KLA12356 RCE vulnerability in Apple iTunes

Remote code execution vulnerability was found in Apple iTunes U for iOS and iPadOS. Malicious users can exploit this vulnerability to execute arbitrary code.

Original advisories

About the security content of iTunes U 3.8.3

Related products

Apple-iTunes

CVE list

CVE-2021-30862 high

Solution

Update to the latest version

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iTunes U earlier than 3.8.3