KLA11602 Multiple vulnerabilities in Apple iTunes

Multiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service.

Below is a complete list of vulnerabilities:

1. Multiple memory corruption vulnerabilities in WebKit Process Model can be exploited to execute arbitrary code;
2. Multiple memory corruption vulnerabilities in WebKit can be exploited to execute arbitrary code;
3. A logic vulnerability in WebKit can be exploited to perform cross-site scripting attacks;
4. A dynamic library loading vulnerability in iTunes can be exploited to execute arbitrary code;
5. A memory corruption vulnerability in Graphics Driver can be exploited to execute arbitrary code;
6. The HTTP referrer header vulnerability in WebKit can be exploited to obtain sensitive information.

Original advisories

HT210726

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iTunes

CVE list

CVE-2019-8815 critical

CVE-2019-8782 high

CVE-2019-8822 high

CVE-2019-8823 high

CVE-2019-8808 high

CVE-2019-8783 high

CVE-2019-8811 high

CVE-2019-8813 warning

CVE-2019-8812 high

CVE-2019-8814 critical

CVE-2019-8819 high

CVE-2019-8816 critical

CVE-2019-8801 warning

CVE-2019-8784 critical

CVE-2019-8820 high

CVE-2019-8821 high

CVE-2019-8827 warning

Solution

Update to the latest version

Download iTunes

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iTunes earlier than 12.10.2