Apple has released a new version of iTunes for Macintosh and Windows platforms. These software updates fix a combined 40 bugs with 1 flaw resolved in iTunes for Mac OS X v10.6.8 or later, Windows 7, Vista, XP SP2 or later and an additional 39 flaws resolved just for Windows 7, Vista, XP SP2 or later.
The iTunes versions available for Mac OS X v10.6.8 or later, Windows 7, Vista, XP SP2 or later addresses a vulnerability in which an attacker in a privileged network position may manipulate HTTPS server certificates, leading to the disclosure of sensitive information. According to Apple’s description, a certificate validation issue existed in iTunes and in certain contexts, an active network attacker could present untrusted certificates to iTunes and they would be accepted without warning. This issue was resolved by improved certificate validation.
The iTunes versions available for Windows 7, Vista, XP SP2 or later addresses a vulnerability in which a man-in-the-middle attack that occurs while browsing the iTunes Store via iTunes may lead to an unexpected application termination or arbitrary code execution. Multiple memory corruption issues existed in WebKit that were addressed through improved memory handling.
Users of iTunes 11.0.2 and earlier versions for Mac and Windows should download and install the update to iTunes 11.0.3 from the Downloads page or through the software’s update function.
