Apple TV 12.0.0 and < 12.3 Multiple Vulnerabilities

The version of Apple tvOS installed on the remote host is greater or equal to 12.0.0 and prior to 12.3. It is, therefore, affected by the following vulnerabilities :

• An application may be able to execute arbitrary code with system privileges. (CVE-2019-8593)

• Processing a maliciously crafted movie file may lead to arbitrary code execution. (CVE-2019-8585)

• A malicious application may be able to read restricted memory. (CVE-2019-8560)

• A malicious application may be able to execute arbitrary code with system privileges. (CVE-2019-8605)

• A local user may be able to cause unexpected system termination or read kernel memory. (CVE-2019-8576)

• An application may be able to cause unexpected system termination or write kernel memory. (CVE-2019-8591)

• A local user may be able to modify protected parts of the file system. (CVE-2019-8568)

• A malicious application may be able to gain root privileges. (CVE-2019-8637)

• An application may be able to gain elevated privileges. (CVE-2019-8577)

• A maliciously crafted SQL query may lead to arbitrary code execution. (CVE-2019-8600)

• A malicious application may be able to read restricted memory. (CVE-2019-8598)

• A malicious application may be able to elevate privileges. (CVE-2019-8602)

• An application may be able to execute arbitrary code with system privileges. (CVE-2019-8574)

• Processing maliciously crafted web content may result in the disclosure of process memory. (CVE-2019-8607)

• Processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-6237, CVE-2019-8571, CVE-2019-8583, CVE-2019-8584, CVE-2019-8586, CVE-2019-8587, CVE-2019-8594, CVE-2019-8595, CVE-2019-8596, CVE-2019-8597, CVE-2019-8601, CVE-2019-8608, CVE-2019-8609, CVE-2019-8610, CVE-2019-8611, CVE-2019-8615, CVE-2019-8619, CVE-2019-8622, CVE-2019-8623, CVE-2019-8628)

• A device may be passively tracked by its WiFi MAC address. (CVE-2019-8620)