WebKit, as used in Apple Safari before 6.2.6, 7.x before 7.1.6, and 8.x before 8.0.6, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than CVE-2015-1152 and CVE-2015-1153.

The version of Apple iTunes running on the remote host is prior to 12.2. It is, therefore, affected by multiple vulnerabilities due to memory corruption issues in the WebKit component. An attacker can exploit these to cause a denial of service or execute arbitrary code.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Safari installed on the remote host is prior to 6.2.6 / 7.1.6 / 8.0.6 and is affected by the following vulnerabilities :

 - Multiple memory corruption issues in WebKit due to improper validation of user-supplied input. A remote attacker can exploit this, via a specially crafted web page, to cause a denial of service condition or to execute arbitrary code. (CVE-2015-1152, CVE-2015-1153, and CVE-2015-1154)
 - An information disclosure vulnerability in WebKit History exists due to a state management flaw and improper validation of user-supplied input. A remote attacker can exploit this, via a specially crafted web page, to disclose sensitive information from the file system. (CVE-2015-1155)
 - A flaw exists in WebKit Page Loading due to improper handling of rel attributes in anchor elements that allows target objects to get unauthorized access to link objects. A remote attacker can exploit this, via a specially crafted web page, to spoof the user interface. (CVE-2015-1156)

The version of Apple iTunes installed on the remote Windows host is prior to 12.2. It is, therefore, affected by multiple vulnerabilities in the bundled version of WebKit, including denial of service and arbitrary code execution vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote Mac OS X host is prior to 6.2.6 / 7.1.6 / 8.0.6. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption issues in WebKit due to     improper validation of user-supplied input. A remote     attacker can exploit this, via a specially crafted     web page, to cause a denial of service condition or to     execute arbitrary code. (CVE-2015-1152, CVE-2015-1153,     and CVE-2015-1154)

  - An information disclosure vulnerability in WebKit     History exists due to a state management flaw and     improper validation of user-supplied input. A remote     attacker can exploit this, via a specially crafted web     page, to disclose sensitive information from the file     system. (CVE-2015-1155)     
  - A flaw exists in WebKit Page Loading due to improper     handling of rel attributes in anchor elements that     allows target objects to get unauthorized access to link     objects. A remote attacker can exploit this, via a     specially crafted web page, to spoof the user interface.
    (CVE-2015-1156)

ID	Name	Product	Family	Severity
86600	Apple iTunes < 12.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	high
8870	Safari < 6.2.6 / 7.1.6 / 8.0.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	high
84504	Apple iTunes < 12.2 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	high
83291	Mac OS X : Apple Safari < 6.2.6 / 7.1.6 / 8.0.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	medium

Detections

Analytics

CVE-2015-1154

high

Tenable Plugins

high

high

high

medium