CVE-2014-4474: Medium severity itunes vulnerability

Q: What is the severity of CVE-2014-4474?

CVE-2014-4474 has a severity that allows remote execution of arbitrary code or denial of service through memory corruption.

Q: How do I fix CVE-2014-4474?

To fix CVE-2014-4474, update your Apple Safari or iTunes to the latest version available.

Q: What versions of Safari are affected by CVE-2014-4474?

CVE-2014-4474 affects Apple Safari versions prior to 6.2.1, all 7.x versions before 7.1.1, and all 8.x versions before 8.0.1.

Q: Can CVE-2014-4474 affect my iPhone?

Yes, CVE-2014-4474 can affect iPhone OS versions up to 8.1.2.

Q: Which Apple software is vulnerable due to CVE-2014-4474?

CVE-2014-4474 impacts Apple Safari and iTunes versions listed in the vulnerability details, including Safari version 6.2.0 and below.

Published Dec 10, 2014

Updated

WebKit, as used in Apple Safari before 6.2.1, 7.x before 7.1.1, and 8.x before 8.0.1, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site, a different vulnerability than other WebKit CVEs listed in APPLE-SA-2014-12-2-1.

Affected Software

13 affected components

Apple iTunes<=12.1

Apple Safari<=6.2.0

Apple Safari=7.0

Apple Safari=7.0.1

Apple Safari=7.0.2

Apple Safari=7.0.3

Apple Safari=7.0.4

Apple Safari=7.0.5

Apple Safari=7.0.6

Apple Safari=7.1.0

Apple Safari=8.0.0

Apple iPhone OS<=8.1.2

Apple tvOS<=7.0.1

Remediation

Patch Available

http://lists.apple.com/archives/security-announce/2015/Jun/msg00006.html

Event History

Dec 10, 2014

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-4474?

CVE-2014-4474 has a severity that allows remote execution of arbitrary code or denial of service through memory corruption.

How do I fix CVE-2014-4474?