CVE-2019-8502

An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.

CVSS v3 3.3 LOW
CVSS v2.0 4.3 MEDIUM

3.3^/10

CVSS v3 : LOW

Vector :

Exploitability : 1.8 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://support.apple.com/HT209599	Vendor Advisory
https://support.apple.com/HT209600	Vendor Advisory
https://support.apple.com/HT209601	Vendor Advisory
https://support.apple.com/HT209602	Vendor Advisory
https://support.apple.com/HT209599	Vendor Advisory
https://support.apple.com/HT209600	Vendor Advisory
https://support.apple.com/HT209601	Vendor Advisory
https://support.apple.com/HT209602	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:mac_os_x::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

21 Nov 2024, 04:49

Type	Values Removed	Values Added
References	~~() https://support.apple.com/HT209599 - Vendor Advisory~~	() https://support.apple.com/HT209599 - Vendor Advisory
References	~~() https://support.apple.com/HT209600 - Vendor Advisory~~	() https://support.apple.com/HT209600 - Vendor Advisory
References	~~() https://support.apple.com/HT209601 - Vendor Advisory~~	() https://support.apple.com/HT209601 - Vendor Advisory
References	~~() https://support.apple.com/HT209602 - Vendor Advisory~~	() https://support.apple.com/HT209602 - Vendor Advisory

Information

Published : 2019-12-18 18:15

Updated : 2024-11-21 04:49

NVD link : CVE-2019-8502

Mitre link : CVE-2019-8502

CVE.ORG link : CVE-2019-8502

JSON object : View

Products Affected

apple

mac_os_x
iphone_os
watchos
tvos

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2019-8502", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 1.8}]}, "published": "2019-12-18T18:15:22.537", "references": [{"url": "https://support.apple.com/HT209599", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT209600", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT209601", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT209602", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT209599", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT209600", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT209601", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT209602", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization."}, {"lang": "es", "value": "Se present\u00f3 un problema de API en el manejo de las peticiones de dictado. Este problema fue abordado con una comprobaci\u00f3n mejorada. Este problema es corregido en iOS versi\u00f3n 12.2, macOS Mojave versi\u00f3n 10.14.4, tvOS versi\u00f3n 12.2, watchOS versi\u00f3n 5.2. Una aplicaci\u00f3n maliciosa puede iniciar una petici\u00f3n de dictado sin la autorizaci\u00f3n del usuario."}], "lastModified": "2024-11-21T04:49:57.353", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1531E802-5419-4B38-8C0C-BDCBC272648F", "versionEndExcluding": "12.2"}, {"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09CDBB72-2A0D-4321-BA1F-4FB326A5646A", "versionEndExcluding": "10.14.4"}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "98912716-69F2-4372-98F0-BD6CCA9AAEB9", "versionEndExcluding": "12.2"}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8962A4FE-AE67-421E-9635-B03E2EBCDF19", "versionEndExcluding": "5.2"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}