Search for vulnerabilities
Vulnerability details: VCID-pudm-eh99-aaad
Vulnerability ID VCID-pudm-eh99-aaad
Aliases CVE-2019-8506
Summary A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Status Published
Exploitability 2.0
Weighted Severity 8.4
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CWE-94 Improper Control of Generation of Code ('Code Injection')
System Score Found at
generic_textual Medium http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-8506.html
rhas Moderate https://access.redhat.com/errata/RHSA-2020:4035
cvssv3 6.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.05170 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.06332 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.06332 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.06332 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.16254 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.17978 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.18638 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.20351 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.23371 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.28559 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.37089 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.37089 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
epss 0.37089 https://api.first.org/data/v1/epss?cve=CVE-2019-8506
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1719199
generic_textual Medium https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8506
cvssv2 9.3 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
cvssv3.1 8.8 https://support.apple.com/HT209599
cvssv3.1 8.8 https://support.apple.com/HT209599
ssvc Attend https://support.apple.com/HT209599
ssvc Attend https://support.apple.com/HT209599
cvssv3.1 8.8 https://support.apple.com/HT209601
cvssv3.1 8.8 https://support.apple.com/HT209601
ssvc Attend https://support.apple.com/HT209601
ssvc Attend https://support.apple.com/HT209601
cvssv3.1 8.8 https://support.apple.com/HT209602
cvssv3.1 8.8 https://support.apple.com/HT209602
ssvc Attend https://support.apple.com/HT209602
ssvc Attend https://support.apple.com/HT209602
cvssv3.1 8.8 https://support.apple.com/HT209603
cvssv3.1 8.8 https://support.apple.com/HT209603
ssvc Attend https://support.apple.com/HT209603
ssvc Attend https://support.apple.com/HT209603
cvssv3.1 8.8 https://support.apple.com/HT209604
cvssv3.1 8.8 https://support.apple.com/HT209604
ssvc Attend https://support.apple.com/HT209604
ssvc Attend https://support.apple.com/HT209604
cvssv3.1 8.8 https://support.apple.com/HT209605
cvssv3.1 8.8 https://support.apple.com/HT209605
ssvc Attend https://support.apple.com/HT209605
ssvc Attend https://support.apple.com/HT209605
generic_textual Medium https://ubuntu.com/security/notices/USN-3948-1
generic_textual Medium https://usn.ubuntu.com/usn/usn-3948-1
generic_textual Medium https://webkitgtk.org/security/WSA-2019-0002.html
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-8506.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
https://api.first.org/data/v1/epss?cve=CVE-2019-8506
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8506
https://support.apple.com/HT209599
https://support.apple.com/HT209601
https://support.apple.com/HT209602
https://support.apple.com/HT209603
https://support.apple.com/HT209604
https://support.apple.com/HT209605
https://ubuntu.com/security/notices/USN-3948-1
https://usn.ubuntu.com/usn/usn-3948-1
https://webkitgtk.org/security/WSA-2019-0002.html
1719199 https://bugzilla.redhat.com/show_bug.cgi?id=1719199
cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*
cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*
cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:apple:safari:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:tvos:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*
CVE-2019-8506 Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
CVE-2019-8506 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/dos/46647.js
CVE-2019-8506 https://nvd.nist.gov/vuln/detail/CVE-2019-8506
RHSA-2020:4035 https://access.redhat.com/errata/RHSA-2020:4035
Data source Exploit-DB
Date added April 3, 2019
Description WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion
Ransomware campaign use Known
Source publication date April 3, 2019
Exploit type dos
Platform multiple
Source update date April 3, 2019
Source URL https://bugs.chromium.org/p/project-zero/issues/detail?id=1753
Data source KEV
Date added May 4, 2022
Description A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.
Required action Apply updates per vendor instructions.
Due date May 25, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Ransomware campaign use Unknown
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-8506.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2019-8506
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209599
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209599
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209599
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209601
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209601
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209601
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209601
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209602
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209602
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209602
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209603
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209603
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209603
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209603
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209604
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209604
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209604
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209604
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209605
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://support.apple.com/HT209605
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209605
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T17:41:25Z/ Found at https://support.apple.com/HT209605
Exploit Prediction Scoring System (EPSS)
Percentile 0.93196
EPSS Score 0.05170
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.