An issue was discovered in certain Apple products. iOS before 10.3 is affected. Safari before 10.1 is affected. iCloud before 6.2 on Windows is affected. iTunes before 12.6 on Windows is affected. tvOS before 10.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Versions of iTunes prior to 12.6 are affected by multiple vulnerabilities :

 - A use-after-free condition exists that is triggered when handling RenderBox objects. With specially crafted web content, a context-dependent attacker can dereference already freed memory and potentially execute arbitrary code. (CVE-2017-2463)
 - A flaw exists that allows a universal cross-site scripting (UXSS) attack. This flaw exists because the 'notifyChildNodeRemoved()' function in 'WebCore/dom/ContainerNodeAlgorithms.cpp' executes script code synchronously. This may allow a context-dependent attacker to create a specially crafted web page that executes arbitrary script code in a user's browser session within the trust relationship between their browser and any server. (CVE-2017-2479)
 - A flaw exists that allows a UXSS attack. This flaw exists because the program does not properly revalidates the 'SubframeLoader::requestFrame()' function in 'WebCore/loader/SubframeLoader.cpp'. This may allow a context-dependent attacker to create a specially crafted web page that executes arbitrary script code in a user's browser session within the trust relationship between their browser and any server. (CVE-2017-2480)

The version of Apple iTunes running on the remote host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple iTunes installed on the remote Windows host is prior to 12.6. It is, therefore, affected by multiple vulnerabilities :

  - Multiple vulnerabilities exist in the expat component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2009-3270,     CVE-2009-3560, CVE-2009-3720, CVE-2012-1147,     CVE-2012-1148, CVE-2012-6702, CVE-2015-1283,     CVE-2016-0718, CVE-2016-4472, CVE-2016-5300)

  - Multiple vulnerabilities exist in the SQLite component,     the most severe of which are remote code execution     vulnerabilities. An unauthenticated, remote attacker can     exploit these vulnerabilities by convincing a user to     open a specially crafted file, to cause a denial of     service condition or the execution of arbitrary code in     the context of the current user. (CVE-2013-7443,     CVE-2015-3414, CVE-2015-3415, CVE-2015-3416,     CVE-2015-3717, CVE-2015-6607, CVE-2016-6153)

  - An information disclosure vulnerability exists in the     APNs server component due to client certificates being     transmitted in cleartext. A man-in-the-middle attacker     can exploit this to disclose sensitive information.
    (CVE-2017-2383)

  - A use-after-free error exists in the WebKit component     due to improper handling of RenderBox objects. An     unauthenticated, remote attacker can exploit this to     execute arbitrary code. (CVE-2017-2463)

  - Multiple universal cross-site scripting (XSS)     vulnerabilities exist in the WebKit component due to     improper validation of user-supplied input. An     unauthenticated, remote attacker can exploit these     vulnerabilities, by convincing a user to visit a     specially crafted web page, to execute arbitrary script     code in a user's browser session. (CVE-2017-2479,     CVE-2017-2480, CVE-2017-2493)

  - An integer overflow condition exists in the libxslt     component in the xsltAddTextString() function in     transform.c due to improper validation of user-supplied     input. An unauthenticated, remote attacker can exploit     this to cause an out-of-bounds write, resulting in the     execution of arbitrary code. (CVE-2017-5029)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 10.1. It is, therefore, affected by multiple vulnerabilities:

  - An out-of-bounds read error exists in WebKit when     handling certain JavaScript code. An unauthenticated,     remote attacker can exploit this to cause a denial of     service condition or the disclosure of memory contents.
    (CVE-2016-9642)

  - A denial of service vulnerability exists in WebKit when     handling certain regular expressions. An     unauthenticated, remote attacker can exploit this, via a     specially crafted web page, to exhaust available memory     resources. (CVE-2016-9643)

  - Multiple information disclosure vulnerabilities exist     in WebKit when handling page loading due to improper     validation of certain input. An unauthenticated, remote     attacker can exploit these to disclose data     cross-origin. (CVE-2017-2364, CVE-2017-2367)

  - An unspecified state management flaw exists that allows     an unauthenticated, remote attacker to spoof the address     bar. (CVE-2017-2376)

  - A denial of service vulnerability exists in the Web     Inspector component when closing a window while the     debugger is paused. An unauthenticated, remote attacker     can exploit this to terminate the application.
    (CVE-2017-2377)

  - An unspecified flaw exists in WebKit when creating     bookmarks using drag-and-drop due to improper validation     of certain input. An unauthenticated, remote attacker     can exploit this, via a specially crafted link, to spoof     bookmarks or potentially execute arbitrary code.
    (CVE-2017-2378)

  - An information disclosure vulnerability exists in the     Login AutofFill component that allows a local attacker     to access keychain items. (CVE-2017-2385)

