CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

Input validation

A logic issue existed with the display of notification previews. This issue was addressed with improved validation. This issue is fixed in iOS 13. Notification previews may show on Bluetooth accessories even when previews are disabled...

Design/Logic Flaw

A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fixed in iOS 13. Processing a maliciously crafted file may disclose user information...

CVE-2019-8760

This issue was addressed by improving Face ID machine learning models. This issue is fixed in iOS 13. A 3D model constructed to look like the enrolled user may authenticate via Face ID...

CVE-2019-8760

CVE-2019-8760 concerns Face ID authentication on Apple iOS. Description and multiple sources confirm that a 3D model constructed to resemble the enrolled user could bypass Face ID. The issue is addressed by improving Face ID machine learning models and was fixed in iOS 13. Related entries in Red ...

CVE-2019-8742

The issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 13. A person with physical access to an iOS device may be able to access contacts from the lock screen...

CVE-2019-8727

A logic issue was addressed with improved state management. This issue is fixed in iOS 13. Visiting a malicious website may lead to address bar spoofing...

CVE-2019-8711

A logic issue existed with the display of notification previews. This issue was addressed with improved validation. This issue is fixed in iOS 13. Notification previews may show on Bluetooth accessories even when previews are disabled...

CVE-2019-8731

A permissions issue existed in which execute permission was incorrectly granted. This issue was addressed with improved permission validation. This issue is fixed in iOS 13. Processing a maliciously crafted file may disclose user information...

CVE-2019-8731

CVE-2019-8731 maps to an Apple iOS 13 vulnerability in the Quick Look component where execute permissions were inappropriately granted. The root cause is a permissions validation issue; processing a maliciously crafted file could disclose user information. Apple fixes this with updated permission...

CVE-2019-8727

CVE-2019-8727 affects Safari on iOS prior to patch; a logic issue with state management in Safari’s address bar allows spoofing when visiting a malicious site. Fixed in iOS 13. Impact is limited to address bar spoofing; remediation is OS update (iOS 13+). Exploitation details are not provided bey...

CVE-2019-8711

The CVE-2019-8711 entry describes a logic issue in iOS 13 related to notification previews that could appear on Bluetooth accessories even when previews are disabled. The root cause is improper validation/display logic for notification previews. Apple confirms the fix is included in iOS 13, and t...

CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2019-8674

A logic issue was addressed with improved state management. This issue is fixed in iOS 13, Safari 13. Processing maliciously crafted web content may lead to universal cross site scripting...

CVE-2019-8674

CVE-2019-8674 is a logic issue in WebKit/Page Loading that was fixed by state-management improvements. It affects WebKit-based components used by iOS Safari, with impact described as universal cross-site scripting when processing malicious web content. The fix is deployed in iOS 13 and Safari 13....

Apple iOS/tvOS/iPadOS/watchOS/macOS CVE-2019-8848 Privilege Escalation Vulnerability

Description Apple iOS/tvOS/iPadOS/watchOS/macOS are prone to a privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges on an affected system. Technologies Affected Apple Ipad Mini- Apple TV Apple Watch Apple iOS 10 Apple iOS 10.0.1 Apple iOS 10.1 Apple i...

The iPhone 11 Pro’s Location Data Puzzler

One of the more curious behaviors of Apple's new iPhone 11 Pro is that it intermittently seeks the user's location information even when all applications and system services on the phone are individually set to never request this data. Apple says this is by design, but that response seems at odds...

CVE-2019-8771

This issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari 13.0.1, iOS 13. Maliciously crafted web content may violate iframe sandboxing policy...

Apple Shares Some Browsing History with Chinese Company

Apple is sending some browsing history of iOS 13 Safari users to Tencent Holdings Limited, a Chinese multinational conglomerate. The data shared is tied to the Safari Safe Browsing technology. Revelations of the relationship have drawn criticism from security and privacy experts. Apple’s Safari...