Sign-up

ID

VAR-201912-0502


CVE

CVE-2019-8565


TITLE

plural Apple Updates to product vulnerabilities

Trust: 0.8

sources: JVNDB: JVNDB-2019-001923

DESCRIPTION

A race condition was addressed with additional validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A malicious application may be able to gain root privileges. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Insufficient access restrictions * Cross-site scripting * Privilege escalation * Service operation interruption (DoS) * Sandbox avoidance * Information falsification * information leak * Arbitrary code execution * Arbitrary command execution * Memory corruption. in the United States. Apple iOS is an operating system developed for mobile devices. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Feedback Assistant is one of the system error feedback components. A race condition vulnerability exists in the Feedback Assistant component in Apple iOS versions prior to 12.2 and macOS Mojave versions prior to 10.14.4. By using a specially-crafted application

Trust: 1.8

sources: NVD: CVE-2019-8565 // JVNDB: JVNDB-2019-001923 // VULHUB: VHN-160000 // VULMON: CVE-2019-8565

AFFECTED PRODUCTS

vendor:applemodel:mac os xscope:ltversion:10.14.4

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:12.2

Trust: 1.0

vendor:applemodel:icloudscope:ltversion:for windows 7.11 earlier

Trust: 0.8

vendor:applemodel:iosscope:ltversion:12.2 earlier

Trust: 0.8

vendor:applemodel:itunesscope:ltversion:12.9.4 for windows earlier

Trust: 0.8

vendor:applemodel:macos high sierrascope:eqversion:(security update 2019-002 not applied )

Trust: 0.8

vendor:applemodel:macos mojavescope:ltversion:10.14.4 earlier

Trust: 0.8

vendor:applemodel:macos sierrascope:eqversion:(security update 2019-002 not applied )

Trust: 0.8

vendor:applemodel:safariscope:ltversion:12.1 earlier

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:12.2 earlier

Trust: 0.8

vendor:applemodel:watchosscope:ltversion:5.2 earlier

Trust: 0.8

vendor:applemodel:xcodescope:ltversion:10.2 earlier

Trust: 0.8

sources: JVNDB: JVNDB-2019-001923 // NVD: CVE-2019-8565

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2019-8565
value: HIGH

Trust: 1.0

CNNVD: CNNVD-201903-1022
value: HIGH

Trust: 0.6

VULHUB: VHN-160000
value: HIGH

Trust: 0.1

VULMON: CVE-2019-8565
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2019-8565
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

VULHUB: VHN-160000
severity: HIGH
baseScore: 7.6
vectorString: AV:N/AC:H/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: HIGH
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 4.9
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2019-8565
baseSeverity: HIGH
baseScore: 7.0
vectorString: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 1.0
impactScore: 5.9
version: 3.1

Trust: 1.0

sources: VULHUB: VHN-160000 // VULMON: CVE-2019-8565 // CNNVD: CNNVD-201903-1022 // NVD: CVE-2019-8565

PROBLEMTYPE DATA

problemtype:CWE-362

Trust: 1.1

sources: VULHUB: VHN-160000 // NVD: CVE-2019-8565

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201903-1022

TYPE

competition condition problem

Trust: 0.6

sources: CNNVD: CNNVD-201903-1022

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2019-001923

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-160000 // 
            
            
            
            VULMON: CVE-2019-8565

PATCH
title:About the security content of iCloud for Windows 7.11url:https://support.apple.com/en-us/HT209605
Trust: 0.8
title:About the security content of watchOS 5.2url:https://support.apple.com/en-us/HT209602
Trust: 0.8
title:About the security content of iOS 12.2url:https://support.apple.com/en-us/HT209599
Trust: 0.8
title:About the security content of Xcode 10.2url:https://support.apple.com/en-us/HT209606
Trust: 0.8
title:About the security content of tvOS 12.2url:https://support.apple.com/en-us/HT209601
Trust: 0.8
title:About the security content of macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierraurl:https://support.apple.com/en-us/HT209600
Trust: 0.8
title:About the security content of Safari 12.1url:https://support.apple.com/en-us/HT209603
Trust: 0.8
title:About the security content of iTunes 12.9.4 for Windowsurl:https://support.apple.com/en-us/HT209604
Trust: 0.8
title:Apple iOS  and Apple macOS Mojave Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=90461
Trust: 0.6
title:Apple: macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierraurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=71ec5bcffc9e0f0f386b31db20244ce1
Trust: 0.1
title:cve-2019-8565url:https://github.com/Gentle-Knife/cve-2019-8565 
Trust: 0.1
title:sploitsurl:https://github.com/ChiChou/sploits 
Trust: 0.1
title:sploitsurl:https://github.com/ChiChou/CVE-2018-8142-poc 
Trust: 0.1
title:sec-daily-2019url:https://github.com/alphaSeclab/sec-daily-2019 
Trust: 0.1
title:CVE-POCurl:https://github.com/0xT11/CVE-POC 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/developer3000S/PoC-in-GitHub 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/nomi-sec/PoC-in-GitHub 
Trust: 0.1
title:PoC-in-GitHuburl:https://github.com/hectorgie/PoC-in-GitHub 
Trust: 0.1
title:Exp101tsArchiv30thersurl:https://github.com/nu11secur1ty/Exp101tsArchiv30thers 
Trust: 0.1
title:awesome-cve-poc_qazbnm456url:https://github.com/xbl3/awesome-cve-poc_qazbnm456 
Trust: 0.1
title:Threatposturl:https://threatpost.com/apple-ios-12-2-patches-51-serious-flaws/143162/
Trust: 0.1
sources:
            
