SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Multimedia)  >   Apple iTunes Vendors:   Apple
(Apple Issues Fix for Apple iTunes) Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code
SecurityTracker Alert ID:  1033592
SecurityTracker URL:  http://securitytracker.com/id/1033592
CVE Reference:   CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749   (Links to External Site)
Date:  Sep 16 2015
Impact:   Disclosure of system information, Disclosure of user information, Execution of arbitrary code via network, Modification of system information, Modification of user information, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): prior to 12.3
Description:   Multiple vulnerabilities were reported in Apple Safari. A remote user can cause arbitrary code to be executed on the target user's system. A remote user can bypass security controls on the target system. A remote user can obtain potentially sensitive information on the target system. A remote user can spoof the user interface. A remote user can spoof URLs. Apple iTunes is affected.

A remote user can create a specially crafted file that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2015-3730, CVE-2015-3731, CVE-2015-3732, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, CVE-2015-3749].

A remote user can create a specially crafted web site that, when loaded by the target user, will spoof the user interface [CVE-2015-3729].

A remote web server can cause the target browser to fail to use HTTP Strict Transport Security for Content Security Policy reports [CVE-2015-3750].

A remote server with video controls can load images nested in object elements in violation of the Content Security Policy for that server [CVE-2015-3751].

A remote user can obtain cookies from a different domain via a Content Security Policy report [CVE-2015-3752].

A remote server can access image data from a different domain [CVE-2015-3753].

Authentication data from private browsing mode may be cached during non-private mode browsing [CVE-2015-3754]. As a result, part of the target user's private browsing history may be exposed.

A remote user can create a specially crafted URL that, when loaded by the target user, will allow the web site to display an arbitrary URL [CVE-2015-3755].

Code Audit Labs of VulnHunt.com, Muneaki Nishimura (nishimunea), Antonio Sanso and Damien Antipa of Adobe, xisigr of Tencent's Xuanwu Lab, and Dongsung Kim (@kid1ng) reported these vulnerabilities.

Impact:   A remote user can create content that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote user can bypass security controls on the target system.

A remote user can obtain potentially sensitive information on the target system.

A remote user can spoof the user interface.

A remote user can spoof a URL.

Solution:   Apple has issued a fix for CVE-2015-3730, CVE-2015-3731, CVE-2015-3733, CVE-2015-3734, CVE-2015-3735, CVE-2015-3736, CVE-2015-3737, CVE-2015-3738, CVE-2015-3739, CVE-2015-3740, CVE-2015-3741, CVE-2015-3742, CVE-2015-3743, CVE-2015-3744, CVE-2015-3745, CVE-2015-3746, CVE-2015-3747, CVE-2015-3748, and CVE-2015-3749 for Apple iTunes (12.3).

The Apple advisory is available at:

https://support.apple.com/en-us/HT205221

Vendor URL:  support.apple.com/en-us/HT205221 (Links to External Site)
Cause:   Access control error, Authentication error, Input validation error
Underlying OS:  Windows (7), Windows (8), Windows (10)

Message History:   This archive entry is a follow-up to the message listed below.
Aug 13 2015 Apple Safari Flaws Let Remote Users Bypass Security Controls, Obtain Potentially Sensitive Information, Spoof Interfaces and URLS, and Execute Arbitrary Code



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC