CVE-2019-6226: High severity Apple tvOS vulnerability

Q: What is CVE-2019-6226?

CVE-2019-6226 is a vulnerability in Apple Safari, iOS, tvOS, watchOS, iTunes, and iCloud that allows arbitrary code execution through malicious web content.

Q: How severe is CVE-2019-6226?

CVE-2019-6226 has a severity score of 8.8 out of 10, indicating a high severity vulnerability.

Q: Which software versions are affected by CVE-2019-6226?

Versions up to and excluding Safari 12.0.3, iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, iTunes 12.9.3 for Windows, and iCloud for Windows 7.10 are affected by CVE-2019-6226.

Q: How can I fix CVE-2019-6226?

To fix CVE-2019-6226, update your software to Safari 12.0.3, iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, iTunes 12.9.3 for Windows, or iCloud for Windows 7.10.

Q: Where can I find more information about CVE-2019-6226?

You can find more information about CVE-2019-6226 at the following references: [1](http://www.securityfocus.com/bid/106696), [2](https://security.gentoo.org/glsa/201903-12), [3](https://support.apple.com/HT209443).

Published Jan 22, 2019

Updated

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, watchOS 5.1.3, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Mike Zhang(The Pangu team), Wen Xu(SSLab at Georgia Tech), Fluoroacetate(Trend Micro), Proteas, Shrek_wzw, Zhuo Liang(Qihoo 360 Nirvan Team), Apple, an anonymous researcher

Affected Software

16 affected componentsFixes available

Apple tvOS<12.1.2

12.1.2

Apple WatchOS<5.1.3

5.1.3

Apple iCloud for Windows<7.10

7.10

Apple iTunes for Windows<12.9.3

12.9.3

Apple Safari<12.0.3

12.0.3

Apple iOS<12.1.3

12.1.3

Apple Safari<12.0.3

Apple iPhone OS<12.1.3

Apple tvOS<12.1.2

Apple WatchOS<5.1.3

All of the following

Any of the following

Apple iCloud<7.10

Apple iTunes<12.9.3

Microsoft Windows

Apple iCloud<7.10

Apple iTunes<12.9.3

Microsoft Windows

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 12.1.2
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 5.1.3
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 7.10
Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.9.3
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 12.0.3
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 12.1.3
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 12.1.3
Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 5.1.3
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.9.3
Upgrade
Upgrade iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.10

Event History

Mar 5, 2019

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2019-6226?

CVE-2019-6226 is a vulnerability in Apple Safari, iOS, tvOS, watchOS, iTunes, and iCloud that allows arbitrary code execution through malicious web content.

How severe is CVE-2019-6226?