CVE-2019-8600
published 2019-12-18CVE-2019-8600: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes…
PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
19.96%
97.1th percentile
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | icloud | < 7.12 | 7.12 |
| apple | icloud | 10.0 – 10.4 | — |
| apple | icloud_for_windows | — | — |
| apple | icloud_for_windows | — | — |
| apple | icloud_for_windows | >= unspecified < iCloud for Windows 7.12 | iCloud for Windows 7.12 |
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.3 | iOS 12.3 |
| apple | iphone_os | < 12.3 | 12.3 |
| apple | itunes | < 12.9.5 | 12.9.5 |
| apple | itunes_for_windows | — | — |
| apple | itunes_for_windows | >= unspecified < iTunes for Windows 12.9.5 | iTunes for Windows 12.9.5 |
| apple | mac_os_x | < 10.14.5 | 10.14.5 |
| apple | macos | >= unspecified < macOS Mojave 10.14.5 | macOS Mojave 10.14.5 |
| apple | macos_mojave_10.14.5_security_update_2019-003_high_sierra_security_update_2019-0 | — | — |
| apple | tvos | < 12.3 | 12.3 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 12.3 | tvOS 12.3 |
| apple | watchos | < 5.2.1 | 5.2.1 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 5.2.1 | watchOS 5.2.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger vector is a maliciously crafted SQL query delivered to the SQLite component; monitor for anomalous or oversized SQL input passed to SQLite on affected Apple platforms ↗
- →Focus detection on the SQLite component specifically within iOS, macOS, tvOS, watchOS, iTunes for Windows, and iCloud for Windows; memory corruption triggered via input validation failure in SQLite query parsing ↗
- ·Vulnerability is fixed in specific versions; systems running older versions of the listed products remain exposed. Patch baseline: iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12 (and 10.4). ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-8600: iCloud for Windows 10.4
vendor_apple·2019-06-11·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: iCloud for Windows 10.4
Apple Security Update: About the security content of iCloud for Windows 10.4
Product: iCloud for Windows
Version: 10.4
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: iCloud for Windows 7.12
vendor_apple·2019-05-28·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: iCloud for Windows 7.12
Apple Security Update: About the security content of iCloud for Windows 7.12
Product: iCloud for Windows
Version: 7.12
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: iTunes for Windows 12.9.5
vendor_apple·2019-05-28·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: iTunes for Windows 12.9.5
Apple Security Update: About the security content of iTunes for Windows 12.9.5
Product: iTunes for Windows
Version: 12.9.5
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: iOS 12.3
vendor_apple·2019-05-13·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: iOS 12.3
Apple Security Update: About the security content of iOS 12.3
Product: iOS
Version: 12.3
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra
vendor_apple·2019-05-13·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra
Product: macOS Mojave 10.14.5, Security Update 2019-003 High Sierra, Security Update 2019-003 Sierra
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: tvOS 12.3
vendor_apple·2019-05-13·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: tvOS 12.3
Apple Security Update: About the security content of tvOS 12.3
Product: tvOS
Version: 12.3
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8600: watchOS 5.2.1
vendor_apple·2019-05-13·CVSS 9.8
CVE-2019-8600 [CRITICAL] CVE-2019-8600: watchOS 5.2.1
Apple Security Update: About the security content of watchOS 5.2.1
Product: watchOS
Version: 5.2.1
CVE: CVE-2019-8600
Component: SQLite
Impact: A maliciously crafted SQL query may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
GHSA
GHSA-gx82-h946-724f: A memory corruption issue was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2019-8600 [HIGH] GHSA-gx82-h946-724f: A memory corruption issue was addressed with improved input validation
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.
No detection rules found.
No public exploits indexed.
https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/https://support.apple.com/HT210118https://support.apple.com/HT210119https://support.apple.com/HT210120https://support.apple.com/HT210122https://support.apple.com/HT210124https://support.apple.com/HT210125https://support.apple.com/HT210212https://research.checkpoint.com/2019/select-code_execution-from-using-sqlite/https://support.apple.com/HT210118https://support.apple.com/HT210119https://support.apple.com/HT210120https://support.apple.com/HT210122https://support.apple.com/HT210124https://support.apple.com/HT210125https://support.apple.com/HT210212
2019-12-18
Published