The version of Apple iTunes running on the remote host is prior to 12.6.2. It is, therefore, affected by multiple vulnerabilities :

  - Multiple out-of-bounds read errors exist in the libxml2     component due to improper handling of specially crafted     XML documents. An unauthenticated, remote attacker can     exploit these to disclose user information.
    (CVE-2017-7010, CVE-2017-7013)

  - Multiple memory corruption issues exist in the Webkit     Web Inspector component due to improper validation of     user-supplied input. An unauthenticated, remote attacker     can exploit these, via a specially crafted web page, to     corrupt memory, resulting in the execution of arbitrary     code. (CVE-2017-7012)

  - Multiple memory corruption issues exist in the WebKit     component due to improper validation of input. An     unauthenticated, remote attacker can exploit these     issues, via a specially crafted web page, to execute     arbitrary code. (CVE-2017-7018, CVE-2017-7020,     CVE-2017-7030, CVE-2017-7034, CVE-2017-7037,     CVE-2017-7039, CVE-2017-7040, CVE-2017-7041,     CVE-2017-7042, CVE-2017-7043, CVE-2017-7046,     CVE-2017-7048, CVE-2017-7049, CVE-2017-7052,     CVE-2017-7055, CVE-2017-7056, CVE-2017-7061)

  - A memory corruption issue exists in the 'WebKit Page     Loading' component due to improper validation of input.
    An unauthenticated, remote attacker can exploit this,     via a specially crafted web page, to execute arbitrary     code. (CVE-2017-7019)

  - A flaw exists in the iPodService component when handling     the iPodManager COM control due to insufficient access     restrictions. A local attacker can exploit this, via     a specially crafted application, to execute arbitrary     code with system privileges. (CVE-2017-7053)

  - An unspecified memory initialization issue exists in     Webkit. A local attacker can exploit this, via a     specially crafted application, to disclose the contents     of restricted memory. (CVE-2017-7064)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for webkit2gtk3 fixes the following issues :

Update to version 2.18.5 :

  + Disable SharedArrayBuffers from Web API.

  + Reduce the precision of 'high' resolution time to 1ms.

  + bsc#1075419 - Security fixes: includes improvements to     mitigate the effects of Spectre and Meltdown     (CVE-2017-5753 and CVE-2017-5715).

Update to version 2.18.4 :

  + Make WebDriver implementation more spec compliant.

  + Fix a bug when trying to remove cookies before a web     process is spawned.

  + WebKitWebDriver process no longer links to     libjavascriptcoregtk.

  + Fix several memory leaks in GStreamer media backend.

  + bsc#1073654 - Security fixes: CVE-2017-13866,     CVE-2017-13870, CVE-2017-7156, CVE-2017-13856.

Update to version 2.18.3 :

  + Improve calculation of font metrics to prevent     scrollbars from being shown unnecessarily in some cases.

  + Fix handling of null capabilities in WebDriver     implementation.

  + Security fixes: CVE-2017-13798, CVE-2017-13788,     CVE-2017-13803.

Update to version 2.18.2 :

  + Fix rendering of arabic text.

  + Fix a crash in the web process when decoding GIF images.

  + Fix rendering of wind in Windy.com.

  + Fix several crashes and rendering issues.

Update to version 2.18.1 :

  + Improve performance of GIF animations.

  + Fix garbled display in GMail.

  + Fix rendering of several material design icons when     using the web font.

  + Fix flickering when resizing the window in Wayland.

  + Prevent default kerberos authentication credentials from     being used in ephemeral sessions.

  + Fix a crash when webkit_web_resource_get_data() is     cancelled.

  + Correctly handle touchmove and touchend events in     WebKitWebView.

  + Fix the build with enchant 2.1.1.

  + Fix the build in HPPA and Alpha.

  + Fix several crashes and rendering issues.

  + Security fixes: CVE-2017-7081, CVE-2017-7087,     CVE-2017-7089, CVE-2017-7090, CVE-2017-7091,     CVE-2017-7092, CVE-2017-7093, CVE-2017-7094,     CVE-2017-7095, CVE-2017-7096, CVE-2017-7098,     CVE-2017-7099, CVE-2017-7100, CVE-2017-7102,     CVE-2017-7104, CVE-2017-7107, CVE-2017-7109,     CVE-2017-7111, CVE-2017-7117, CVE-2017-7120,     CVE-2017-7142.

  - Enable gold linker on s390/s390x on SLE15/Tumbleweed.

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
101955	Apple iTunes < 12.6.2 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	2017/7/25	2026/10/12	high
106549	openSUSE Security Update : webkit2gtk3 (openSUSE-2018-118) (Meltdown) (Spectre)	Nessus	SuSE Local Security Checks	2018/2/1	2026/1/13	high

検出

プラグインの検索

high

high