PT-2019-19194 · Apple+1 · Icloud For Windows+7

Published 2019-12-18 · Updated 2021-07-21 · CVE-2019-8756

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions libxml2 versions prior to the version included in macOS Catalina 10.15 macOS versions prior to 10.15 iOS versions prior to 13 iCloud for Windows versions prior to 7.14 and 10.7 tvOS versions prior to 13 watchOS versions prior to 6 iTunes for Windows versions prior to 12.10.1

Description The issue arises from multiple memory corruption problems that have been addressed through improved input validation. Attackers can exploit vulnerabilities in libxml2 related to input validation to cause memory corruption.

Recommendations For libxml2, update to a version included in the latest macOS, iOS, or other affected products. For macOS, update to version 10.15 or later. For iOS, update to version 13 or later. For iCloud for Windows, update to version 7.14 or 10.7 or later. For tvOS, update to version 13 or later. For watchOS, update to version 6 or later. For iTunes for Windows, update to version 12.10.1 or later.

Fix

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-8756

Affected Products

Icloud For Windows

Ios

Itunes

Itunes For Windows

Libxml2

Apple Macos

Tvos

Watchos

References · 10

• https://osv.dev/vulnerability/CVE-2019-8756 · Vendor Advisory
• https://support.apple.com/en-us/HT210606 · Vendor Advisory
• https://support.apple.com/en-us/HT210636 · Vendor Advisory
• https://support.apple.com/en-us/HT210634 · Vendor Advisory
• https://support.apple.com/en-us/HT210635 · Vendor Advisory
• https://support.apple.com/en-us/HT210604 · Vendor Advisory
• https://support.apple.com/en-us/HT210607 · Vendor Advisory
• https://support.apple.com/en-us/HT210637 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8756 · Security Note
• https://support.apple.com/en-us/HT210722 · Vendor Advisory