CVE-2014-4471: Medium severity itunes vulnerability

Q: What is the severity of CVE-2014-4471?

CVE-2014-4471 is rated as a high severity vulnerability that allows remote code execution and denial of service.

Q: How do I fix CVE-2014-4471?

To fix CVE-2014-4471, update to the latest version of Safari, iTunes, or tvOS that addresses this vulnerability.

Q: Which versions of Safari are affected by CVE-2014-4471?

CVE-2014-4471 affects Safari versions before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1.

Q: Can CVE-2014-4471 affect iOS devices?

Yes, CVE-2014-4471 can affect Apple iPhone OS versions up to and including 8.1.2.

Q: What kind of attack can exploit CVE-2014-4471?

CVE-2014-4471 can be exploited through crafted web pages to execute arbitrary code or cause application crashes.

Published Dec 10, 2014

Updated

WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.

Affected Software

13 affected components

Apple iTunes<=12.1

Apple tvOS<=7.0.1

Apple Safari<=6.2.0

Apple Safari=7.0

Apple Safari=7.0.1

Apple Safari=7.0.2

Apple Safari=7.0.3

Apple Safari=7.0.4

Apple Safari=7.0.5

Apple Safari=7.0.6

Apple Safari=7.1.0

Apple Safari=8.0.0

Apple iPhone OS<=8.1.2

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html

Event History

Dec 10, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4471?

CVE-2014-4471 is rated as a high severity vulnerability that allows remote code execution and denial of service.

How do I fix CVE-2014-4471?