CVE-2019-8506highunder attackCWE-843

CVE-2019-8506: high-severity vulnerability in Apple iOS

Published · Updated

Follow this CVE+ Monitor iOS+ Monitor watchOS

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 16%
from disclosure to weaponsame day
Published on NVDDec 18
1st PoCApr 3
CISA KEV+868d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Affected
2 products (9 components)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6
no_fix_planned: Out of support scope
Fixed
11 products (1,407 components)
Red Hat Enterprise Linux AppStream (v. 8) · Red Hat CodeReady Linux Builder (v. 8) · Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux Client (v. 7) · Red Hat Enterprise Linux Client Optional (v. 7) · and others 6
fix ↗
Action required by CISAfederal deadline: 2022-05-25

Apply updates per vendor instructions.

In short

A vulnerability in how Safari and Apple apps handle certain web content allows attackers to execute malicious code on your device. This happens when the software gets confused about what type of data it's processing, potentially giving attackers full control of your system.

Technical detail

A type confusion vulnerability in memory handling (CWE-843) allows remote code execution when processing maliciously crafted web content. The attack vector is network-based through web browsing; no user authentication or special privileges are required. Successful exploitation results in arbitrary code execution with the privileges of the affected application.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Apple · iCloud for WindowsApple · iOSApple · iTunes for WindowsApple · SafariApple · tvOSApple · watchOS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Apple iOS

In the same product, most dangerous first.

CVE-2021-30860HIGHCVE-2021-30860EPSS 76.0%KEVCVE-2019-8605HIGHCVE-2019-8605EPSS 17.6%KEVCVE-2019-7286HIGHCVE-2019-7286EPSS 15.9%KEVCVE-2020-3837HIGHCVE-2020-3837EPSS 14.8%KEVCVE-2021-30858HIGHCVE-2021-30858EPSS 13.4%KEVCVE-2021-30762HIGHCVE-2021-30762EPSS 11.0%KEV