CVE-2019-8827
First published: Mon Oct 28 2019(Updated: )
The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.
Credit: Artur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security TeamArtur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security TeamArtur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security TeamArtur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security TeamArtur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security TeamArtur Janc Krzyszt KotowiczLukas Weichselbaum Roberto Clapis Google Security Team product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iCloud for Windows | <7.15 | 7.15 |
| Apple iTunes for Windows | <12.10.2 | 12.10.2 |
| Apple Safari | <13.0.3 | 13.0.3 |
| Apple iCloud for Windows | <10.9.2 | 10.9.2 |
| Apple tvOS | <13.2 | 13.2 |
| Apple iOS | <13.2 | 13.2 |
| Apple iPadOS | <13.2 | 13.2 |
| Apple Icloud Windows | <7.15 | |
| Apple Icloud Windows | >=10.0<10.9.2 | |
| Apple Itunes Windows | <12.10.2 | |
| Apple Safari | <13.0.3 | |
| Apple iPadOS | <13.2 | |
| Apple iPhone OS | <13.2 | |
| Apple tvOS | <13.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT210721 (Advisory)
- https://support.apple.com/en-us/HT210723 (Advisory)
- https://support.apple.com/en-us/HT210725 (Advisory)
- https://support.apple.com/en-us/HT210726 (Advisory)
- https://support.apple.com/en-us/HT210728 (Advisory)
- https://support.apple.com/en-us/HT210947 (Advisory)
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2019-8784
- CVE-2019-8783
- CVE-2019-8811
- CVE-2019-8814
- CVE-2019-8816
- CVE-2019-8819
- CVE-2019-8820
- CVE-2019-8821
- CVE-2019-8822
- CVE-2019-8823
- CVE-2019-8827
- CVE-2019-8815
- CVE-2019-8801
- CVE-2019-8813
- CVE-2019-8782
- CVE-2019-8808
- CVE-2019-8812
- CVE-2020-3826
- CVE-2020-3846
- CVE-2020-3867
- CVE-2020-3825
- CVE-2020-3868
- CVE-2020-3862
- CVE-2020-3865
- CVE-2020-3864
- CVE-2019-8787
- CVE-2019-8803
- CVE-2019-8785
- CVE-2019-8797
- CVE-2019-8795
- CVE-2019-8798
- CVE-2019-8794
- CVE-2019-8786
- CVE-2019-8829
- CVE-2019-8796
- CVE-2019-8788
- CVE-2019-8789
- CVE-2017-7152
- CVE-2019-8804
- CVE-2019-8793
- CVE-2019-15126
Frequently Asked Questions
What is CVE-2019-8827?
CVE-2019-8827 is a vulnerability in WebKit that allows the HTTP referrer header to be used to leak browsing history.
How does CVE-2019-8827 affect Apple iCloud for Windows?
CVE-2019-8827 affects Apple iCloud for Windows version up to exclusive 10.9.2.
How can I resolve CVE-2019-8827 in Apple iCloud for Windows?
To resolve CVE-2019-8827 in Apple iCloud for Windows, make sure to update to version 10.9.2 or higher.
Was CVE-2019-8827 resolved by Apple?
Yes, Apple resolved CVE-2019-8827 by downgrading all third party referrers to their origin.
Where can I find more information about CVE-2019-8827?
You can find more information about CVE-2019-8827 on the Apple support page: https://support.apple.com/en-us/HT210947.
- collector/apple-support
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- agent/software-canonical-lookup-request
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/event
- agent/description
- collector/nvd-index
- vendor/apple
- canonical/apple icloud for windows
- canonical/apple itunes for windows
- canonical/apple safari
- canonical/apple tvos
- canonical/apple ios
- canonical/apple ipados
- canonical/apple icloud windows
- version/apple icloud windows/10.0
- canonical/apple itunes windows
- canonical/apple iphone os