A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

 - A logic issue in the handling of Group FaceTime calls could allow the initiator to cause the recipient to answer. (CVE-2019-6223)

 - An unspecified memory corruption issue in Foundation could lead to an application gaining elevated privileges. (CVE-2019-7286)

 - An unspecified memory corruption issue in IOKit could lead to an application executing arbitrary code with kernel privileges.
 (CVE-2019-7287)

 - An unspecified issue with Live Photos in FaceTime.
 (CVE-2019-7288)

The remote host is running a version of macOS 10.14.3 that is missing the macOS 10.14.3 Supplemental Update.  This update fixes the following vulnerabilities :

  - An unspecified flaw exists related to handling Group     FaceTime calls that allows an attacker to cause a call     recipient to unintentionally answer. (CVE-2019-6223)

  - An input-validation flaw exists related to the     Foundation component that allows memory corruption and     privilege escalation. (CVE-2019-7286)

  - An unspecified flaw exists related to Live Photos in     FaceTime having unspecified impact. (CVE-2019-7288)

The version of Apple iOS running on the mobile device is prior to 12.1.4. It is, therefore, affected by multiple vulnerabilities:

  - A logic issue in the handling of Group FaceTime calls could allow     the initiator to cause the recipient to answer. (CVE-2019-6223)

  - An unspecified memory corruption issue in Foundation could lead     to an application gaining elevated privileges. (CVE-2019-7286)

  - An unspecified memory corruption issue in IOKit could lead to an     application executing arbitrary code with kernel privileges.
    (CVE-2019-7287)

  - An unspecified issue with Live Photos in FaceTime.
    (CVE-2019-7288)

ID	Name	Product	Family	Severity
700557	Apple iOS < 12.1.4 Multiple Vulnerabilities (APPLE-SA-2019-2-07-1)	Nessus Network Monitor	Mobile Devices	high
122508	macOS 10.14.3 Supplemental Update	Nessus	MacOS X Local Security Checks	critical
121645	Apple iOS < 12.1.4 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2019-7286

high

Tenable Plugins

high

critical

critical