CVE-2011-0191

iTunes < 10.2 - Remote Code Execution via Crafted TIFF Image with JPEG Encoding

Title source: llm
STIX 2.1

Description

Buffer overflow in LibTIFF 3.9.4 and possibly other versions, as used in ImageIO in Apple iTunes before 10.2 on Windows and other products, allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TIFF image with JPEG encoding.

References (18)

Core 18
Core References
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0845
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4564
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4565
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/43934
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4566
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2011/dsa-2210
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011/Mar/msg00006.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46657
Patch, Vendor Advisory vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011/Mar/msg00000.html
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Mar/msg00003.html
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4554
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Mar/msg00004.html
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2011:064
Mailing List vendor-advisory x_refsource_apple
http://lists.apple.com/archives/security-announce/2011//Mar/msg00005.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2011/0859
Vendor Advisory x_refsource_confirm
http://support.apple.com/kb/HT4581

Scores

EPSS 0.0672
EPSS Percentile 93.2%

Details

CWE
CWE-119
Status published
Products (50)
apple/itunes 4.0.0
apple/itunes 4.0.1
apple/itunes 4.1.0
apple/itunes 4.2.0
apple/itunes 4.5
apple/itunes 4.5.0
apple/itunes 4.6
apple/itunes 4.6.0
apple/itunes 4.7
apple/itunes 4.7.0
... and 40 more
Published Mar 03, 2011
Tracked Since Feb 18, 2026