CVE-2024-44193

iTunesを通じたWindowsハッキング - ローカル権限昇格の0-day CVE-2024–44193の紹介 これは、iTunesバージョン12.13.2.3におけるローカル権限昇格（Local Privilege Escalation）エクスプロイトであるCVE-2024–44193に関するライトアップです。 これは2024年9月12日にAppleによって修正されました。 Appleのセキュリティアドバイザリへのリンク: Appleのセキュリティアドバイザリ iTunesバージョン12.13.2.3は、Apple Device Discovery Serviceをインストールしま...

CVE-2021-30862

CVE-2021-30862 2021年、CodeColorist氏はMistuned脆弱性に関する記事を公開しました。これはiTunes Storeに影響を及ぼす一連の脆弱性で、ワンクリックでのリモートコード実行を可能にします。特筆すべきは、メモリ破壊を伴わず、単なるロジックバグだけで電卓を起動させたことです。この時期、私はさまざまなアプリのURLスキームを調査していました。というのも、2年前にApp Storeのitms-services:// URLスキームに関するセキュリティ問題を報告していたからです。私が見つけた非常に類似したURLスキームの1つが、iTunes...

CVE-2023-32353-PoC

CVE-2023-32353 概念実証 免責事項 この概念実証コードは教育目的で公開されています。 同様の脆弱性を発見し、責任を持って報告し、修正することを促進するためのものです。 2023年5月23日、Appleはこの脆弱性の修正を公開しました。 iTunesを最新バージョン（少なくとも12.12.9）にアップデートすることを推奨します。 私はこのCVEを発見したわけではなく、このPoCを作成しただけです。「クレジット」セクションをお読みください。 私もこのリポジトリもAppleとは提携関係にありません。...

CVE-2018-4293

A cookie management issue was addressed with improved checks. This issue affected versions prior to iOS 11.4.1, macOS High Sierra 10.13.6, tvOS 11.4.1, watchOS 4.3.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...

CVE-2018-4374

A logic issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

CVE-2018-4437

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9...

CVE-2018-4284

A type confusion issue was addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...

CVE-2018-4464

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9...

CVE-2018-4266

A race condition was addressed with additional validation. This issue affected versions prior toiVersions prior to: OS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...

CVE-2018-4312

A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

CVE-2018-4316

A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7...

CVE-2018-4271

Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...

CVE-2018-4442

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9...

CVE-2018-4378

A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12.1, tvOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

CVE-2018-4267

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...

CVE-2018-4375

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1, watchOS 5.1, Safari 12.0.1, iTunes 12.9.1, iCloud for Windows 7.8...

CVE-2018-4438

A logic issue existed resulting in memory corruption. This was addressed with improved state management. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9...

CVE-2018-4443

A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9...

CVE-2018-4412

A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, iTunes 12.9 for Windows, iCloud for Windows 7.7...

CVE-2018-4263

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6...