var-201912-0509
Vulnerability from variot
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Arbitrary code execution * Insufficient access restrictions * information leak * Service operation interruption (DoS) * Information falsification * Privilege escalation * Sandbox avoidance. Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. The following products and versions are affected: Apple iOS prior to 12.4; Windows-based iTunes prior to 12.9.6; tvOS prior to 12.4; Safari prior to 12.1.2; macOS Mojave prior to 10.14.6; watchOS prior to 5.3. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512
Debian Security Advisory DSA-4515-1 security@debian.org https://www.debian.org/security/ Alberto Garcia September 04, 2019 https://www.debian.org/security/faq
Package : webkit2gtk CVE ID : CVE-2019-8644 CVE-2019-8649 CVE-2019-8658 CVE-2019-8666 CVE-2019-8669 CVE-2019-8671 CVE-2019-8672 CVE-2019-8673 CVE-2019-8676 CVE-2019-8677 CVE-2019-8678 CVE-2019-8679 CVE-2019-8680 CVE-2019-8681 CVE-2019-8683 CVE-2019-8684 CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689 CVE-2019-8690
Several vulnerabilities have been discovered in the webkit2gtk web engine:
CVE-2019-8644
G.
CVE-2019-8681
G.
CVE-2019-8686
G.
For the stable distribution (buster), these problems have been fixed in version 2.24.4-1~deb10u1.
We recommend that you upgrade your webkit2gtk packages.
For the detailed security status of webkit2gtk please refer to its security tracker page at: https://security-tracker.debian.org/tracker/webkit2gtk
Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl1wJHoACgkQEMKTtsN8 TjaQlw//fmWHtAwh8WO+GqE/mAHWu7Ph2aDRr/WtZ636WZXBFKc5uO1ja+FMzSAx 0UE5bQXK/mNk68HzdmwMZzkwz7rZGaiEHVQffAapxvjKCfPzgd7p70Ea49yLVuoH mEAJ2PRd7jSI0CnLrOxFsiCkTHI3rZjPtZ04pePDOmNA3TS9u4sMNcfz0LbKaFvq 0/VNDCZ7MsBZq2c1Feg3pdwtRd6qJ0tXPIme6Q5OGWnIzCaa72bl/pdWWmvQzelh Ljs7FCQm/DInrOHeAqMW14f18j10Is/d2p27hroOK4F4fnUvsxvU6gOoKTl3dyrA drQJ1EIFg5Qt6AsVCdHogbrFjn9sStcaa0Yue2UhogJjh+tCugqcWpvad+Dzd61t Ptl+NmIWYBeJG+LYw2c5MBrrmBrt2ajZBeDUaLR+v/FuvGuPgGr7jNZybl3n8lkQ jbH2FrC/TIDZjeT84bnPuxbGG9ITyE7f8kB+isXZPvRqMccebRpyM8mnq+z1ywTf UxC9M3aIaq/CYuqo9xcdUVjTcUotIQgUSw+JyKjc38Ksa32PrMj84mmwp4UvOVHt g0OandgtSGjx+skzJOevttJ5baX6qSgtuZvxFmvPGMn2BSRpRHrSXX2OHqK5ux36 8xQAXsSZtm8E5q3MtzvOmW2lkdprocmdWfwxrvA/QoaFyJzQMVM=x0Ii -----END PGP SIGNATURE----- . ------------------------------------------------------------------------ WebKitGTK and WPE WebKit Security Advisory WSA-2019-0004
Date reported : August 29, 2019 Advisory ID : WSA-2019-0004 WebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2019-0004.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2019-0004.html CVE identifiers : CVE-2019-8644, CVE-2019-8649, CVE-2019-8658, CVE-2019-8666, CVE-2019-8669, CVE-2019-8671, CVE-2019-8672, CVE-2019-8673, CVE-2019-8676, CVE-2019-8677, CVE-2019-8678, CVE-2019-8679, CVE-2019-8680, CVE-2019-8681, CVE-2019-8683, CVE-2019-8684, CVE-2019-8686, CVE-2019-8687, CVE-2019-8688, CVE-2019-8689, CVE-2019-8690.
Several vulnerabilities were discovered in WebKitGTK and WPE WebKit.
CVE-2019-8644 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to G. Geshev working with Trend Micro's Zero Day Initiative.
CVE-2019-8649 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to Sergei Glazunov of Google Project Zero. A logic issue existed in the handling of synchronous page loads.
