TCR
The desktop application forcefully installs Bonjour version 3.0.0.10 (released in 2011).
Which is vulnerable for CVE-2011-0220
.
The latest version of the binary provided by Apple is 3.1.0.1 (released in 2015).
Apple no longer provides binaries for Bonjour and instead provides the source on GitHub so you can compile it with your own.