About the security content of iTunes 12.6 for Windows - Apple Support

Linked CVE reports

These are source relationships, not a claim that this article fixes every affected product or branch.

• CVE-2016-4472Affected product: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2016-0718Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers a buffer overflow
• CVE-2009-3720n/a: security vulnerability
• CVE-2009-3560n/a: Improper Restriction of Operations within the Bounds of a Memory Buffer
• CVE-2009-3270n/a: Uncontrolled Resource Consumption
• CVE-2012-6702n/a: security vulnerability
• CVE-2012-1148n/a: security vulnerability
• CVE-2012-1147readfilemap.c in expat before 2.1.0 allows context-dependent attackers to cause a denial of service (file descriptor consumption) via a large number of crafted XML files
• CVE-2013-7443Buffer overflow in the skip-scan optimization in SQLite 3.8.2 allows remote attackers to cause a denial of service (crash) via crafted SQL statements
• CVE-2015-6607SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586
• CVE-2015-3717n/a: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CVE-2015-3416n/a: Integer Overflow or Wraparound
• CVE-2015-3414n/a: Use of Uninitialized Resource
• CVE-2015-3415n/a: Improper Resource Shutdown or Release
• CVE-2015-1283n/a: Integer Overflow or Wraparound
• CVE-2016-6153n/a: Improper Input Validation
• CVE-2016-5300n/a: security vulnerability
• CVE-2017-5029n/a Google Chrome prior to 57.0.2987.98 for Mac, Windows and Linux, and 57.0.2987.108 for Android: Out-of-bounds Write
• CVE-2017-2493It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted elements on a web site
• CVE-2017-2480It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
• CVE-2017-2463It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site
• CVE-2017-2479It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site
• CVE-2017-2383It allows man-in-the-middle attackers to track users via correlation with this certificate

Source and provenance

Original title: About the security content of iTunes 12.6 for Windows - Apple Support. Captured 17 Oct 2026, 08:14 UTC. The stored article is used for enrichment and change detection; BlackTree does not republish the publisher's full text here.