CVE-2019-8658 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to akayn working with Trend Micro's Zero Day Initiative.
CVE-2019-8666 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to Zongming Wang (王宗明) and Zhe Jin (金哲) from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd.
CVE-2019-8669 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to akayn working with Trend Micro's Zero Day Initiative.
CVE-2019-8671 Versions affected: WebKitGTK and WPE WebKit before 2.24.2. Credit to Apple.
CVE-2019-8672 Versions affected: WebKitGTK and WPE WebKit before 2.24.2. Credit to Samuel Groß of Google Project Zero.
CVE-2019-8673 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech.
CVE-2019-8676 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech.
CVE-2019-8677 Versions affected: WebKitGTK and WPE WebKit before 2.24.2. Credit to Jihui Lu of Tencent KeenLab.
CVE-2019-8678 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to an anonymous researcher, Anthony Lai (@darkfloyd1014) of Knownsec, Ken Wong (@wwkenwong) of VXRL, Jeonghoon Shin (@singi21a) of Theori, Johnny Yu (@straight_blast) of VX Browser Exploitation Group, Chris Chan (@dr4g0nfl4me) of VX Browser Exploitation Group, Phil Mok (@shadyhamsters) of VX Browser Exploitation Group, Alan Ho (@alan_h0) of Knownsec, Byron Wai of VX Browser Exploitation.
CVE-2019-8679 Versions affected: WebKitGTK and WPE WebKit before 2.24.2. Credit to Jihui Lu of Tencent KeenLab.
CVE-2019-8680 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to Jihui Lu of Tencent KeenLab.
CVE-2019-8681 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to G. Geshev working with Trend Micro Zero Day Initiative.
CVE-2019-8683 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to lokihardt of Google Project Zero.
CVE-2019-8684 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to lokihardt of Google Project Zero.
CVE-2019-8686 Versions affected: WebKitGTK and WPE WebKit before 2.24.2. Credit to G. Geshev working with Trend Micro's Zero Day Initiative.
CVE-2019-8687 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to Apple.
CVE-2019-8688 Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before 2.24.3. Credit to Insu Yun of SSLab at Georgia Tech.
CVE-2019-8689 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to lokihardt of Google Project Zero.
CVE-2019-8690 Versions affected: WebKitGTK and WPE WebKit before 2.24.3. Credit to Sergei Glazunov of Google Project Zero. A logic issue existed in the handling of document loads.
We recommend updating to the latest stable versions of WebKitGTK and WPE WebKit. It is the best way to ensure that you are running safe versions of WebKit. Please check our websites for information about the latest stable releases.
Further information about WebKitGTK and WPE WebKit security advisories can be found at: https://webkitgtk.org/security.html or https://wpewebkit.org/security/.
The WebKitGTK and WPE WebKit team, August 29, 2019 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2019-8-13-3 Additional information for APPLE-SA-2019-7-22-4 watchOS 5.3
watchOS 5.3 addresses the following:
Bluetooth Available for: Apple Watch Series 1 and later Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB) Description: An input validation issue existed in Bluetooth. CVE-2019-9506: Daniele Antonioli of SUTD, Singapore, Dr. Nils Ole Tippenhauer of CISPA, Germany, and Prof. Kasper Rasmussen of University of Oxford, England Entry added August 13, 2019
Core Data Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8646: Natalie Silvanovich of Google Project Zero
Core Data Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to cause arbitrary code execution Description: A use after free issue was addressed with improved memory management. CVE-2019-8647: Samuel Groß and Natalie Silvanovich of Google Project Zero
Core Data Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2019-8660: Samuel Groß and Natalie Silvanovich of Google Project Zero
Digital Touch Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8624: Natalie Silvanovich of Google Project Zero
FaceTime Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to cause arbitrary code execution Description: A memory corruption issue was addressed with improved input validation. CVE-2019-8648: Tao Huang and Tielei Wang of Team Pangu
Foundation Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8641: Samuel Groß and Natalie Silvanovich of Google Project Zero
Heimdal Available for: Apple Watch Series 1 and later Impact: An issue existed in Samba that may allow attackers to perform unauthorized actions by intercepting communications between services Description: This issue was addressed with improved checks to prevent unauthorized actions. CVE-2018-16860: Isaac Boukris and Andrew Bartlett of the Samba Team and Catalyst
libxslt Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to view sensitive information Description: A stack overflow was addressed with improved input validation. CVE-2019-13118: found by OSS-Fuzz
Messages Available for: Apple Watch Series 1 and later Impact: Users removed from an iMessage conversation may still be able to alter state Description: This issue was addressed with improved checks. CVE-2019-8659: Ryan Kontos (@ryanjkontos), Will Christensen of University of Oregon
Messages Available for: Apple Watch Series 1 and later Impact: A remote attacker may cause an unexpected application termination Description: A denial of service issue was addressed with improved validation. CVE-2019-8665: Michael Hernandez of XYZ Marketing
Quick Look Available for: Apple Watch Series 1 and later Impact: An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary Description: This issue was addressed with improved checks. CVE-2019-8662: Natalie Silvanovich and Samuel Groß of Google Project Zero
Siri Available for: Apple Watch Series 1 and later Impact: A remote attacker may be able to leak memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8646: Natalie Silvanovich of Google Project Zero
UIFoundation Available for: Apple Watch Series 1 and later Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution Description: An out-of-bounds read was addressed with improved input validation. CVE-2019-8657: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative
Wallet Available for: Apple Watch Series 1 and later Impact: A user may inadvertently complete an in-app purchase while on the lock screen Description: The issue was addressed with improved UI handling.
