Memory corruption in Apple iOS - CVE-2019-6233
Published: January 23, 2019 / Updated: January 29, 2019
Vulnerability identifier: #VU17166
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-6233
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code.
The weakness exists due to a boundary error in the WebKit component when handling malicious input. A remote attacker can trick the victim into processing a specially crafted content, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to a boundary error in the WebKit component when handling malicious input. A remote attacker can trick the victim into processing a specially crafted content, trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
Apple iOS
Gentoo Linux
tvOS
Opensuse
iCloud for Windows
Apple Safari
iTunes
Gentoo Linux
tvOS
Opensuse
iCloud for Windows
Apple Safari
iTunes
How to mitigate CVE-2019-6233
Update to version 12.1.3.
Apple iOS - update to 12.1.3 16D39
iCloud for Windows - update to 7.10
Apple Safari - update to 12.0.3
tvOS - update to 12.1.2
iTunes - update to 12.9.3
iCloud for Windows - update to 7.10
Apple Safari - update to 12.0.3
tvOS - update to 12.1.2
iTunes - update to 12.9.3
External References
Related Security Bulletins
- Multiple vulnerabilities in Apple iOS
- Multiple vulnerabilities in Apple Safari
- Multiple vulnerabilities in Apple iCloud
- Multiple vulnerabilities in Apple tvOS
- Multiple vulnerabilities in Apple iTunes
- OpenSUSE Linux update for webkit2gtk3
- OpenSUSE Linux update for webkit2gtk3
- Gentoo update for WebkitGTK+