Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1990 iTunes 12.8 for Windows released 10 July 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Apple iTunes Publisher: Apple Operating System: Windows Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction Denial of Service -- Remote with User Interaction Access Confidential Data -- Remote with User Interaction Reduced Security -- Unknown/Unspecified Resolution: Patch/Upgrade CVE Names: CVE-2018-4293 CVE-2018-4284 CVE-2018-4278 CVE-2018-4273 CVE-2018-4272 CVE-2018-4271 CVE-2018-4270 CVE-2018-4267 CVE-2018-4266 CVE-2018-4265 CVE-2018-4264 CVE-2018-4263 CVE-2018-4262 CVE-2018-4261 Reference: ESB-2018.1985 Original Bulletin: https://support.apple.com/en-au/HT208933 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-7-9-7 iTunes 12.8 for Windows iTunes 12.8 for Windows is now available and addresses the following: CFNetwork Available for: Windows 7 and later Impact: Cookies may unexpectedly persist in Safari Description: A cookie management issue was addressed with improved checks. CVE-2018-4293: an anonymous researcher WebKit Available for: Windows 7 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4270: found by OSS-Fuzz WebKit Available for: Windows 7 and later Impact: A malicious website may exfiltrate audio data cross-origin Description: Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking. CVE-2018-4278: Jun Kokatsu (@shhnjk) WebKit Available for: Windows 7 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4284: Found by OSS-Fuzz WebKit Available for: Windows 7 and later Impact: A malicious website may be able to cause a denial of service Description: A race condition was addressed with additional validation. CVE-2018-4266: found by OSS-Fuzz WebKit Available for: Windows 7 and later Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day Initiative CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero Day Initiative CVE-2018-4272: found by OSS-Fuzz WebKit Available for: Windows 7 and later Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2018-4271: found by OSS-Fuzz CVE-2018-4273: found by OSS-Fuzz Installation note: iTunes 12.8 for Windows may be obtained from: https://www.apple.com/itunes/download/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ - -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDzcUpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCbdnxAA zGhbDAoZ7cRpe6EOlY6tjXDSfzVdLcAfpjf0dvOnfCnm1Rzo6QhCX0eyw0jRfNRn tK0h2ub70Uxn5RpIu/I8OoHUnF0XH+6VUIdiuuXSeyv3KuvMiQ4vp0V5uDKZRXWJ e9Rm+7aDR/L3c4vBc5JhVRytOkHDVWhuTkirIHhrPHTiAH/3/bG2XB/bvNipOokL d8GDlk1C1txZ7oWJVTp6yvRMS5ByMGU6XEa9QbA/qEU2KOxpllQGsEtNAcRevLtm YX6zeXQPl2hx2OVyG2j1vEatRR28uQqOoi5WsAa5vQAmrK+9/laL0jNkjdy1KAM8 QXkVjM0SYlDVhBmw5+kj1dFCmJcQSN6xb//X8QGDgCS9behuI2fRWzKZK84/EV1L 1Oo7HDX3tWQWdMr4henOhjNZsko9iSIP/Ie4NWvlWdYOfopN6u23vxGrmzB1awz7 Ds7g8HTrwUiDVclIso6idmpLNFXxmeGMwJnhO7M1KqajJ2TI/lm6nPgMiojGmaW0 2cOoGEwPtXAT2rzsYB3HzVpMEaOrY4/TZFnRC3PU8GLvIdljWGR8R+zp7sCLgMyZ OUp1BD8r7p0oKKoNeoQWfVJQchP0A3z2+w+p0fAIRUSJ5+ty1m6bFBwpaWYROwOh 0fQ6E6REXfQc6jDyyLCQJsNMsKclLUadP/3N6VYZWBA= =4sxp - -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/apple-security-announce%40auscert.org.au This email sent to apple-security-announce@auscert.org.au - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW0P61WaOgq3Tt24GAQhQxQ/9GGvruuB+X3hsToHmaDuHC+hKqCJpiiyo 2mbzehHrtupYMBCQX05bJBna+037nBdYWWkUUNt6eOOAeQZ3RS+IR3rUYwuwao3K D9JOzheCsX4lTmEHn6pjD1kUGO9ZI0nf8Jtfeh9Ken7hcFSprFXU50KhvYrNafCx hIrK3eeX1rXSnjZ4KbPeKUh3CsMF4BhwvWhvd7MPkGusgrfrnfki4ue7pKmmlkAf KGjjJYXtJ/QbvQ5gJyR86wGjvQ8+N/GphMntMbQSyA/79NlR4vEGKvAZ9rL5DfAw IjHR8OBgG/9bc20/MLxxH5w1t/aGTcsVWr1vLAwxfmz5gEGy7sOWhcnTyCb26bDB DgGGJXW9CIp1mz3Z+0VXedgqsKlG01TrykERgkYa8kiCX3seHE/aqGeCnoGx/Xps Hsqqrqa5i33VA3o+8jn8voaYYn72638hU86Z28Lu0v9Atvakv+FMp4Df0CZVUAIA 6ic4slsORE143U+iDW5iHfRxWdQYY2wkJSeP7b3tO8hkh30Gpl6oI13zOI7LTx1t bF3zg99V1ERvZZAebMzpF29NQhNUy7aui/gsLsJYBIrHg5llKYKyB69UAGFOEfjK sBSNH3y7M27BZ4Iw8jXaSX6HzuD25kcqhtNDpQSR5s528Jp/477oDIa6ixsimH9u xtg3MKH1kts= =L6oO -----END PGP SIGNATURE-----