Installation note:
Instructions on how to update your Apple Watch software are available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About"
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201912-0509",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.6"
},
{
"model": "tvos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.4"
},
{
"model": "iphone os",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.4"
},
{
"model": "enterprise linux desktop",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "enterprise linux workstation",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "enterprise linux server",
"scope": "eq",
"trust": 1.0,
"vendor": "redhat",
"version": "7.0"
},
{
"model": "icloud",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "7.13"
},
{
"model": "icloud",
"scope": "gte",
"trust": 1.0,
"vendor": "apple",
"version": "10.0"
},
{
"model": "watchos",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "5.3"
},
{
"model": "itunes",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.9.6"
},
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.6"
},
{
"model": "safari",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "12.1.2"
},
{
"model": "icloud",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 10.6 earlier"
},
{
"model": "icloud",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 7.13 earlier"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.4 earlier"
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 12.9.6 earlier"
},
{
"model": "macos high sierra",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "(security update 2019-004 not applied )"
},
{
"model": "macos mojave",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10.14.6 earlier"
},
{
"model": "macos sierra",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "(security update 2019-004 not applied )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.1.2 earlier"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.4 earlier"
},
{
"model": "watchos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "5.3 earlier"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:icloud",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:itunes",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_high_sierra",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_mojave",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_sierra",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:watchos",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
}
],
"trust": 0.6
},
"cve": "CVE-2019-8688",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2019-8688",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.0,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-160123",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"id": "CVE-2019-8688",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-8688",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201907-1232",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-160123",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Arbitrary code execution * Insufficient access restrictions * information leak * Service operation interruption (DoS) * Information falsification * Privilege escalation * Sandbox avoidance. Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. The following products and versions are affected: Apple iOS prior to 12.4; Windows-based iTunes prior to 12.9.6; tvOS prior to 12.4; Safari prior to 12.1.2; macOS Mojave prior to 10.14.6; watchOS prior to 5.3. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA512\n\n- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4515-1 security@debian.org\nhttps://www.debian.org/security/ Alberto Garcia\nSeptember 04, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : webkit2gtk\nCVE ID : CVE-2019-8644 CVE-2019-8649 CVE-2019-8658 CVE-2019-8666\n CVE-2019-8669 CVE-2019-8671 CVE-2019-8672 CVE-2019-8673\n CVE-2019-8676 CVE-2019-8677 CVE-2019-8678 CVE-2019-8679\n CVE-2019-8680 CVE-2019-8681 CVE-2019-8683 CVE-2019-8684\n CVE-2019-8686 CVE-2019-8687 CVE-2019-8688 CVE-2019-8689\n CVE-2019-8690\n\nSeveral vulnerabilities have been discovered in the webkit2gtk web\nengine:\n\nCVE-2019-8644\n\n G. \n\nCVE-2019-8681\n\n G. \n\nCVE-2019-8686\n\n G. \n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.24.4-1~deb10u1. \n\nWe recommend that you upgrade your webkit2gtk packages. \n\nFor the detailed security status of webkit2gtk please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/webkit2gtk\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org\n-----BEGIN PGP SIGNATURE-----\n\niQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAl1wJHoACgkQEMKTtsN8\nTjaQlw//fmWHtAwh8WO+GqE/mAHWu7Ph2aDRr/WtZ636WZXBFKc5uO1ja+FMzSAx\n0UE5bQXK/mNk68HzdmwMZzkwz7rZGaiEHVQffAapxvjKCfPzgd7p70Ea49yLVuoH\nmEAJ2PRd7jSI0CnLrOxFsiCkTHI3rZjPtZ04pePDOmNA3TS9u4sMNcfz0LbKaFvq\n0/VNDCZ7MsBZq2c1Feg3pdwtRd6qJ0tXPIme6Q5OGWnIzCaa72bl/pdWWmvQzelh\nLjs7FCQm/DInrOHeAqMW14f18j10Is/d2p27hroOK4F4fnUvsxvU6gOoKTl3dyrA\ndrQJ1EIFg5Qt6AsVCdHogbrFjn9sStcaa0Yue2UhogJjh+tCugqcWpvad+Dzd61t\nPtl+NmIWYBeJG+LYw2c5MBrrmBrt2ajZBeDUaLR+v/FuvGuPgGr7jNZybl3n8lkQ\njbH2FrC/TIDZjeT84bnPuxbGG9ITyE7f8kB+isXZPvRqMccebRpyM8mnq+z1ywTf\nUxC9M3aIaq/CYuqo9xcdUVjTcUotIQgUSw+JyKjc38Ksa32PrMj84mmwp4UvOVHt\ng0OandgtSGjx+skzJOevttJ5baX6qSgtuZvxFmvPGMn2BSRpRHrSXX2OHqK5ux36\n8xQAXsSZtm8E5q3MtzvOmW2lkdprocmdWfwxrvA/QoaFyJzQMVM=x0Ii\n-----END PGP SIGNATURE-----\n. ------------------------------------------------------------------------\nWebKitGTK