CVE-2019-8766

Published on: 12/18/2019 12:00:00 AM UTC

Last Modified on: 11/30/2021 09:08:00 PM UTC

CVE-2019-8766

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Certain versions of Icloud from Apple contain the following vulnerability:

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2019-8766 has been assigned by [email protected] to track the vulnerability - currently rated as HIGH severity.
Affected Vendor/Software: Apple - watchOS version < watchOS 6.1
Affected Vendor/Software: Apple - iCloud for Windows version < iCloud for Windows 11.0

CVSS3 Score: 8.8 - HIGH

Attack Vector ^ⓘ	Attack Complexity	Privileges Required	User Interaction
NETWORK	LOW	NONE	REQUIRED
Scope	Confidentiality Impact	Integrity Impact	Availability Impact
UNCHANGED	HIGH	HIGH	HIGH

CVSS2 Score: 6.8 - MEDIUM

Access Vector^ⓘ	Access Complexity	Authentication
NETWORK	MEDIUM	NONE
Confidentiality Impact	Integrity Impact	Availability Impact
PARTIAL	PARTIAL	PARTIAL

CVE References

Description	Tags ^ⓘ	Link
About the security content of iCloud for Windows 10.8 - Apple Support	Vendor Advisory support.apple.com text/html	MISC support.apple.com/HT210727
About the security content of watchOS 6.1 - Apple Support	Vendor Advisory support.apple.com text/html	MISC support.apple.com/HT210724
WebkitGTK+: Multiple vulnerabilities (GLSA 202003-22) — Gentoo security	security.gentoo.org text/html	GENTOO GLSA-202003-22

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

296075 Oracle Solaris 11.4 Support Repository Update (SRU) 21.69.0 Missing (CPUAPR2020)
377553 Alibaba Cloud Linux Security Update for webkitgtk4 (ALINUX2-SA-2020:0147)
501286 Alpine Linux Security Update for webkit2gtk
501936 Alpine Linux Security Update for webkit2gtk
751623 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:0142-1)
751646 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:0183-1)
751648 SUSE Enterprise Linux Security Update for webkit2gtk3 (SUSE-SU-2022:0182-1)
751659 OpenSUSE Security Update for webkit2gtk3 (openSUSE-SU-2022:0182-1)
751755 OpenSUSE Security Update for webkit2gtk3 (openSUSE-SU-2022:0182-2)
770068 Red Hat OpenShift Container Platform 4.6 Security Update (RHSA-2021:0436)
940362 AlmaLinux Security Update for GNOME (ALSA-2020:4451)
960761 Rocky Linux Security Update for GNOME (RLSA-2020:4451)

Known Affected Configurations (CPE V2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Application	Apple	Icloud	All	All	All	All
Application	Apple	Icloud	All	All	All	All
Operating System	Apple	Watchos	All	All	All	All
Operating System	Apple	Watchos	All	All	All	All

cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*:
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*:
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*:
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*:

No vendor comments have been submitted for this CVE