VulnerabilityModified
CVE-2019-8600
A memory corruption issue was addressed with improved input validation.
CRITICAL 9.8EPSS 20.0%
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.0%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 19.96% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-89, CWE-787
- Affected
- apple/icloud · apple/itunes · apple/iphone os · apple/mac os x · apple/tvos · apple/watchos
- Source
- product-security@apple.com
References
- https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/
- https://support.apple.com/HT210118Vendor Advisory
- https://support.apple.com/HT210119Vendor Advisory
- https://support.apple.com/HT210120Vendor Advisory
- https://support.apple.com/HT210122Vendor Advisory
- https://support.apple.com/HT210124Vendor Advisory
- https://support.apple.com/HT210125Vendor Advisory
- https://support.apple.com/HT210212Vendor Advisory
- https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/
- https://support.apple.com/HT210118Vendor Advisory
- https://support.apple.com/HT210119Vendor Advisory
- https://support.apple.com/HT210120Vendor Advisory
- https://support.apple.com/HT210122Vendor Advisory
- https://support.apple.com/HT210124Vendor Advisory
- https://support.apple.com/HT210125Vendor Advisory
- https://support.apple.com/HT210212Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.