About the security content of iTunes 12.7 for Windows - Apple Support

BlackTree keeps a versioned source snapshot and links it to relevant CVE reports. The publisher remains authoritative for product applicability, release details and installation guidance.

Read the official article ↗

Publishersupport.apple.com

Article IDNo stable ID in source URL

Verified snapshot17 Oct 2026, 02:04 UTC

Linked CVEs27

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

CVE-2017-9050libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictAddString function in dict.c
CVE-2017-9049libxml2 20904-GITv2.9.4-16-g0741801 is vulnerable to a heap-based buffer over-read in the xmlDictComputeFastKey function in dict.c
CVE-2017-7376Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects
CVE-2017-5130n/a Google Chrome prior to 62.0.3202.62: Integer Overflow or Wraparound
CVE-2017-13829It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
CVE-2017-13833It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app
CVE-2017-13831It allows remote attackers to obtain sensitive information or cause a denial of service via a crafted image
CVE-2017-7109n/a: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2017-7095It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7100It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7120It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7098It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7081It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7087It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7111It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7102It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7091It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7090It allows remote attackers to bypass the Same Origin Policy and obtain sensitive cookie information via a custom URL scheme
CVE-2017-7096It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7092It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7117It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7093It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7104It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7094It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7107It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2017-7099It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
CVE-2018-4302A null pointer dereference was addressed with improved validation

Source and provenance

Original title: About the security content of iTunes 12.7 for Windows - Apple Support. Captured 17 Oct 2026, 02:04 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.

Open the publisher's current version ↗