-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 APPLE-SA-2016-12-13-3 iTunes 12.5.4 iTunes 12.5.4 is now available and addresses the following: WebKit Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved memory handling. CVE-2016-4692: Apple CVE-2016-7635: Apple CVE-2016-7652: Apple WebKit Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: A memory corruption issue was addressed through improved input validation. CVE-2016-4743: Alan Cutter WebKit Impact: Processing maliciously crafted web content may result in the disclosure of user information Description: A validation issue was addressed through improved state management. CVE-2016-7586: Boris Zbarsky WebKit Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed through improved state management. CVE-2016-7587: Adam Klein CVE-2016-7610: Zheng Huang of the Baidu Security Lab working with Trend Micro's Zero Day Initiative CVE-2016-7611: an anonymous researcher working with Trend Micro's Zero Day Initiative CVE-2016-7639: Tongbo Luo of Palo Alto Networks CVE-2016-7640: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7641: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7642: Tongbo Luo of Palo Alto Networks CVE-2016-7645: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7646: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7648: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7649: Kai Kang of Tencent's Xuanwu Lab (tencent.com) CVE-2016-7654: Keen Lab working with Trend Micro's Zero Day Initiative WebKit Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A memory corruption issue was addressed through improved state management. CVE-2016-7589: Apple CVE-2016-7656: Keen Lab working with Trend Micro's Zero Day Initiative WebKit Impact: Processing maliciously crafted web content may compromise user information Description: An issue existed in handling of JavaScript prompts. This was addressed through improved state management. CVE-2016-7592: xisigr of Tencent's Xuanwu Lab (tencent.com) WebKit Impact: Processing maliciously crafted web content may result in the disclosure of process memory Description: An uninitialized memory access issue was addressed through improved memory initialization. CVE-2016-7598: Samuel Groß WebKit Impact: Processing maliciously crafted web content may result in the disclosure of user information Description: An issue existed in the handling of HTTP redirects. This issue was addressed through improved cross origin validation. CVE-2016-7599: Muneaki Nishimura (nishimunea) of Recruit Technologies Co., Ltd. WebKit Impact: Processing maliciously crafted web content may lead to an unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed through improved state management. CVE-2016-7632: Jeonghoon Shin iTunes 12.5.4 may be obtained from: https://www.apple.com/itunes/download/ Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- Comment: GPGTools - https://gpgtools.org iQIcBAEBCgAGBQJYT7LLAAoJEIOj74w0bLRG7KQP/3ol4XeUpdU5D9Ev+/p6eYbf OBS7QvFlgmhsEyckdqKThOs+/eBRM7zrYyVijvusZBJRBOS9NxnFMEPBXd2xWvXo VXO0qgvY9w6mXuriPyr2NbSYChXWLsAxQkNck2S0OsgOB+v3JK9D8og5ZSWOoCJm Z0NFMhjIzG/WsJa2vf2YA/sB5fy4WTUxwC8B/HCLQIW0FhgyKfUtNpLtBE+kWbYH y59rdqVbSovLcwtyPnyBj0cbLLv7Rj+s6IulJwejeXc+cmz9wpvky/6YdTFE+6oV 2Ma9hgifA++Pn0WOXEcq6+1/oje/lltfjv+PP1JZI6r465r5lensemPMYKS8XM0q yoXRWVfU2pEg90UYPWQnoKyfqLvQyh88SQWw+YnQ1AGviO1EgjR8NkCWhznZBDBT d4Gz+/iVgHxblf9li3qtkyFfPtaOdvUGrVckoHTzJS4C3PX/bNZPzS+0W9TAwfC9 VT7vEzmTSiWYzRhpr4IwcPEGWhOXyEXl8ta9/4m4oBocCKvVKrETaXlGXmAfQd7b dkkGgQXWZUEeLqfslfdKyCFFjjLQbwwKRmcxRdG/gcuZeMDjFyEartsuRtoE5XfD spTLHM3llAHgilVr65B70zIRiClYmM3G2/IF1A+L+ul0VUs6ylRP8s9rOSxPAiym tNxo4hsdtJCmEBLjUcER =zB0I -----END PGP SIGNATURE----- _______________________________________________ Do not post admin requests to the list. They will be ignored. Security-announce mailing list (Security-announce@lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/security-announce/site_archiver%40li... This email sent to site_archiver@lists.apple.com