CVE-2019-8660
published 2019-12-18CVE-2019-8660: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote…
PriorityP269critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EXPLOIT
EPSS
13.81%
96.1th percentile
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apple | ios | — | — |
| apple | ios | >= unspecified < iOS 12.4 | iOS 12.4 |
| apple | iphone_os | < 12.4 | 12.4 |
| apple | mac_os_x | < 10.14.6 | 10.14.6 |
| apple | macos | >= unspecified < macOS Mojave 10.14.6 | macOS Mojave 10.14.6 |
| apple | macos_mojave_10.14.6_security_update_2019-004_high_sierra_security_update_2019-0 | — | — |
| apple | tvos | < 12.4 | 12.4 |
| apple | tvos | — | — |
| apple | tvos | >= unspecified < tvOS 12.4 | tvOS 12.4 |
| apple | watchos | < 5.3 | 5.3 |
| apple | watchos | — | — |
| apple | watchos | >= unspecified < watchOS 5.3 | watchOS 5.3 |
Detection & IOCsextracted from sources · hover to see the quote
- →Look for iMessage-delivered payloads triggering NSKnownKeysDictionary1 deserialization — the exploit is delivered remotely via iMessage using a crafted serialized object file (.obj) injected via a Python script (sendMessage.py / injectMessage.js) ↗
- →Monitor for memory corruption in Core Data component (NSKnownKeysDictionary1 / NSKnownKeysMappingStrategy1 decoding path) — specifically an integer overflow in buffer allocation where a decoded length member is multiplied by 8 without overflow check, followed by out-of-bounds copy loop ↗
- →Frida-based injection (frida tooling) used as part of exploit delivery — presence of frida on a device combined with iMessage activity targeting NSKeyedArchiver/Core Data classes may indicate exploitation attempt ↗
- ·Exploitation is assessed as difficult due to uncontrolled nature of the out-of-bounds copies; arbitrary code execution may not be reliably achievable ↗
- ·The vulnerability is only exploitable when the decoded values array is null; if non-null, getObjects:range throws an exception instead of proceeding to the dangerous copy loop ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Apple
CVE-2019-8660: watchOS 5.3
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8660 [CRITICAL] CVE-2019-8660: watchOS 5.3
Apple Security Update: About the security content of watchOS 5.3
Product: watchOS
Version: 5.3
CVE: CVE-2019-8660
Component: Core Data
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8660: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8660 [CRITICAL] CVE-2019-8660: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Apple Security Update: About the security content of macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
Product: macOS Mojave 10.14.6, Security Update 2019-004 High Sierra, Security Update 2019-004 Sierra
CVE: CVE-2019-8660
Component: Core Data
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8660: iOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8660 [CRITICAL] CVE-2019-8660: iOS 12.4
Apple Security Update: About the security content of iOS 12.4
Product: iOS
Version: 12.4
CVE: CVE-2019-8660
Component: Core Data
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
Apple
CVE-2019-8660: tvOS 12.4
vendor_apple·2019-07-22·CVSS 9.8
CVE-2019-8660 [CRITICAL] CVE-2019-8660: tvOS 12.4
Apple Security Update: About the security content of tvOS 12.4
Product: tvOS
Version: 12.4
CVE: CVE-2019-8660
Component: Core Data
Impact: A remote attacker may be able to cause unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
GHSA
GHSA-5wp3-f7pj-2997: A memory corruption issue was addressed with improved input validation
ghsa_unreviewed·2022-05-24
CVE-2019-8660 [HIGH] GHSA-5wp3-f7pj-2997: A memory corruption issue was addressed with improved input validation
A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3. A remote attacker may be able to cause unexpected application termination or arbitrary code execution.
Project0
The Fully Remote Attack Surface of the iPhone - Project Zero
project_zero·2019-08-01
CVE-2019-8613 The Fully Remote Attack Surface of the iPhone - Project Zero
Posted by Natalie Silvanovich, Project Zero
While there have been several rumours and reports of fully remote vulnerabilities affecting the iPhone being used by attackers in the last couple of years, limited information is available about the technical details of these vulnerabilities, as well as the underlying attack surface they occur in. I investigated the remote, interaction-less attack surface of the iPhone, and found several serious vulnerabilities.
Vulnerabilities are considered ‘remote’ when the attacker does not require any physical or network proximity to the target to be able to use the vulnerability. Remote vulnerabilities are described as ‘fully remote’, ‘interaction-less’ or ‘zero click’ when they do not require any physical interaction from the target to be exploited, an
No detection rules found.
No writeups or analysis indexed.
2019-12-18
Published