PT-2019-2624 · Apple+2 · Itunes For Windows+8

Linus Särud · Published 2019-03-25 · Updated 2019-12-31 · CVE-2019-8503

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions iOS versions prior to 12.2 tvOS versions prior to 12.2 Safari versions prior to 12.1 iTunes for Windows versions prior to 12.9.4 iCloud for Windows versions prior to 7.11 WebKitGTK (affected versions not specified) WPE WebKit (affected versions not specified)

Description A logic issue was addressed with improved validation, which may allow a malicious website to execute scripts in the context of another website. The issue is related to insecure privilege management in WebKitGTK and WPE WebKit modules, which can be exploited by a remote attacker using a specially crafted web page to execute arbitrary code.

Recommendations For iOS versions prior to 12.2, update to iOS 12.2 or later. For tvOS versions prior to 12.2, update to tvOS 12.2 or later. For Safari versions prior to 12.1, update to Safari 12.1 or later. For iTunes for Windows versions prior to 12.9.4, update to iTunes 12.9.4 or later. For iCloud for Windows versions prior to 7.11, update to iCloud for Windows 7.11 or later. For WebKitGTK and WPE WebKit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Improper Privilege Management

Weakness Enumeration

CWE-20

CWE-269

Related Identifiers

BDU:2019-02506

CVE-2019-8503

OPENSUSE-SU-2019:1374-1

OPENSUSE-SU-2019_1374-1

OPENSUSE-SU-2019_1391-1

SUSE-SU-2019:1137-1

SUSE-SU-2019:1155-1

Affected Products

Safari

Suse

Wpe Webkit

Webkitgtk

Icloud For Windows

Ios

Itunes

Itunes For Windows

Tvos

References · 46

• https://cve.org/CVERecord?id=CVE-2019-8503 · Security Note
• https://support.apple.com/HT209603 · Vendor Advisory
• https://support.apple.com/HT209601 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8503 · Security Note
• https://bdu.fstec.ru/vul/2019-02506 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:1155-1 · Vendor Advisory
• https://support.apple.com/HT209605 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2019:1374-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-8503 · Vendor Advisory
• https://support.apple.com/HT209599 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:1137-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8503 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-8503 · Vendor Advisory
• https://support.apple.com/HT209604 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-8503 · Vendor Advisory