ID

VAR-201912-0474

CVE

CVE-2019-7287

TITLE

apple's  iOS  Out-of-bounds write vulnerability in

DESCRIPTION

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges. apple's iOS Exists in an out-of-bounds write vulnerability.Information is obtained, information is tampered with, and service operation is interrupted. (DoS) It may be in a state. Apple iOS is prone to a memory-corruption vulnerability. Failed exploit attempts will result in a denial-of-service condition. The following versions fixes the issue: Versions prior to Apple iOS 12.1.4. IOKit is one of the components that read system information. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2019-2-07-1 iOS 12.1.4 iOS 12.1.4 is now available and addresses the following: FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: The initiator of a Group FaceTime call may be able to cause the recipient to answer Description: A logic issue existed in the handling of Group FaceTime calls. CVE-2019-6223: Grant Thompson of Catalina Foothills High School, Daven Morris of Arlington, TX Foundation Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7286: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero IOKit Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2019-7287: an anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel GroA of Google Project Zero Live Photos in FaceTime Available for: iPhone 5s and later, iPad Air and later, and iPod touch 6th generation Impact: A thorough security audit of the FaceTime service uncovered an issue with Live Photos Description: The issue was addressed with improved validation on the FaceTime server. CVE-2019-7288: Apple Installation note: This update is available through iTunes and Software Update on your iOS device, and will not appear in your computer's Software Update application, or in the Apple Downloads site. Make sure you have an Internet connection and have installed the latest version of iTunes from https://www.apple.com/itunes/ iTunes and Software Update on the device will automatically check Apple's update server on its weekly schedule. When an update is detected, it is downloaded and the option to be installed is presented to the user when the iOS device is docked. We recommend applying the update immediately if possible. Selecting Don't Install will present the option the next time you connect your iOS device. The automatic update process may take up to a week depending on the day that iTunes or the device checks for updates. You may manually obtain the update via the Check for Updates button within iTunes, or the Software Update on your device. To check that the iPhone, iPod touch, or iPad has been updated: * Navigate to Settings * Select General * Select About. The version after applying this update will be "iOS 12.1.4". Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlxcZmkpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3F9HRAA sYhaZOf89H/kgxsBJbnJWa4g3Gi+OVgw2cfLkLT8GlAa2tZW+9pvra8cYZZ2TlvV 20UNupWr5sJPru+OWMiEYGRvVBQI5UaIRyIR4IsRbDcbvKe4ml0WM5t96PA1y5wt vhV9CKFwJY40k9PAWbb87eHf1kf8W6yCNAmddskSVFtgPBmGmZX4+u5OTY1YjIyc ilOKOJAsgnn/E+OGZ8RiDcQljY3CruzdCBecczt0QkzuXuvoSlL9RujOBtjZ/uLd cDorb7v0I9PokAdYAksEmgXFL8PDsm5h4ELkS3/Cp4RF8krdybB/4RN3SosWNBpA 99jMxgA5Mc+yLdIwPM9WUd/iq51KkYx+MLXYWzJwplnqQAQYW9p0+wTGTmEB+2x5 wStyUhMGbh3u5u3HBSLx31q2lkbTZU6+/kcqe6aQX0NckJBXV/+yGylQNcKN6XDk vWb9pCOjfpv5WyqvJ7XgNoX5CQcLt6WzJ0onZoVrhJoEnm2T0TKC/Tv2OCs9eJzb SgjAmKmavEaebSUa2StV4JfoNVPt7ijZdu+theAoObVrrktiWGX04srqyFaLZd/w 57NvpxizrLDNUWLmuuELQ9m1zL+xCLbJp46y1EaojjkaFw4H/7+U9nuKtg6+8ay/ o2nlJlEaOnQzrL+jp7mLvW05upIw0Ii/fyKTCQmbKSg= =p+hh -----END PGP SIGNATURE-----

AFFECTED PRODUCTS

CVSS

PROBLEMTYPE DATA

THREAT TYPE

local

TYPE

buffer error

PATCH

EXTERNAL IDS

REFERENCES

CREDITS

An anonymous researcher, Clement Lecigne of Google Threat Analysis Group, Ian Beer of Google Project Zero, and Samuel Gro?? of Google Project Zero.

SOURCES

LAST UPDATE DATE

2024-11-23T19:51:10.224000+00:00

SOURCES UPDATE DATE

SOURCES RELEASE DATE