CVE-2019-6223: high-severity vulnerability in Apple iOS
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A flaw in Group FaceTime allowed the person starting a call to force someone to answer it without their consent. This was a serious privacy issue because people could be put into calls they didn't want to join.
A logic flaw in Group FaceTime call state management allowed an attacker (call initiator) to manipulate the call handling logic, causing recipients to be placed in an answered state without explicit user action. The attack required initiating a Group FaceTime call and exploiting improper state validation; the impact was unwanted call connection and potential privacy violation.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.