A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3. A malicious application may be able to break out of its sandbox.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Multiple unspecified vulnerabilities in WebKit can lead to arbitrary code execution if a user is enticed to visit a malicious web page. (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

 - A maliciously crafted SQL query could lead to arbitrary code execution. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506)

 - A malicious application could lead to arbitrary code execution with kernel privileges. (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

 - AppleKeyStore
 - Bluetooth
 - Core Media
 - CoreAnimation
 - FaceTime
 - IOKit
 - Kernel
 - libxpc
 - Natural Language Processing
 - QuartzCore
 - SQLite
 - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

  - AppleKeyStore
  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - IOKit
  - Kernel
  - libxpc
  - Natural Language Processing
  - QuartzCore
  - SQLite
  - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components:

  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - Hypervisor
  - Intel Graphics Driver
  - IOKit
  - Kernel
  - libxpc
  - QuartzCore

The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components:

  - CoreAnimation
  - Hypervisor
  - Intel Graphics Driver
  - IOKit
  - Kernel
  - libxpc
  - QuartzCore

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

  - Multiple unspecified vulnerabilities in WebKit     can lead to arbitrary code execution if a user     is enticed to visit a malicious web page.
    (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A maliciously crafted SQL query could lead to     arbitrary code execution.
    (CVE-2018-20346, CVE-2018-20505,     CVE-2018-20506)

  - A malicious application could lead to arbitrary     code execution with kernel privileges.
    (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

ID	Name	Product	Family	Type	Severity
700556	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	Nessus Network Monitor	Mobile Devices		medium
700521	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		critical
121393	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
121392	macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)	Nessus	MacOS X Local Security Checks	Local	high
121391	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)	Nessus	MacOS X Local Security Checks	Local	high
121331	Apple iOS < 12.1.3 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2019-6214

high

Tenable Plugins

medium

critical

critical

high

high

critical