The version of Apple iTunes on the remote host is prior to version 12.0.1. It is, therefore, affected by multiple vulnerabilities related to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Apple Safari installed on the remote Mac OS X host is a version prior to 6.1.5 or 7.0.5. It is, therefore, affected by the following vulnerabilities :

  - Multiple memory corruption vulnerabilities exist in     WebKit that could lead to unexpected program     termination or arbitrary code execution.
    (CVE-2014-1325, CVE-2014-1340, CVE-2014-1362,     CVE-2014-1363, CVE-2014-1364, CVE-2014-1365,     CVE-2014-1366, CVE-2014-1367, CVE-2014-1368,     CVE-2014-1382)

  - An error exists in WebKit related to domains in URLs     and encoding that could allow spoofing attacks.
    (CVE-2014-1345)

  - An error exists in WebKit related to handling URLs     being dragged between windows that could allow     disclosure of local file content. (CVE-2014-1369)

The version of Apple iTunes installed on the remote Windows host is prior to 12.0.1. It is, therefore, affected by multiple vulnerabilities due to the included version of WebKit. The errors could lead to application crashes or arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host has Safari installed that is older than 6.1.4 or 7.0.4, and is thus unpatched for the following WebKit vulnerabilities :

 - Multiple memory corruption issues within WebKit, which were addressed through improved memory handling (CVE-2014-1325, CVE-2014-1340, CVE-2014-1362, CVE-2014-1363, CVE-2014-1364, CVE-2014-1365, CVE-2014-1366, CVE-2014-1367, CVE-2014-1368, CVE-2014-1382)
 - URL spoofing vulnerability due to improper encoding of domain names (CVE-2014-1345)
 - Information disclosure vulnerability wherein URLs dragged between windows could allow disclosure of local file content (CVE-2014-1369)

Versions of iTunes earlier than 12.0.1 are missing updates that patch memory corruption vulnerabilities within WebKit, as well as a patch that fixes a man-in-the-middle vulnerability that affects encrypted connections to the iTunes Store via iTunes. The most severe of these vulnerabilites can result in arbitrary remote code execution or unexpected application termination.

ID	Name	Product	Family	Published	Updated	Severity
78598	Apple iTunes < 12.0.1 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	10/21/2014	11/15/2018	critical
76316	Mac OS X : Apple Safari < 6.1.5 / 7.0.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	6/30/2014	11/26/2019	medium
78597	Apple iTunes < 12.0.1 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	10/21/2014	11/15/2018	critical
8324	Safari < 6.1.5 / 7.0.5 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	6/8/2014	3/6/2019	medium
8561	iTunes < 12.0.1 Multiple Vulnerabilities	Nessus Network Monitor	Web Clients	10/20/2014	3/6/2019	critical

Detections

Analytics

Plugins Search

critical

medium

critical

medium

critical