CVSS: 7.6EPSS: 0%CPEs: 73EXPL: 0CVE-2011-0111
https://notcve.org/view.php?id=CVE-2011-0111
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit, tal como se utiliza en el Apple iTunes anterior a v10.2 en Windows, permite a atacantes de hombre en medio (man-in-the-middle) ejecutar código arbitrario o causar una denegación de servicio (corrupción de memoria y caída de la aplicación) a través de vectores relacionados con la navegación por la iTunes Store, una vulnerabilidad diferente a otros CVEs listados en APPLE-SA-2011-03-02-1. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html http://support.apple.com/kb/HT4554 http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17172 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 0%CPEs: 73EXPL: 0CVE-2011-0121
https://notcve.org/view.php?id=CVE-2011-0121
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit, tal como se utiliza en el iTunes de Apple antes de v10.2 para Windows, permite a los atacantes "man-in-the-middle" ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria y caída de la aplicación)a través de vectores relacionados con la navegación de la tienda iTunes, una vulnerabilidad diferente a los CVE listados en APPLE-SA-2011-03-02-1. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html http://support.apple.com/kb/HT4554 http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17374 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 0%CPEs: 73EXPL: 0CVE-2011-0142
https://notcve.org/view.php?id=CVE-2011-0142
WebKit, as used in Apple iTunes before 10.2 on Windows, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit, tal como se utiliza en el iTunes de Apple antes de v10.2 para Windows, permite a los atacantes "man-in-the-middle" ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria y caída de la aplicación)a través de vectores relacionados con la navegación de la tienda iTunes, una vulnerabilidad diferente a los CVE listados en APPLE-SA-2011-03-02-1. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html http://support.apple.com/kb/HT4554 http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17104 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.0EPSS: 3%CPEs: 74EXPL: 0CVE-2011-0132 – Apple Safari Webkit Runin Box Promotion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0132
Use-after-free vulnerability in the Runin box functionality in the Cascading Style Sheets (CSS) 2.1 Visual Formatting Model implementation in WebKit, as used in Apple iTunes before 10.2 on Windows and Apple Safari, allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. Vulnerabilidad de uso después de liberación en la funcionalidad "Runin box" en las Hojas de Estilo en Cascada (CSS) v2.1 en la implementación de Visual Formatting Model en WebKit, tal como se utiliza en el iTunes de Apple antes de v10.2 para Windows, permite a los atacantes "man-in-the-middle" ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria y caída de la aplicación)a través de vectores relacionados con la navegación de la tienda iTunes, una vulnerabilidad diferente a los CVE listados en APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way the WebKit library implements the requirements required for a Runin box as outlined in the Visual Formatting Model listed in the CSS 2.1 Specification. When promoting a run-in element the application will incorrectly free one of the child elements of the run-in. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html http://support.apple.com/kb/HT4554 http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.zerodayinitiative.com/advisories/ZDI-11-098 • CWE-399: Resource Management Errors •
CVSS: 9.7EPSS: 1%CPEs: 73EXPL: 0CVE-2011-0133 – Apple Webkit Font Glyph Layout Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2011-0133
WebKit, as used in Apple iTunes before 10.2 on Windows, does not properly access glyph data during layout actions for floating blocks associated with pseudo-elements, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via vectors related to iTunes Store browsing, a different vulnerability than other CVEs listed in APPLE-SA-2011-03-02-1. WebKit, tal como se utiliza en el iTunes de Apple antes de v10.2 para Windows, no accede correctamente a los datos glifo durante las acciones de diseño para los bloques flotantes asociadas a los pseudo-elementos, lo que permite a los atacantes "man-in-the-middle" ejecutar código de su elección o causar una denegación de servicio (corrupción de memoria y caída de la aplicación)a través de vectores relacionados con la navegación de la tienda iTunes, una vulnerabilidad diferente a los CVE listados en APPLE-SA-2011-03-02-1. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari's Webkit. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the way the application handles floating blocks in certain situations. When performing layout operations for a floating block produced by a pseudo-element, the application will attempt to access glyph data that hasn't been fully assigned into the glyph data hashmap. • http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html http://support.apple.com/kb/HT4554 http://support.apple.com/kb/HT4564 http://support.apple.com/kb/HT4566 http://www.zerodayinitiative.com/advisories/ZDI-11-099 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17072 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •