CVE-2019-8560

An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to read restricted memory.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://support.apple.com/HT210118	Vendor Advisory
https://support.apple.com/HT210119	Vendor Advisory
https://support.apple.com/HT210120	Vendor Advisory
https://support.apple.com/HT210122	Vendor Advisory
https://support.apple.com/HT210118	Vendor Advisory
https://support.apple.com/HT210119	Vendor Advisory
https://support.apple.com/HT210120	Vendor Advisory
https://support.apple.com/HT210122	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:apple:iphone_os::::::::
	cpe:2.3:o:apple:mac_os_x::::::::
	cpe:2.3:o:apple:tvos::::::::
	cpe:2.3:o:apple:watchos::::::::

History

21 Nov 2024, 04:50

Type	Values Removed	Values Added
References	~~() https://support.apple.com/HT210118 - Vendor Advisory~~	() https://support.apple.com/HT210118 - Vendor Advisory
References	~~() https://support.apple.com/HT210119 - Vendor Advisory~~	() https://support.apple.com/HT210119 - Vendor Advisory
References	~~() https://support.apple.com/HT210120 - Vendor Advisory~~	() https://support.apple.com/HT210120 - Vendor Advisory
References	~~() https://support.apple.com/HT210122 - Vendor Advisory~~	() https://support.apple.com/HT210122 - Vendor Advisory

Information

Published : 2019-12-18 18:15

Updated : 2024-11-21 04:50

NVD link : CVE-2019-8560

Mitre link : CVE-2019-8560

CVE.ORG link : CVE-2019-8560

JSON object : View

Products Affected

apple

iphone_os
tvos
watchos
mac_os_x

CWE

CWE-125

Out-of-bounds Read

{"id": "CVE-2019-8560", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2019-12-18T18:15:26.223", "references": [{"url": "https://support.apple.com/HT210118", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT210119", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT210120", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT210122", "tags": ["Vendor Advisory"], "source": "product-security@apple.com"}, {"url": "https://support.apple.com/HT210118", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT210119", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT210120", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://support.apple.com/HT210122", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1. A malicious application may be able to read restricted memory."}, {"lang": "es", "value": "Una lectura fuera de l\u00edmites fue abordada con una mejor comprobaci\u00f3n de l\u00edmites. Este problema es corregido en iOS versi\u00f3n 12.3, macOS Mojave versi\u00f3n 10.14.5, tvOS versi\u00f3n 12.3, watchOS versi\u00f3n 5.2.1. Una aplicaci\u00f3n maliciosa puede leer la memoria restringida."}], "lastModified": "2024-11-21T04:50:04.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DB19F7E8-75CA-4F9F-B79C-DB3B2C0E1EF4", "versionEndExcluding": "12.3"}, {"criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6E2DF4C-D103-4762-8CF1-6EDCE088FB1A", "versionEndExcluding": "10.14.5"}, {"criteria": "cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4F48137-53D0-4469-9785-57A7FC4482AB", "versionEndExcluding": "12.3"}, {"criteria": "cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CF31F5E0-94DD-41FD-80D4-8A27CAECB80B", "versionEndExcluding": "5.2.1"}], "operator": "OR"}]}], "sourceIdentifier": "product-security@apple.com"}