GCVE - cpe:2.3:a:apple:itunes:6.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:apple:itunes:6.0:*:*:*:*:*:*:*

part: a version: 6.0 update: *

Vendor	Apple (`c2b419d0-9f0f-51c1-88dc-2e204a98e1c7`)
Product	Itunes (`070f0504-eb09-503b-89ba-8a3202d30355`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2009-0950`	vulnerable	2026-06-08 04:51:12.480333	Details available Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon. Published: 2009-06-02T18:00:00.000Z Updated: 2024-08-07T04:57:17.367Z Open on db.gcve.eu Reference links http://www.vupen.com/english/advisories/2009/1470 http://www.securityfocus.com/bid/35157 http://secunia.com/advisories/35314 https://www.exploit-db.com/exploits/8934 http://redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3634`	vulnerable	2026-06-08 04:50:35.713735	Details available Apple iTunes before 8.0 on Mac OS X 10.4.11, when iTunes Music Sharing is enabled but blocked by the host-based firewall, presents misleading information about firewall security, which might allow remote attackers to leverage an exposure that would be absent if the administrator were given better information. Published: 2008-09-10T16:00:00.000Z Updated: 2024-09-16T17:14:56.121Z Open on db.gcve.eu Reference links http://lists.apple.com/archives/security-announce//2008/Sep/msg00001.html http://securitytracker.com/id?1020840 http://www.securityfocus.com/bid/31090	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2008-3434`	vulnerable	2026-06-08 04:50:34.694473	Details available Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning. Published: 2008-08-01T14:00:00.000Z Updated: 2024-08-07T09:37:27.087Z Open on db.gcve.eu Reference links http://support.apple.com/kb/HT5030 http://www.infobyte.com.ar/down/Francisco%20Amato%20-%20evilgrade%20-%20ENG.pdf http://lists.apple.com/archives/Security-announce/2011/Nov/msg00003.html https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A17136 http://www.infobyte.com.ar/down/isr-evilgrade-1.0.0.tar.gz	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.