CVE-2019-8506

Katalog CVE

CVSS 8.8 · High KEV · sudah dieksploitasi EPSS 16,2%

Kerentanan Access of Resource Using Incompatible Type ('Type Confusion') pada apple icloud, apple itunes +7 lainnya. Skor CVSS 3.1 8.8 (High) menurut NVD. Masuk katalog KEV CISA pada 4 Mei 2022, artinya sudah terbukti dieksploitasi.

Deskripsi (NVD)

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

Rincian

Terbit di NVD

18 Desember 2019

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')

EPSS (30 hari)

16,2% peluang dieksploitasi; lebih tinggi dari 96,8% CVE lain

Known Exploited Vulnerabilities (CISA)

Nama

Apple Multiple Products Type Confusion Vulnerability

Masuk KEV

4 Mei 2022

Tenggat CISA

25 Mei 2022 (untuk instansi federal AS)

Ransomware

Belum tercatat

Tindakan wajib

Apply updates per vendor instructions.

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://support.apple.com/HT209599 release notes · advisory vendor
• https://support.apple.com/HT209601 release notes · advisory vendor
• https://support.apple.com/HT209602 release notes · advisory vendor
• https://support.apple.com/HT209603 release notes · advisory vendor
• https://support.apple.com/HT209604 release notes · advisory vendor
• https://support.apple.com/HT209605 release notes · advisory vendor
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8506 pemerintah AS