Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-6224 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Macos

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents5 sources

Severity

8.8HIGHNVD

EPSS

28.3%

top 3.49%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Apple IOS Apple Macos Apple Tvos +4 more

Timeline

PublishedMar 5

Latest updateMay 14

Description

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A remote attacker may be able to initiate a FaceTime call causing arbitrary code execution.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

▶CVEListV5apple/tvosunspecified — tvOS 12.1.2

▶CVEListV5apple/macosunspecified — macOS Mojave 10.14.3

▶NVDapple/tv_os< 12.1.2

▶CVEListV5apple/watchosunspecified — watchOS 5.1.3

▶NVDapple/watchos< 5.1.3

🔴Vulnerability Details

GHSA

GHSA-ccfh-xjj4-c59j: A buffer overflow issue was addressed with improved memory handling↗2022-05-14

▶

CVEList

CVE-2019-6224: A buffer overflow issue was addressed with improved memory handling↗2019-03-05

▶

💥Exploits & PoCs

Exploit-DB

FaceTime - Texture Processing Memory Corruption↗2019-02-20

▶

📋Vendor Advisories

Apple

CVE-2019-6224: macOS Mojave 10.14.3, Security Update 2019-001 High Sierra, Security Update 2019-001 Sierra↗2019-01-22

▶

Apple

CVE-2019-6224: tvOS 12.1.2↗2019-01-22

▶

Apple

CVE-2019-6224: watchOS 5.1.3↗2019-01-22

▶

Apple

CVE-2019-6224: iOS 12.1.3↗2019-01-22

▶