CVE-2011-0259

CoreFoundation, as used in Apple iTunes before 10.5, does not properly perform string tokenization, which allows man-in-the-middle attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via unspecified vectors.

• CWE-119

• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• http://support.apple.com/kb/HT4981Vendor Advisory
• http://support.apple.com/kb/HT4999
• http://support.apple.com/kb/HT5002
• http://www.securityfocus.com/bid/50067
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16919
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00000.htmlPatch, Vendor Advisory
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00001.html
• http://lists.apple.com/archives/Security-announce/2011//Oct/msg00003.html
• http://support.apple.com/kb/HT4981Vendor Advisory
• http://support.apple.com/kb/HT4999
• http://support.apple.com/kb/HT5002
• http://www.securityfocus.com/bid/50067
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16919

Published

Oct 12, 2011

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2011-0253WebKit, as used in Apple Safari before 5.0.6, allows remote …
• CVE-2011-0254WebKit, as used in Apple Safari before 5.0.6, allows remote …
• CVE-2011-0255WebKit, as used in Apple Safari before 5.0.6, allows remote …
• CVE-2011-0256Integer overflow in Apple QuickTime before 7.7 allows remote…
• CVE-2011-0257Integer signedness error in Apple QuickTime before 7.7 allow…
• CVE-2011-0258Apple QuickTime before 7.7 on Windows allows remote attacker…
• CVE-2011-0260The CoreProcesses component in Apple Mac OS X 10.7 before 10…
• CVE-2011-0261Unspecified vulnerability in jovgraph.exe in jovgraph in HP …
• CVE-2011-0262Buffer overflow in the stringToSeconds function in ovutil.dl…
• CVE-2011-0263Multiple stack-based buffer overflows in ovas.exe in the OVA…
• CVE-2011-0264Stack-based buffer overflow in ovutil.dll in HP OpenView Net…
• CVE-2011-0265Buffer overflow in nnmRptConfig.exe in HP OpenView Network N…