CVE-2019-8812

HIGH

iTunes < 12.10.2 - Memory Corruption and Arbitrary Code Execution

Title source: llm
STIX 2.1

Description

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2. Processing maliciously crafted web content may lead to arbitrary code execution.

References (6)

Core 6
Core References
Vendor Advisory x_refsource_misc
https://support.apple.com/HT210724
Vendor Advisory x_refsource_misc
https://support.apple.com/HT210721
Vendor Advisory x_refsource_misc
https://support.apple.com/HT210726
Vendor Advisory x_refsource_misc
https://support.apple.com/HT210723
Vendor Advisory x_refsource_misc
https://support.apple.com/HT210725
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/202003-22

Scores

CVSS v3 8.8
EPSS 0.0189
EPSS Percentile 77.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-787
Status published
Products (6)
apple/ipados < 13.2
apple/iphone_os < 13.2
apple/itunes < 12.10.2
apple/safari < 13.0.3
apple/tvos < 13.2
apple/watchos < 6.1
Published Dec 18, 2019
Tracked Since Feb 18, 2026