and WPE WebKit Security Advisory WSA-2019-0004\n------------------------------------------------------------------------\n\nDate reported : August 29, 2019\nAdvisory ID : WSA-2019-0004\nWebKitGTK Advisory URL : https://webkitgtk.org/security/WSA-2019-0004.html\nWPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2019-0004.html\nCVE identifiers : CVE-2019-8644, CVE-2019-8649, CVE-2019-8658,\n CVE-2019-8666, CVE-2019-8669, CVE-2019-8671,\n CVE-2019-8672, CVE-2019-8673, CVE-2019-8676,\n CVE-2019-8677, CVE-2019-8678, CVE-2019-8679,\n CVE-2019-8680, CVE-2019-8681, CVE-2019-8683,\n CVE-2019-8684, CVE-2019-8686, CVE-2019-8687,\n CVE-2019-8688, CVE-2019-8689, CVE-2019-8690. \n\nSeveral vulnerabilities were discovered in WebKitGTK and WPE WebKit. \n\nCVE-2019-8644\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to G. Geshev working with Trend Micro\u0027s Zero Day Initiative. \n\nCVE-2019-8649\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to Sergei Glazunov of Google Project Zero. A logic issue existed in the handling of\n synchronous page loads. \n\nCVE-2019-8658\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to akayn working with Trend Micro\u0027s Zero Day Initiative. \n\nCVE-2019-8666\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to Zongming Wang (\u738b\u5b97\u660e) and Zhe Jin (\u91d1\u54f2) from Chengdu Security\n Response Center of Qihoo 360 Technology Co. Ltd. \n\nCVE-2019-8669\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to akayn working with Trend Micro\u0027s Zero Day Initiative. \n\nCVE-2019-8671\n Versions affected: WebKitGTK and WPE WebKit before 2.24.2. \n Credit to Apple. \n\nCVE-2019-8672\n Versions affected: WebKitGTK and WPE WebKit before 2.24.2. \n Credit to Samuel Gro\u00df of Google Project Zero. \n\nCVE-2019-8673\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech. \n\nCVE-2019-8676\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to Soyeon Park and Wen Xu of SSLab at Georgia Tech. \n\nCVE-2019-8677\n Versions affected: WebKitGTK and WPE WebKit before 2.24.2. \n Credit to Jihui Lu of Tencent KeenLab. \n\nCVE-2019-8678\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to an anonymous researcher, Anthony Lai (@darkfloyd1014) of\n Knownsec, Ken Wong (@wwkenwong) of VXRL, Jeonghoon Shin (@singi21a)\n of Theori, Johnny Yu (@straight_blast) of VX Browser Exploitation\n Group, Chris Chan (@dr4g0nfl4me) of VX Browser Exploitation Group,\n Phil Mok (@shadyhamsters) of VX Browser Exploitation Group, Alan Ho\n (@alan_h0) of Knownsec, Byron Wai of VX Browser Exploitation. \n\nCVE-2019-8679\n Versions affected: WebKitGTK and WPE WebKit before 2.24.2. \n Credit to Jihui Lu of Tencent KeenLab. \n\nCVE-2019-8680\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to Jihui Lu of Tencent KeenLab. \n\nCVE-2019-8681\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to G. Geshev working with Trend Micro Zero Day Initiative. \n\nCVE-2019-8683\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to lokihardt of Google Project Zero. \n\nCVE-2019-8684\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to lokihardt of Google Project Zero. \n\nCVE-2019-8686\n Versions affected: WebKitGTK and WPE WebKit before 2.24.2. \n Credit to G. Geshev working with Trend Micro\u0027s Zero Day Initiative. \n\nCVE-2019-8687\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to Apple. \n\nCVE-2019-8688\n Versions affected: WebKitGTK before 2.24.4 and WPE WebKit before\n 2.24.3. \n Credit to Insu Yun of SSLab at Georgia Tech. \n\nCVE-2019-8689\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to lokihardt of Google Project Zero. \n\nCVE-2019-8690\n Versions affected: WebKitGTK and WPE WebKit before 2.24.3. \n Credit to Sergei Glazunov of Google Project Zero. A logic issue existed in the handling of\n document loads. \n\n\nWe recommend updating to the latest stable versions of WebKitGTK and WPE\nWebKit. It is the best way to ensure that you are running safe versions\nof WebKit. Please check our websites for information about the latest\nstable releases. \n\nFurther information about WebKitGTK and WPE WebKit security advisories\ncan be found at: https://webkitgtk.org/security.html or\nhttps://wpewebkit.org/security/. \n\nThe WebKitGTK and WPE WebKit team,\nAugust 29, 2019\n. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2019-8-13-3 Additional information for\nAPPLE-SA-2019-7-22-4 watchOS 5.3\n\nwatchOS 5.3 addresses the following:\n\nBluetooth\nAvailable for: Apple Watch Series 1 and later\nImpact: An attacker in a privileged network position may be able to\nintercept Bluetooth traffic (Key Negotiation of Bluetooth - KNOB)\nDescription: An input validation issue existed in Bluetooth. \nCVE-2019-9506: Daniele Antonioli of SUTD, Singapore, Dr. Nils Ole\nTippenhauer of CISPA, Germany, and Prof. Kasper Rasmussen of\nUniversity of Oxford, England\nEntry added August 13, 2019\n\nCore Data\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8646: Natalie Silvanovich of Google Project Zero\n\nCore Data\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A use after free issue was addressed with improved\nmemory management. \nCVE-2019-8647: Samuel Gro\u00df and Natalie Silvanovich of Google Project\nZero\n\nCore Data\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-8660: Samuel Gro\u00df and Natalie Silvanovich of Google Project\nZero\n\nDigital Touch\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8624: