The version of Apple iTunes installed on the remote Windows host is prior to 12.12.3. It is, therefore, affected by multiple vulnerabilities as referenced in the HT213188 advisory.

  - Processing a maliciously crafted image may lead to arbitrary code execution (CVE-2022-22611)

  - Processing a maliciously crafted image may lead to heap corruption (CVE-2022-22612)

  - Processing maliciously crafted web content may disclose sensitive user information (CVE-2022-22662)

  - Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2022-22629)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 12.x prior to 12.3 Monterey. It is, therefore, affected by multiple vulnerabilities, including the following:
  - A use after free issue was addressed with improved memory management. Successful exploitation could   result in arbitrary code execution with kernel privileges (CVE-2022-22614). 

  - A logic issue was addressed with improved state management. Successful exploitation could result in   privilege escalation (CVE-2022-22632).

  - A null pointer dereference was addressed with improved validation. Successful exploitation could   result in a denial of service condition. (CVE-2022-22638).

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 15.4. It is, therefore, affected by multiple vulnerabilities, including the following:

  - A memory corruption issue in the Accelerate Framework that can lead to unexpected application termination     or arbitrary code execution when opening a maliciously crafted PDF. (CVE-2022-22633)

  - A buffer overflow condition in AVEVideoEncoder that allows an application to execute arbitrary code with     kernel privileges. (CVE-2022-22634)

  - An out-of-bounds write issue in AVEVideoEncoder that allows an application to execute arbitrary code with     kernel privileges. (CVE-2022-22636)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
158930	Apple iTunes < 12.12.3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	3/15/2022	11/6/2023	high
159106	macOS 12.x < 12.3 (HT213183)	Nessus	MacOS X Local Security Checks	3/21/2022	11/3/2023	critical
158931	Apple iTunes < 12.12.3 Multiple Vulnerabilities (uncredentialed check)	Nessus	Peer-To-Peer File Sharing	3/15/2022	11/6/2023	high
158972	Apple iOS < 15.4 Multiple Vulnerabilities (HT213182)	Nessus	Mobile Devices	3/16/2022	4/8/2024	critical

Detections

Analytics

Plugins Search

high

critical

high

critical