CVE-2019-6235: A memory corruption issue was addressed with improved validation

Critical severity · published Mar 4, 2019

CVE-2019-6235

A memory corruption issue was addressed with improved validation

10.0

CVSS

2.1%

EPSS

On KEV

Description

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3, iTunes 12.9.3 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)2.1% · higher than 82% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

iOS · Apple

before iOS 12.1.3 · source: vendor, NVD

macOS · Apple

before macOS Mojave 10.14.3 · source: vendor

iTunes for Windows · Apple

before iTunes 12.9.3 for Windows · source: vendor

tvOS · Apple

before tvOS 12.1.2 · source: vendor

watchOS · Apple

before watchOS 5.1.3 · source: vendor

Itunes · Apple

before 12.9.3 · source: NVD

Mac OS X · Apple

before 10.14.3 · source: NVD

TV OS · Apple

before 12.1.2 · source: NVD

Watch OS · Apple

before 5.1.3 · source: NVD

Affected product

iOS

Apple

All iOS CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-6235

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-6235

Third Party Advisory

http://www.securityfocus.com/bid/106724

Vendor Advisory

https://support.apple.com/HT209443

Vendor Advisory

https://support.apple.com/HT209446

Vendor Advisory

https://support.apple.com/HT209447

Vendor Advisory

https://support.apple.com/HT209448

Vendor Advisory

https://support.apple.com/HT209450