VulnerabilityModified

CVE-2019-6215

Processing maliciously crafted web content may lead to arbitrary code execution.

HIGH 8.8EPSS 9.75%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (9.75%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

CVSS 3.0: 8.8 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS: 9.75% probability · 95th percentile
CISA KEV: Not listed
Weakness: CWE-843
Affected: apple/safari · apple/iphone os · apple/tvos · apple/watchos · apple/icloud · apple/itunes · canonical/ubuntu linux
Source: product-security@apple.com

References

http://www.securityfocus.com/bid/106691Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201903-12Third Party Advisory
https://support.apple.com/HT209443Vendor Advisory
https://support.apple.com/HT209447Vendor Advisory
https://support.apple.com/HT209449Vendor Advisory
https://support.apple.com/HT209450Vendor Advisory
https://support.apple.com/HT209451Vendor Advisory
https://usn.ubuntu.com/3889-1/Third Party Advisory
https://www.exploit-db.com/exploits/46448/Exploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/106691Third Party Advisory, VDB Entry
https://security.gentoo.org/glsa/201903-12Third Party Advisory
https://support.apple.com/HT209443Vendor Advisory
https://support.apple.com/HT209447Vendor Advisory
https://support.apple.com/HT209449Vendor Advisory
https://support.apple.com/HT209450Vendor Advisory
https://support.apple.com/HT209451Vendor Advisory
https://usn.ubuntu.com/3889-1/Third Party Advisory
https://www.exploit-db.com/exploits/46448/Exploit, Third Party Advisory, VDB Entry

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.