Julien Chaffraix

**Name of the Vulnerable Software and Affected Versions** WebKit, as used in Apple iTunes versions prior to 10.7 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple iTunes versions prior to 10.7, update to version 10.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Apple Safari versions prior to 6.0 Apple iTunes (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple Safari versions prior to 6.0, update to version 6.0 or later to resolve the issue. For Apple iTunes, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** WebKit, as used in Apple iOS versions prior to 5.1 WebKit, as used in Apple iTunes versions prior to 10.6 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For Apple iOS versions prior to 5.1, update to version 5.1 or later. For Apple iTunes versions prior to 10.6, update to version 10.6 or later.

**Name of the Vulnerable Software and Affected Versions** WebKit before r58409 **Description** The issue is related to the XMLHttpRequest implementation in WebCore in WebKit, where the loader/DocumentThreadableLoader.cpp does not properly handle credentials during a cross-origin synchronous request. This has unspecified impact and remote attack vectors. **Recommendations** For WebKit before r58409, update to a version after r58409 to resolve the issue.