Natalie Silvanovich of Google Project Zero\n\nFaceTime\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to cause arbitrary code\nexecution\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2019-8648: Tao Huang and Tielei Wang of Team Pangu\n\nFoundation\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to cause unexpected application\ntermination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8641: Samuel Gro\u00df and Natalie Silvanovich of Google Project\nZero\n\nHeimdal\nAvailable for: Apple Watch Series 1 and later\nImpact: An issue existed in Samba that may allow attackers to perform\nunauthorized actions by intercepting communications between services\nDescription: This issue was addressed with improved checks to prevent\nunauthorized actions. \nCVE-2018-16860: Isaac Boukris and Andrew Bartlett of the Samba Team\nand Catalyst\n\nlibxslt\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to view sensitive information\nDescription: A stack overflow was addressed with improved input\nvalidation. \nCVE-2019-13118: found by OSS-Fuzz\n\nMessages\nAvailable for: Apple Watch Series 1 and later\nImpact: Users removed from an iMessage conversation may still be able\nto alter state\nDescription: This issue was addressed with improved checks. \nCVE-2019-8659: Ryan Kontos (@ryanjkontos), Will Christensen of\nUniversity of Oregon\n\nMessages\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may cause an unexpected application\ntermination\nDescription: A denial of service issue was addressed with improved\nvalidation. \nCVE-2019-8665: Michael Hernandez of XYZ Marketing\n\nQuick Look\nAvailable for: Apple Watch Series 1 and later\nImpact: An attacker may be able to trigger a use-after-free in an\napplication deserializing an untrusted NSDictionary\nDescription: This issue was addressed with improved checks. \nCVE-2019-8662: Natalie Silvanovich and Samuel Gro\u00df of Google Project\nZero\n\nSiri\nAvailable for: Apple Watch Series 1 and later\nImpact: A remote attacker may be able to leak memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8646: Natalie Silvanovich of Google Project Zero\n\nUIFoundation\nAvailable for: Apple Watch Series 1 and later\nImpact: Parsing a maliciously crafted office document may lead to an\nunexpected application termination or arbitrary code execution\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2019-8657: riusksk of VulWar Corp working with Trend Micro\u0027s Zero\nDay Initiative\n\nWallet\nAvailable for: Apple Watch Series 1 and later\nImpact: A user may inadvertently complete an in-app purchase while on\nthe lock screen\nDescription: The issue was addressed with improved UI handling. \n\nInstallation note:\n\nInstructions on how to update your Apple Watch software are\navailable at https://support.apple.com/kb/HT204641\n\nTo check the version on your Apple Watch, open the Apple Watch app\non your iPhone and select \"My Watch \u003e General \u003e About\". \n\nAlternatively, on your watch, select \"My Watch \u003e General \u003e About\"",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-8688"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "154359"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "154256"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-8688",
"trust": 3.3
},
{
"db": "JVN",
"id": "JVNVU93368270",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006634",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "153739",
"trust": 0.7
},
{
"db": "PACKETSTORM",
"id": "153718",
"trust": 0.7
},
{
"db": "AUSCERT",
"id": "ESB-2020.3399",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2746",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.4456",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.3294",
"trust": 0.6
},
{
"db": "AUSCERT",
"id": "ESB-2019.2761",
"trust": 0.6
},
{
"db": "BID",
"id": "109328",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-160123",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "154359",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "153726",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "154256",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "153741",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "154056",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "153740",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "154359"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "154256"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"id": "VAR-201912-0509",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-160123"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-29T20:11:23.220000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "About the security content of iCloud for Windows 7.13",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210357"
},
{
"title": "About the security content of iCloud for Windows 10.6",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210358"
},
{
"title": "About the security content of iOS 12.4",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210346"
},
{
"title": "About the security content of tvOS 12.4",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210351"
},
{
"title": "About the security content of Safari 12.1.2",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210355"
},
{
"title": "About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210348"
},
{
"title": "About the security content of watchOS 5.3",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210353"
