CVE-2019-8856 — Missing Authorization in Apple IOS AND Ipados

CWE-862 — Missing Authorization5 documents3 sources
Severity
3.3LOWNVD
EPSS
0.2%
top 56.57%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Apple IOS AND IpadosApple MacosApple Ipados+5 more
Timeline
PublishedOct 27
Latest updateMay 24

Description

An API issue existed in the handling of outgoing phone calls initiated with Siri. This issue was addressed with improved state handling. This issue is fixed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. Calls made using Siri may be initiated using the wrong cellular plan on devices with two active plans.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages9 packages

▶CVEListV5apple/macosunspecified — 10.15+1
▶NVDapple/ipados< 13.3
▶NVDapple/watchos< 6.1.1
▶NVDapple/mac_os_x< 10.15.2

🔴Vulnerability Details

1
GHSA
GHSA-mr2g-m2pj-f4jh: An API issue existed in the handling of outgoing phone calls initiated with Siri↗2022-05-24
▶

📋Vendor Advisories

3
Apple
CVE-2019-8856: watchOS 6.1.1↗2019-12-10
▶
Apple
CVE-2019-8856: macOS Catalina 10.15.2, Security Update 2019-002 Mojave, Security Update 2019-007 High Sierra↗2019-12-10
▶
Apple
CVE-2019-8856: iOS 13.3 and iPadOS 13.3↗2019-12-10
▶