Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Apple iOS, macOS, Safari, iTunes, iCloud may run malicious code

CVE-2019-8685 · published 6 years ago
Summary

Several Apple operating systems and apps had memory handling bugs that could let specially crafted web content cause the software to execute any code. The problem is fixed in the latest updates for iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, and iCloud for Windows. Ensure all devices and applications are upgraded to these versions to stay protected.

What to do
  • Update apple itunes to version 12.9.6 or later.
  • Update apple safari to version 12.1.2 or later.
  • Update apple iphone_os to version 12.4 or later.
  • Update apple mac_os_x to version 10.14.6 or later.
  • Update apple tvos to version 12.4 or later.
  • Update apple watchos to version 5.3 or later.
Affected software
VendorProductAffected versions
apple icloud < 7.13
>= 10.0, < 10.6
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
apple itunes < 12.9.6
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
apple safari < 12.1.2
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
apple iphone_os < 12.4
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
apple mac_os_x < 10.14.6
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
apple tvos < 12.4
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
apple watchos < 5.3
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
Original advisory text
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9...
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published18 Dec 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2019-8685 · NVD
Track software like this
Free during beta