},
{
"title": "About the security content of iTunes 12.9.6 for Windows",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT210356"
},
{
"title": "Multiple Apple product WebKit Fixes for component security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=95399"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-787",
"trust": 1.0
},
{
"problemtype": "CWE-119",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8688"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210346"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210348"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210351"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210353"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210355"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210356"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210357"
},
{
"trust": 1.7,
"url": "https://support.apple.com/ht210358"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8669"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8689"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8672"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8683"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8676"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8684"
},
{
"trust": 1.6,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8658"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8679"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8687"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8666"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8680"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8681"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8671"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8690"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8673"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8644"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8649"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8677"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8685"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8678"
},
{
"trust": 1.4,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8686"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8662"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8682"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8660"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8624"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8659"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8648"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8647"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8657"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8665"
},
{
"trust": 1.0,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8646"
},
{
"trust": 0.9,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8670"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8669"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8648"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8680"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8688"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8692"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8699"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8671"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8647"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8681"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8689"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8691"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8667"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8672"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8646"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8682"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8690"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8670"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8624"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8665"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8673"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8683"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8693"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8644"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8663"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8662"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8676"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8684"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8694"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8649"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8661"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8677"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8685"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8695"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8657"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8660"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8678"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8686"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8697"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8658"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8659"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8679"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8687"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8698"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8666"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu93368270/"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8663"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8698"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8699"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8661"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8692"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8691"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8693"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8694"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8667"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8695"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8697"
