VulnerabilityModified
CVE-2019-6232
A race condition existed during the installation of iTunes for Windows.
HIGH 7.5EPSS 1.17%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.
- CVSS 3.1
- 7.5 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 1.17% probability · 66th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Affected
- apple/icloud
- Source
- product-security@apple.com
References
- https://support.apple.com/HT209605Vendor Advisory
- https://support.apple.com/HT209605Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.