CVE-2019-8734: High severity Apple tvOS vulnerability

Q: What is CVE-2019-8734?

CVE-2019-8734 is a vulnerability in WebKit that allows arbitrary code execution by processing malicious web content.

Q: Which software products are affected by CVE-2019-8734?

CVE-2019-8734 affects watchOS up to version 6, iCloud for Windows up to version 10.7, iTunes for Windows up to version 12.10.1, tvOS up to version 13, iCloud for Windows up to version 7.14, Safari up to version 13, and iOS up to version 13.

Q: How severe is CVE-2019-8734?

CVE-2019-8734 has a severity rating of 8.8 (high).

Q: How can I fix the CVE-2019-8734 vulnerability?

To fix the CVE-2019-8734 vulnerability, update your software to iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, or iTunes 12.10.1 for Windows.

Q: Where can I find more information about CVE-2019-8734?

You can find more information about CVE-2019-8734 on the Apple support website: [link1], [link2], [link3].

Published Sep 19, 2019

Updated

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Other sources

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Credit

an anonymous researcher(Trend Micro), cc(Trend Micro Zero Day Initiative), found by OSS-Fuzz, Jihui Lu(Tencent KeenLab), Junho Jang(LINE Security Team), Hanul Choi(ABLY Corporation), Sergei Glazunov(Google Project Zero), G. Geshev(Trend Micro Zero Day Initiative), zhunki(Codesafe Team of Legendsec at Qi), Dongzhuo Zhao(ADLab of Venustech), Samuel Groß(Google Project Zero)

Affected Software

14 affected componentsFixes available

Apple tvOS<13

Apple WatchOS<6

Apple iCloud for Windows<7.14

7.14

Apple iCloud for Windows<10.7

10.7

Apple iTunes for Windows<12.10.1

12.10.1

Apple Safari<13

Apple iOS<13

Apple Icloud Windows<7.14

Apple Icloud Windows>=10.0<10.7

Apple Itunes Windows<12.10.1

Apple Safari<13.0

Apple iPhone OS<13.0

Apple tvOS<13

Apple WatchOS<6.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 13
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 6
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 7.14
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 10.7
Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.10.1
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 13
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 13
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 13
Upgrade
Upgrade iCloud for Windows 7 to a version that resolves this vulnerability.
Fixed in 7.14
Upgrade
Upgrade iCloud for Windows 10 to a version that resolves this vulnerability.
Fixed in 10.7
Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 6
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.10.1

Event History

Oct 27, 2020

CVE Published

via MITRE·07:43 PM

Data Sourced

via MITRE·07:43 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2019-8734?

CVE-2019-8734 is a vulnerability in WebKit that allows arbitrary code execution by processing malicious web content.

Which software products are affected by CVE-2019-8734?