  - Multiple information disclosure vulnerabilities exist     in WebKit when handling unspecified exceptions or     elements. An unauthenticated, remote attacker can     exploit these, via specially crafted web content, to     disclose data cross-origin. (CVE-2017-2386,     CVE-2017-2479, CVE-2017-2480)

  - An unspecified flaw exists in the handling of HTTP     authentication that allows an unauthenticated, remote     attacker to disclose authentication sheets on arbitrary     websites or cause a denial of service condition.
    (CVE-2017-2389)

  - Multiple memory corruption issues exist in WebKit that     allow an unauthenticated, remote attacker to cause a     denial of service condition or the execution of     arbitrary code. (CVE-2017-2394, CVE-2017-2395,     CVE-2017-2396, CVE-2017-2433, CVE-2017-2454,     CVE-2017-2455, CVE-2017-2459, CVE-2017-2460,     CVE-2017-2464, CVE-2017-2465, CVE-2017-2466,     CVE-2017-2468, CVE-2017-2469, CVE-2017-2470,     CVE-2017-2476)

  - A memory corruption issue exists in WebKit within the     Web Inspector component due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this to cause a denial of service condition or     the execution of arbitrary code. (CVE-2017-2405)

  - An unspecified type confusion error exists that allows     an unauthenticated remote attacker to execute arbitrary     code by using specially crafted web content.
    (CVE-2017-2415)

  - A security bypass vulnerability exists in WebKit that     allows an unauthenticated, remote attacker to bypass the     Content Security Policy by using specially crafted web     content. (CVE-2017-2419)

  - An unspecified flaw exists in WebKit when handling     OpenGL shaders that allows an unauthenticated, remote     attacker to disclose process memory content by using     specially crafted web content. (CVE-2017-2424)

  - An information disclosure vulnerability exists in WebKit     JavaScript Bindings when handling page loading due to     unspecified logic flaws. An unauthenticated, remote     attacker can exploit this, via specially crafted web     content, to disclose data cross-origin. (CVE-2017-2442)

  - A memory corruption issue exists in WebKit within the     CoreGraphics component due to improper validation of     certain input. An unauthenticated, remote attacker can     exploit this, via specially crafted web content, to     cause a denial of service condition or the execution of     arbitrary code. (CVE-2017-2444)

  - A universal cross-site scripting (XSS) vulnerability     exists in WebKit when handling frame objects due to     improper validation of certain input. An     unauthenticated, remote attacker can exploit this, via     specially crafted web content, to execute arbitrary     script code in a user's browser session. (CVE-2017-2445)

  - A flaw exists in WebKit due to non-strict mode functions     that are called from built-in strict mode scripts not     being properly restricted from calling sensitive native     functions. An unauthenticated, remote attacker can     exploit this, via specially crafted web content, to     execute arbitrary code. (CVE-2017-2446)

  - An out-of-bounds read error exists in WebKit when     handling the bound arguments array of a bound function.
    An unauthenticated, remote attacker can exploit this,     via specially crafted web content, to disclose memory     contents. (CVE-2017-2447)

  - An unspecified flaw exists in FaceTime prompt handling     due to improper validation of certain input. An     unauthenticated, remote attacker can exploit this to     spoof user interface elements. (CVE-2017-2453)

  - A use-after-free error exists in WebKit when handling     RenderBox objects. An unauthenticated, remote attacker     can exploit this, via specially crafted web content, to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2463)

  - An unspecified use-after-free error exists in WebKit     that allows an unauthenticated, remote attacker, via     specially crafted web content, to dereference already     freed memory, resulting in the execution of arbitrary     code. (CVE-2017-2471)

  - A universal cross-site scripting (XSS) vulnerability     exists in WebKit when handling frames due to improper     validation of certain input. An unauthenticated, remote     attacker can exploit this, via specially crafted web     content, to execute arbitrary script code in a user's     browser session. (CVE-2017-2475)

  - A use-after-free error exists in WebKit when handling     ElementData objects. An unauthenticated, remote attacker     can exploit this, via specially crafted web content, to     dereference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2481)

  - A use-after-free error exists in JavaScriptCore when     handling the String.replace() method. An     unauthenticated, remote attacker can exploit this to     deference already freed memory, resulting in the     execution of arbitrary code. (CVE-2017-2491)

  - A universal cross-site scripting (XSS) vulnerability     exists in JavaScriptCore due to an unspecified prototype     flaw. An unauthenticated, remote attacker can exploit     this, via a specially crafted web page, to execute     arbitrary code in a user's browser session.
    (CVE-2017-2492)

ID	Name	Product	Family	Severity
700114	iTunes < 12.6 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	medium
100026	Apple iTunes < 12.6 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	critical
100025	Apple iTunes < 12.6 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
99167	macOS : Apple Safari < 10.1 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high

Detections

Analytics

CVE-2017-2463

high

Tenable Plugins

medium

critical

critical

high