Advisories
watchOSExploitedCISA KEV listedHIGH2019-03-26
A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitra...
CVEs:CVE-2019-8506
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSExploitedCISA KEV listedCRITICAL2019-03-26
A use after free issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. An application may be able to gain elevated privileges.
CVEs:CVE-2019-8526
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSWeaponized exploitCRITICAL2019-03-26
A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges.
CVEs:CVE-2019-8565
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
watchOSWeaponized exploitHIGH2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lea...
CVEs:CVE-2019-8518
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSWeaponized exploitCRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lea...
CVEs:CVE-2019-8558
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSWeaponized exploitHIGH2019-03-26
A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. An application may be able to gain elevated privileges.
CVEs:CVE-2019-8514
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSWeaponized exploitHIGH2019-03-26
This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands.
CVEs:CVE-2019-8513
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
OtherPoC exploitHIGH2019-03-18
An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when...
CVEs:CVE-2019-3855
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| xcode |
affected |
apple |
— |
— |
macOSPoC exploitHIGH2019-03-26
A logic issue was addressed with improved validation. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to elevate privileges.
CVEs:CVE-2019-8561
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
watchOSPoC exploitHIGH2019-03-26
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to determine kernel memory layout.
CVEs:CVE-2019-8540
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSPoC exploitMEDIUM2019-03-26
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to de...
CVEs:CVE-2019-6207
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSCoalition ESS 30-63%CRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lead to unexpected application termination.
CVEs:CVE-2019-8507
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A buffer overflow was addressed with improved size validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A remote attacker may be able to cause unexpected system termination or corrupt kernel memory.
CVEs:CVE-2019-8527
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbi...
CVEs:CVE-2019-8544
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code e...
CVEs:CVE-2019-8535
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrar...
CVEs:CVE-2019-8523
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code exe...
CVEs:CVE-2019-7285
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrar...
CVEs:CVE-2019-6201
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbi...
CVEs:CVE-2019-8536
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted string may lead to a denial of service.
CVEs:CVE-2019-8516
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2. Clicking a malicious SMS link may lead to arbitrary code execution.
CVEs:CVE-2019-8553
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%CRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web cont...
CVEs:CVE-2019-6237
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.
CVEs:CVE-2019-8503
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%CRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lea...
CVEs:CVE-2019-8559
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%CRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lea...
CVEs:CVE-2019-8563
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%CRITICAL2019-03-26
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrar...
CVEs:CVE-2019-8524
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
Multiple input validation issues existed in MIG generated code. These issues were addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to execute arbitrar...
CVEs:CVE-2019-8549
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%CRITICAL2019-03-26
A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code exe...
CVEs:CVE-2019-8556
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. Processing a maliciously crafted font may result in the disclosure of process memory.
CVEs:CVE-2019-8517
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%CRITICAL2019-03-26
A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.
CVEs:CVE-2019-8562
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%HIGH2019-03-26
A buffer overflow was addressed with improved size validation. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2019-8555
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of p...
CVEs:CVE-2019-7292
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%MEDIUM2019-03-26
A cross-origin issue existed with the fetch API. This was addressed with improved input validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content ...
CVEs:CVE-2019-8515
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%HIGH2019-03-26
A user privacy issue was addressed by removing the broadcast MAC address. This issue is fixed in iOS 12.2. A device may be passively tracked by its WiFi MAC address.
CVEs:CVE-2019-8567
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
OtherCoalition ESS < 30%CRITICAL2019-03-26
A race condition existed during the installation of iCloud for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iCloud installer in an untrusted directory may result in arbitrary code...
CVEs:CVE-2019-6236
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
OtherCoalition ESS < 30%CRITICAL2019-03-26
A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in arbitrary code...
CVEs:CVE-2019-6232
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%MEDIUM2019-03-26
A permissions issue existed in the handling of motion and orientation data. This issue was addressed with improved restrictions. This issue is fixed in iOS 12.2. A website may be able to access sensor information without user consent.
CVEs:CVE-2019-8554
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%CRITICAL2019-03-26
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to universal cross site scripting.
CVEs:CVE-2019-8551
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%CRITICAL2019-03-26
A buffer overflow was addressed with improved bounds checking. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious application may be able to elevate privileges.
