https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:49:31 +0000 https://vulnerability.circl.lu/vuln/CERTA-2011-AVI-646 CERTA-2011-AVI-646 https://vulnerability.circl.lu/vuln/CERTA-2011-AVI-646 https://vulnerability.circl.lu/vuln/fkie_cve-2008-3434 <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.</p> <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2008-3434 https://vulnerability.circl.lu/vuln/ghsa-p52p-hq77-4mj2 <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.</p> <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.</p> https://vulnerability.circl.lu/vuln/ghsa-p52p-hq77-4mj2 https://vulnerability.circl.lu/vuln/gsd-2008-3434 gsd-2008-3434 https://vulnerability.circl.lu/vuln/gsd-2008-3434 https://vulnerability.circl.lu/vuln/var-200808-0363 <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning. Apple From iTunes An update for has been released.Man-in-the-middle attacks (man-in-the-middle attack) Any software iTunes May appear to be an update. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Successful exploits will compromise the affected application and possibly the underlying computer. iTunes is a free application for iPod and iPhone media file management. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1</p> <p>APPLE-SA-2011-11-14-1 iTunes 10.5.1</p> <p>iTunes 10.5.1 is now available and addresses the following:</p> <p>iTunes Available for: Mac OS X v10.5 or later, Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attacker may offer software that appears to originate from Apple Description: iTunes periodically checks for software updates using an HTTP request to Apple. If Apple Software Update for Windows is not installed, clicking the Download iTunes button may open the URL from the HTTP response in the user&#39;s default browser. This issue has been mitigated by using a secured connection when checking for available updates. For OS X systems, the user&#39;s default browser is not used because Apple Software Update is included with OS X, however this change adds additional defense-in-depth. C…</p> <p>Apple iTunes before 10.5.1 does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning. Apple From iTunes An update for has been released.Man-in-the-middle attacks (man-in-the-middle attack) Any software iTunes May appear to be an update. Attackers can exploit this issue to execute arbitrary code within the context of the affected application. Successful exploits will compromise the affected application and possibly the underlying computer. iTunes is a free application for iPod and iPhone media file management. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1</p> <p>APPLE-SA-2011-11-14-1 iTunes 10.5.1</p> <p>iTunes 10.5.1 is now available and addresses the following:</p> <p>iTunes Available for: Mac OS X v10.5 or later, Windows 7, Vista, XP SP2 or later Impact: A man-in-the-middle attacker may offer software that appears to originate from Apple Description: iTunes periodically checks for software updates using an HTTP request to Apple. If Apple Software Update for Windows is not installed, clicking the Download iTunes button may open the URL from the HTTP response in the user&#39;s default browser. This issue has been mitigated by using a secured connection when checking for available updates. For OS X systems, the user&#39;s default browser is not used because Apple Software Update is included with OS X, however this change adds additional defense-in-depth. C…</p> https://vulnerability.circl.lu/vuln/var-200808-0363