Vulnerability in N/a
CVE-2009-0950
Stack-based buffer overflow in Apple iTunes before 8.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via an itms: URL with a long URL component after a colon.
EPSS: 0.821 (99.2th percentile) — read the EPSS interpretation.
Affected products
- N/a — versions n/a
Public proof-of-concept exploits
References
- ADV-2009-1470 (vdb-entry, x_refsource_VUPEN)
- 35157 (vdb-entry, x_refsource_BID)
- 35314 (x_refsource_SECUNIA, third-party-advisory)
- 8934 (exploit, x_refsource_EXPLOIT-DB)
- redpig.dataspill.org/2009/05/drive-by-attack-for-itunes-811.html (x_refsource_MISC)
- oval:org.mitre.oval:def:17099 (x_refsource_OVAL, signature, vdb-entry)
- 8861 (exploit, x_refsource_EXPLOIT-DB)
- support.apple.com/kb/HT3592 (x_refsource_CONFIRM)
- 20090602 Re: TPTI-09-03: Apple iTunes Multiple Protocol Handler Buffer Overflow Vulnerabilities (mailing-list, x_refsource_BUGTRAQ)
- static.dataspill.org/releases/itunes/itms_overflow.rb (x_refsource_MISC)
Frequently asked questions
- What is CVE-2009-0950?
- CVE-2009-0950 is a vulnerability in N/a. Published 2009-06-02.
- Is CVE-2009-0950 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.