First published: Mon Mar 25 2019(Updated: )
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Credit: Samuel Groß Google Project Zero product-security@apple.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/webkitgtk | <2.24.0 | 2.24.0 |
Apple Multiple Products | ||
debian/webkit2gtk | 2.44.2-1~deb11u1 2.46.4-1~deb11u1 2.46.0-2~deb12u1 2.46.4-1~deb12u1 2.46.4-1 | |
tvOS | <12.2 | 12.2 |
Apple iOS, iPadOS, and watchOS | <5.2 | 5.2 |
Apple iCloud | <7.11 | 7.11 |
iTunes | <12.9.4 | 12.9.4 |
Safari | <12.1 | 12.1 |
Apple iOS and iPadOS | <12.2 | 12.2 |
iCloud for Windows | <7.11 | |
iTunes | <12.9.4 | |
Safari | <12.1 | |
iPhone OS | <12.2 | |
tvOS | <12.2 | |
Apple iOS, iPadOS, and watchOS | <5.2 | |
Red Hat Enterprise Linux Desktop | =7.0 | |
Red Hat Enterprise Linux Server | =7.0 | |
Red Hat Enterprise Linux Workstation | =7.0 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)
(Found alongside the following vulnerabilities)
CVE-2019-8506 is a type confusion vulnerability in multiple Apple products, including iOS, tvOS, watchOS, Safari, iTunes for Windows, and iCloud for Windows.
The severity of CVE-2019-8506 is critical with a CVSS score of 8.8.
This vulnerability can be exploited by processing maliciously crafted web content, which may lead to arbitrary code execution.
Versions up to and excluding iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11 are vulnerable.
To fix CVE-2019-8506, users should update to iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, or iCloud for Windows 7.11.