CVEs:CVE-2019-8542
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| icloud |
affected |
apple |
— |
— |
| iphone_os |
affected |
apple |
— |
— |
| itunes |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
An issue existed in the pausing of FaceTime video. The issue was resolved with improved logic. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A user’s video may not be paused in a FaceTime call if they exit the FaceTime app while...
CVEs:CVE-2019-8550
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%CRITICAL2019-03-26
A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A malicious application may be able to elevate privileges.
CVEs:CVE-2019-8511
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to elevate privileges.
CVEs:CVE-2019-8552
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%MEDIUM2019-03-26
A consistency issue was addressed with improved state handling. This issue is fixed in iOS 12.2. A website may be able to access the microphone without the microphone use indicator being shown.
CVEs:CVE-2019-6222
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
tvOSCoalition ESS < 30%HIGH2019-03-26
This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2. A malicious application may be able to overwrite arbitrary files.
CVEs:CVE-2019-8530
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%HIGH2019-03-26
This issue was addressed with improved checks. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to overwrite arbitrary files.
CVEs:CVE-2019-8521
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%MEDIUM2019-03-26
This issue was addressed with improved checks. This issue is fixed in iOS 12.2. Processing a maliciously crafted mail message may lead to S/MIME signature spoofing.
CVEs:CVE-2019-7284
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation re...
CVEs:CVE-2019-8502
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%MEDIUM2019-03-26
An API issue existed in the handling of microphone data. This issue was addressed with improved validation. This issue is fixed in iOS 12.2. A malicious application may be able to access the microphone without indication to the user.
CVEs:CVE-2019-8566
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%HIGH2019-03-26
This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure.
CVEs:CVE-2019-8512
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%CRITICAL2019-03-26
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.
CVEs:CVE-2019-6204
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
iOSCoalition ESS < 30%CRITICAL2019-03-26
A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.
CVEs:CVE-2019-8505
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| safari |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%CRITICAL2019-03-26
A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
CVEs:CVE-2019-8508
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%CRITICAL2019-03-26
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. An application may be able to execute arbitrary code with kernel privileges.
CVEs:CVE-2019-8529
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to de...
CVEs:CVE-2019-8510
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%LOW2019-03-26
A privacy issue existed in motion sensor calibration. This issue was addressed with improved motion sensor processing. This issue is fixed in iOS 12.2, watchOS 5.2. A malicious app may be able to track users between installs.
CVEs:CVE-2019-8541
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local user may be able to cause unexpected system termination or read kernel memory.
CVEs:CVE-2019-8545
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%MEDIUM2019-03-26
An access issue was addressed with improved memory management. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to view a user’s locked notes.
CVEs:CVE-2019-8537
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%HIGH2019-03-26
A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local user may be able to read kernel memory.
CVEs:CVE-2019-7293
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| tvos |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
watchOSCoalition ESS < 30%MEDIUM2019-03-26
An access issue was addressed with additional sandbox restrictions. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A local user may be able to view sensitive user information.
CVEs:CVE-2019-8546
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
| watchos |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%MEDIUM2019-03-26
A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local user may be able to read kernel memory.
CVEs:CVE-2019-8504
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| iphone_os |
affected |
apple |
— |
— |
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%MEDIUM2019-03-26
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. A malicious application may be able to read restricted memory.
CVEs:CVE-2019-8520
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%MEDIUM2019-03-26
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. An application may be able to read restricted memory.
CVEs:CVE-2019-8519
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%HIGH2019-03-26
This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Mojave 10.14.4. A malicious application may bypass Gatekeeper checks.
CVEs:CVE-2019-6239
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%HIGH2019-03-26
A lock handling issue was addressed with improved lock handling. This issue is fixed in macOS Mojave 10.14.4. A Mac may not lock when disconnecting from an external monitor.
CVEs:CVE-2019-8533
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
macOSCoalition ESS < 30%MEDIUM2019-03-26
A logic issue was addressed with improved state management. This issue is fixed in macOS Mojave 10.14.4. An encrypted volume may be unmounted and remounted by a different user without prompting for the password.
CVEs:CVE-2019-8522
Affected products
| Product | Status | Vendor | Package | Ecosystem |
|---|
| mac_os_x |
affected |
apple |
— |
— |