            
            VULMON: CVE-2019-8565 // 
            
            
            
            JVNDB: JVNDB-2019-001923 // 
            
            
            
            CNNVD: CNNVD-201903-1022

EXTERNAL IDS
db:NVDid:CVE-2019-8565
Trust: 2.6
db:JVNid:JVNVU93236010
Trust: 0.8
db:JVNDBid:JVNDB-2019-001923
Trust: 0.8
db:CNNVDid:CNNVD-201903-1022
Trust: 0.7
db:PACKETSTORMid:152996
Trust: 0.7
db:AUSCERTid:ESB-2019.0991
Trust: 0.6
db:VULHUBid:VHN-160000
Trust: 0.1
db:EXPLOIT-DBid:46914
Trust: 0.1
db:VULMONid:CVE-2019-8565
Trust: 0.1
sources:
            
            
            VULHUB: VHN-160000 // 
            
            
            
            VULMON: CVE-2019-8565 // 
            
            
            
            JVNDB: JVNDB-2019-001923 // 
            
            
            
            CNNVD: CNNVD-201903-1022 // 
            
            
            
            NVD: CVE-2019-8565

REFERENCES
url:https://support.apple.com/ht209599
Trust: 1.8
url:https://support.apple.com/ht209600
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8565
Trust: 1.4
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6232
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8520
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8561
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6236
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8522
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8562
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6239
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8526
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8563
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8556
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8507
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8533
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8565
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8555
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8508
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8537
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8567
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8553
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8510
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8554
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8513
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8558
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-6207
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8519
Trust: 0.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-8559
Trust: 0.8
url:https://jvn.jp/vu/jvnvu93236010/
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8553
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8513
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8558
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-6207
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8519
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8559
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-6232
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8520
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8561
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-6236
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8522
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8562
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8563
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-6239
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8526
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8507
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8533
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8567
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8556
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8508
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8537
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8555
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8510
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2019-8554
Trust: 0.8
url:https://support.apple.com/en-au/ht209599
Trust: 0.6
url:https://support.apple.com/en-us/ht209600
Trust: 0.6
url:https://vigilance.fr/vulnerability/apple-ios-multiple-vulnerabilities-28854
Trust: 0.6
url:https://www.auscert.org.au/bulletins/77810
Trust: 0.6
url:https://packetstormsecurity.com/files/152996/mac-os-x-feedback-assistant-race-condition.html
Trust: 0.6
url:https://cwe.mitre.org/data/definitions/362.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.exploit-db.com/exploits/46914
Trust: 0.1
url:https://github.com/chichou/sploits
Trust: 0.1
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/158652
Trust: 0.1
sources:
            
            
            VULHUB: VHN-160000 // 
            
            
            
            VULMON: CVE-2019-8565 // 
            
            
            
            JVNDB: JVNDB-2019-001923 // 
            
            
            
            CNNVD: CNNVD-201903-1022 // 
            
            
            
            NVD: CVE-2019-8565

CREDITS
timwr
Trust: 0.6
sources:
            
            
            CNNVD: CNNVD-201903-1022

SOURCES
db:VULHUBid:VHN-160000
db:VULMONid:CVE-2019-8565
db:JVNDBid:JVNDB-2019-001923
db:CNNVDid:CNNVD-201903-1022
db:NVDid:CVE-2019-8565

LAST UPDATE DATE
2024-08-14T12:21:35.950000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-160000date:2019-12-20T00:00:00
db:VULMONid:CVE-2019-8565date:2019-12-20T00:00:00
db:JVNDBid:JVNDB-2019-001923date:2020-01-06T00:00:00
db:CNNVDid:CNNVD-201903-1022date:2021-10-29T00:00:00
db:NVDid:CVE-2019-8565date:2019-12-20T17:18:57.233

SOURCES RELEASE DATE
db:VULHUBid:VHN-160000date:2019-12-18T00:00:00
db:VULMONid:CVE-2019-8565date:2019-12-18T00:00:00
db:JVNDBid:JVNDB-2019-001923date:2019-03-29T00:00:00
db:CNNVDid:CNNVD-201903-1022date:2019-03-26T00:00:00
db:NVDid:CVE-2019-8565date:2019-12-18T18:15:26.553