CVE-2019-8506: Apple Multiple Products Type Confusion Vulnerability
First published: Mon Mar 25 2019(Updated: )
A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Credit: Samuel Groß Google Project Zero product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/webkitgtk | <2.24.0 | 2.24.0 |
| Apple Multiple Products | ||
| debian/webkit2gtk | 2.44.2-1~deb11u1 2.46.4-1~deb11u1 2.46.0-2~deb12u1 2.46.4-1~deb12u1 2.46.4-1 | |
| tvOS | <12.2 | 12.2 |
| Apple Mobile Safari | <12.1 | 12.1 |
| Apple iCloud for Windows | <7.11 | |
| Apple iTunes for Windows | <12.9.4 | |
| Apple Mobile Safari | <12.1 | |
| iOS | <12.2 | |
| tvOS | <12.2 | |
| Apple iOS, iPadOS, and watchOS | <5.2 | |
| redhat enterprise Linux desktop | =7.0 | |
| redhat enterprise Linux server | =7.0 | |
| redhat enterprise Linux workstation | =7.0 | |
| Apple iOS, iPadOS, and watchOS | <12.2 | 12.2 |
| Apple iOS, iPadOS, and watchOS | <5.2 | 5.2 |
| Apple iCloud | <7.11 | 7.11 |
| Apple iTunes | <12.9.4 | 12.9.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT209603 (Advisory)
- https://support.apple.com/en-us/HT209604 (Advisory)
- https://support.apple.com/en-us/HT209605 (Advisory)
- https://support.apple.com/HT209599
- https://support.apple.com/HT209601
- https://support.apple.com/HT209602
- https://support.apple.com/HT209603
- https://support.apple.com/HT209604
- https://support.apple.com/HT209605
- https://launchpad.net/bugs/cve/CVE-2019-8506
- https://support.apple.com/en-us/HT209602 (Advisory)
- https://support.apple.com/en-us/HT209601 (Advisory)
- https://support.apple.com/en-us/HT209599 (Advisory)
- https://webkitgtk.org/security/WSA-2019-0002.html
- https://wpewebkit.org/security/WSA-2019-0002.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1719246
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1719247
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1719249
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1719250
- https://access.redhat.com/errata/RHSA-2020:4035
- https://access.redhat.com/security/cve/cve-2019-8506
- https://bugzilla.redhat.com/show_bug.cgi?id=1719199
- https://nvd.nist.gov/vuln/detail/CVE-2019-8506
- https://security-tracker.debian.org/tracker/CVE-2019-8506
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8506
- https://ubuntu.com/security/CVE-2019-8506
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2019-6203
- CVE-2019-8516
- CVE-2019-8552
- CVE-2019-8542
- CVE-2019-8906
- CVE-2019-7286
- CVE-2019-8553
- CVE-2019-8545
- CVE-2019-5608
- CVE-2019-8547
- CVE-2019-8525
- CVE-2019-8527
- CVE-2019-8528
- CVE-2019-8540
- CVE-2019-8514
- CVE-2019-7293
- CVE-2019-6207
- CVE-2019-8510
- CVE-2019-8532
- CVE-2019-8549
- CVE-2019-8618
- CVE-2019-8531
- CVE-2019-8502
- CVE-2019-8517
- CVE-2019-8551
- CVE-2019-8535
- CVE-2019-6201
- CVE-2019-8518
- CVE-2019-8523
- CVE-2019-8524
- CVE-2019-8558
- CVE-2019-8559
- CVE-2019-8563
- CVE-2019-8638
- CVE-2019-8639
- CVE-2019-8562
- CVE-2019-8515
- CVE-2019-8536
- CVE-2019-8544
- CVE-2019-7285
- CVE-2019-8556
- CVE-2019-8506
- CVE-2019-8503
- CVE-2019-7292
- CVE-2019-8530
- CVE-2019-6204
- CVE-2019-8505
- CVE-2019-8538
- CVE-2019-8511
- CVE-2019-8512
- CVE-2019-8550
- CVE-2019-8565
- CVE-2019-8521
- CVE-2019-8504
- CVE-2019-8529
- CVE-2019-7284
- CVE-2019-8546
- CVE-2019-8541
- CVE-2019-8566
- CVE-2019-8554
- CVE-2019-6222
- CVE-2019-8567
- CVE-2019-8548
- CVE-2019-6232
- CVE-2019-6236
Frequently Asked Questions
What is CVE-2019-8506?
CVE-2019-8506 is a type confusion vulnerability in multiple Apple products, including iOS, tvOS, watchOS, Safari, iTunes for Windows, and iCloud for Windows.
What is the severity of CVE-2019-8506?
The severity of CVE-2019-8506 is critical with a CVSS score of 8.8.
How can this vulnerability be exploited?
This vulnerability can be exploited by processing maliciously crafted web content, which may lead to arbitrary code execution.
Which versions of the affected software are vulnerable?
Versions up to and excluding iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, and iCloud for Windows 7.11 are vulnerable.
What is the recommended remedy for CVE-2019-8506?
To fix CVE-2019-8506, users should update to iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, or iCloud for Windows 7.11.
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/title
- agent/severity
- agent/weakness
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-8506
- agent/software-canonical-lookup
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/trending
- agent/source
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- collector/apple-support
- agent/software-canonical-lookup-request
- agent/tags
- agent/softwarecombine
- agent/author
- collector/nvd-api
- source/NVD
- collector/nvd-cve
- collector/nvd-index
- package-manager/redhat
- vendor/apple
- canonical/apple multiple products
- package-manager/debian
- canonical/tvos
- canonical/apple mobile safari
- canonical/apple icloud for windows
- canonical/apple itunes for windows
- canonical/ios
- canonical/apple ios, ipados, and watchos
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/7.0
- canonical/apple icloud
- canonical/apple itunes