},
{
"trust": 0.7,
"url": "https://webkitgtk.org/security/wsa-2019-0004.html"
},
{
"trust": 0.7,
"url": "https://wpewebkit.org/security/wsa-2019-0004.html"
},
{
"trust": 0.6,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.6,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.6,
"url": "https://lists.apple.com/archives/security-announce/2019/jul/msg00004.html"
},
{
"trust": 0.6,
"url": "https://lists.apple.com/archives/security-announce/2019/jul/msg00003.html"
},
{
"trust": 0.6,
"url": "https://lists.apple.com/archives/security-announce/2019/jul/msg00002.html"
},
{
"trust": 0.6,
"url": "https://lists.apple.com/archives/security-announce/2019/jul/msg00000.html"
},
{
"trust": 0.6,
"url": "https://www.apple.com/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-au/ht210351"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-au/ht210357"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-au/ht210358"
},
{
"trust": 0.6,
"url": "https://www.suse.com/support/update/announcement/2019/suse-su-20193044-1.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2746/"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/153718/apple-security-advisory-2019-7-22-3.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.3294/"
},
{
"trust": 0.6,
"url": "https://www.securityfocus.com/bid/109328"
},
{
"trust": 0.6,
"url": "https://packetstormsecurity.com/files/153739/apple-security-advisory-2019-7-23-3.html"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.2761/"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2020.3399/"
},
{
"trust": 0.6,
"url": "https://support.apple.com/en-us/ht210353"
},
{
"trust": 0.6,
"url": "https://www.auscert.org.au/bulletins/esb-2019.4456/"
},
{
"trust": 0.6,
"url": "https://vigilance.fr/vulnerability/apple-macos-multiple-vulnerabilities-29859"
},
{
"trust": 0.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-13118"
},
{
"trust": 0.2,
"url": "https://support.apple.com/ht204283"
},
{
"trust": 0.2,
"url": "https://support.apple.com/kb/ht204641"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-16860"
},
{
"trust": 0.2,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-8641"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/faq"
},
{
"trust": 0.1,
"url": "https://security-tracker.debian.org/tracker/webkit2gtk"
},
{
"trust": 0.1,
"url": "https://www.debian.org/security/"
},
{
"trust": 0.1,
"url": "https://wpewebkit.org/security/."
},
{
"trust": 0.1,
"url": "https://webkitgtk.org/security.html"
},
{
"trust": 0.1,
"url": "https://www.apple.com/itunes/download/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-9506"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "154359"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "154256"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-160123"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "154359"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "154256"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
},
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-18T00:00:00",
"db": "VULHUB",
"id": "VHN-160123"
},
{
"date": "2019-07-24T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"date": "2019-07-24T19:22:22",
"db": "PACKETSTORM",
"id": "153739"
},
{
"date": "2019-07-23T10:32:22",
"db": "PACKETSTORM",
"id": "153718"
},
{
"date": "2019-09-04T23:03:33",
"db": "PACKETSTORM",
"id": "154359"
},
{
"date": "2019-07-23T02:22:22",
"db": "PACKETSTORM",
"id": "153726"
},
{
"date": "2019-08-30T01:37:49",
"db": "PACKETSTORM",
"id": "154256"
},
{
"date": "2019-07-24T19:02:22",
"db": "PACKETSTORM",
"id": "153741"
},
{
"date": "2019-08-14T20:32:22",
"db": "PACKETSTORM",
"id": "154056"
},
{
"date": "2019-07-24T18:22:22",
"db": "PACKETSTORM",
"id": "153740"
},
{
"date": "2019-07-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"date": "2019-12-18T18:15:34.537000",
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-12-20T00:00:00",
"db": "VULHUB",
"id": "VHN-160123"
},
{
"date": "2020-01-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-006634"
},
{
"date": "2021-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201907-1232"
},
{
"date": "2024-11-21T04:50:18.117000",
"db": "NVD",
"id": "CVE-2019-8688"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201907-1232"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Updates to product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-006634"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "code execution, xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "153739"
},
{
"db": "PACKETSTORM",
"id": "153718"
},
{
"db": "PACKETSTORM",
"id": "153726"
},
{
"db": "PACKETSTORM",
"id": "154256"
},
{
"db": "PACKETSTORM",
"id": "153741"
},
{
"db": "PACKETSTORM",
"id": "154056"
},
{
"db": "PACKETSTORM",
"id": "153740"
}
],
"trust": 0.7
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.