CVE-2012-0638: WebKit, as used in Apple iTunes before 10.6, allows man-in-the-middle attackers to execute arbitrary code o...

Security readout for executives and security teams

This is an old Apple iTunes WebKit flaw fixed in iTunes 10.6. If a user browsed the iTunes Store while an attacker could intercept network traffic, the attacker could potentially crash iTunes or run code on the user’s system. Exposure is most likely on legacy systems running Apple iTunes earlier than 10.6, especially where users browse the iTunes Store on untrusted or interceptable networks. The bundle does not identify modern affected products beyond that scope. Treat this as a legacy cleanup issue with high impact if old iTunes remains installed. Prioritize removal or upgrade on endpoints that still run unsupported Apple software, but do not assume active exploitation from the provided evidence. Mitigation focus: Upgrade Apple iTunes to version 10.6 or later where it is still present.; Remove obsolete iTunes installations from managed endpoints if no longer required.; Avoid iTunes Store browsing on untrusted networks until affected hosts are remediated..

Prepared

Jun 24, 2026, 12:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.