CVE-2015-7011 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Itunes

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer6 documents5 sources

Severity

6.8MEDIUMNVD

EPSS

1.7%

top 17.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Itunes Apple Safari

Timeline

PublishedOct 23

Latest updateMay 17

Description

WebKit, as used in Apple Safari before 9.0.1 and iTunes before 12.3.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2015-10-21-3 and APPLE-SA-2015-10-21-5.

CVSS vector

AV:N/AC:M/C:P/I:P/A:PExploitability: 8.6 | Impact: 6.4

Affected Packages2 packages

▶NVDapple/itunes12.3.0

▶NVDapple/safari9.0

🔴Vulnerability Details

GHSA

GHSA-mjqw-qqhj-w4r3: WebKit, as used in Apple Safari before 9↗2022-05-17

▶

CVEList

CVE-2015-7011: WebKit, as used in Apple Safari before 9↗2015-10-23

▶

OSV

CVE-2015-7011: WebKit, as used in Apple Safari before 9↗2015-10-23

▶

📋Vendor Advisories

Apple

CVE-2015-7011: iTunes 12.3.1↗

▶

Apple

CVE-2015-7011: Safari 9.0.1↗

▶