full-disclosure - [FD] APPLE-SA-2021-09-20-10 iTunes 12.12 for Windows

Open Source and information security mailing list archives

Message-id: <1D74F03E-4C53-4EFE-9D9E-05A88F5E8413@lists.apple.com>
Date: Mon, 20 Sep 2021 14:44:40 -0700
From: product-security-noreply--- via Fulldisclosure
 <fulldisclosure@...lists.org>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-2021-09-20-10 iTunes 12.12 for Windows

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2021-09-20-10 iTunes 12.12 for Windows

iTunes 12.12 for Windows addresses the following issues.
Information about the security content is also available at
https://support.apple.com/HT212817.

ImageIO
Available for: Windows 10 and later
Impact: Processing a maliciously crafted image may lead to arbitrary
code execution
Description: This issue was addressed with improved checks.
CVE-2021-30835: Ye Zhang of Baidu Security
CVE-2021-30847: Mike Zhang of Pangu Lab

WebKit
Available for: Windows 10 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2021-30849: Sergei Glazunov of Google Project Zero

Installation note:

iTunes 12.9.3 for Windows may be obtained from:
https://www.apple.com/itunes/download/

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEePiLW1MrMjw19XzoeC9qKD1prhgFAmFI+ioACgkQeC9qKD1p
rhi2zA/+OfhE7uhWLfTWj2Fpa8OUx4eljZcPG+9gNrJErjf2dgB6mzXUmQa2/r5+
+xHCFsqyu/DQP6KQ1D5y1juLec43zbbSv8VtQjuE1FjvGemCOEBSDrVzEiRF799t
x9IUrRKvoKmFDt6uyNYUYkh/98w6XdKe75m4GI+0nzIPLdVjeP4bf+NrvT22n+cc
WyXZy9vIAP3fOJmnaU5+kD6yJ8UdFrZzlnpxNY2UeqgQ9g1jscA9s2w/1cJT+Ae7
Bv6doPG8wW+sG8CFJ6m+MZuVE4+I22S4kNlxicc1JaV7FM9txt3Wa7/tgyFnTK4S
SqtuSKZSjsimuYbxPPYqLwpmn/5tV4p2Y9SuAhMm3NgQSY/qK/W52/zNlj6CaTsk
U5dS9flhLh21vCskyRLSB8V/LG0oF8Eyfp+vktd1BLTahX3y13x4+xcJ37NQKJl6
byhDXFyTatFGkK9tImLuCgrkkl2O6iNCncBQtSmUejGCrLVQOxe/RVMOHWxqyvX1
NX3+pGImGmY1Uey/QjoTNigc7n6f0636ZW2B1bVWznU3foHhqbeBXUtL6ztWYadF
fWi3TBaJc4gp6VYZtT0o5OQkxCU0Chgw6JJ3t0bxqKUv6RL9eVqqHMEnyZmEuz3F
W9vfD0DKwcRExP2ZLCweBB5TxQLq9yzkWmhPmaeYq9fVjDLhcKU=
=eM6x
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives