5.5med
CVE-2019-8744
A memory corruption issue existed in the handling of IPv6 packets.
Published 6 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 60%
Public exploits
0
none known
Summary
A memory corruption issue existed in the handling of IPv6 packets. This issue was addressed with improved memory management. This issue is fixed in macOS Catalina 10.15, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6, iOS 13. A malicious application may be able to determine kernel memory layout.
Exploit prediction (EPSS)
0.90% probability of exploitation in the next 30 days, higher than 60% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Apple tvOS
- Apple iOS
- Apple watchOS
- Apple macOS
Classification
- Weakness
- CWE-787 Out-of-bounds Write
References
- support.apple.com /en-us/HT210634 · x_refsource_MISC, x_transferred
- support.apple.com /en-us/HT210722 · x_refsource_MISC, x_transferred
- support.apple.com /en-us/HT210604 · x_refsource_MISC, x_transferred
- support.apple.com /en-us/HT210606 · x_refsource_MISC, x_transferred
- support.apple.com /en-us/HT210607 · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2019-8744
- NVD: CVE-2019-8744
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.