CVE-2019-8846: Use After Free
First published: Tue Dec 10 2019(Updated: )
A flaw was found in WebKitGTK before 2.26.3. Processing maliciously crafted web content may lead to arbitrary code execution. References: <a href="https://www.openwall.com/lists/oss-security/2020/01/23/2">https://www.openwall.com/lists/oss-security/2020/01/23/2</a> <a href="https://webkitgtk.org/security/WSA-2020-0001.html">https://webkitgtk.org/security/WSA-2020-0001.html</a>
Credit: Marcin Towalski Cisco TalosMarcin Towalski Cisco TalosMarcin Towalski Cisco TalosMarcin Towalski Cisco TalosMarcin Towalski Cisco TalosMarcin Towalski Cisco Talos product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Safari | <13.0.4 | 13.0.4 |
| Apple iCloud for Windows | <10.9 | 10.9 |
| Apple iCloud for Windows | <7.16 | 7.16 |
| Apple iTunes for Windows | <12.10.3 | 12.10.3 |
| Apple tvOS | <13.3 | 13.3 |
| redhat/webkitgtk | <2.26.3 | 2.26.3 |
| Apple iOS | <13.3 | 13.3 |
| Apple iPadOS | <13.3 | 13.3 |
| Apple Icloud Windows | <7.16 | |
| Apple Icloud Windows | >=10.0<10.9 | |
| Apple Itunes Windows | <12.10.3 | |
| Apple Safari | <13.0.4 | |
| Apple iPadOS | <13.3 | |
| Apple iPhone OS | <13.3 | |
| Apple tvOS | <13.3 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT210785 (Advisory)
- https://support.apple.com/en-us/HT210790 (Advisory)
- https://support.apple.com/en-us/HT210792 (Advisory)
- https://support.apple.com/en-us/HT210793 (Advisory)
- https://support.apple.com/en-us/HT210794 (Advisory)
- https://support.apple.com/en-us/HT210795 (Advisory)
- https://www.openwall.com/lists/oss-security/2020/01/23/2
- https://webkitgtk.org/security/WSA-2020-0001.html
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1816679
- https://access.redhat.com/errata/RHSA-2020:4035
- https://access.redhat.com/security/cve/cve-2019-8846
- https://access.redhat.com/errata/RHSA-2020:4451
- https://bugzilla.redhat.com/show_bug.cgi?id=1816678
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
Frequently Asked Questions
What is CVE-2019-8846?
CVE-2019-8846 is a use after free vulnerability in WebKit that can lead to arbitrary code execution.
How does CVE-2019-8846 affect Apple Safari?
CVE-2019-8846 affects Apple Safari version 13.0.4 and earlier, and can be exploited by processing malicious web content.
Is there a fix for CVE-2019-8846?
Yes, CVE-2019-8846 is fixed in Safari 13.0.4 and later versions.
Which other Apple software is affected by CVE-2019-8846?
CVE-2019-8846 also affects iCloud for Windows versions 10.9 and earlier, iOS 13.3 and earlier, iPadOS 13.3 and earlier, iTunes 12.10.3 for Windows, and iCloud for Windows 7.16 and earlier.
What is the severity of CVE-2019-8846?
CVE-2019-8846 has a severity score of 8.8, indicating a critical vulnerability.
- collector/apple-support
- agent/type
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- agent/weakness
- agent/references
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-8846
- agent/software-canonical-lookup
- agent/tags
- agent/event
- agent/description
- collector/nvd-index
- vendor/apple
- canonical/apple safari
- canonical/apple icloud for windows
- canonical/apple itunes for windows
- canonical/apple tvos
- package-manager/redhat
- canonical/apple ios
- canonical/apple ipados
- canonical/apple icloud windows
- version/apple icloud windows/10.0
- canonical/apple itunes windows
- canonical/apple iphone os
- vendor/redhat
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/7.0