An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.

The version of Apple iOS running on the mobile device is prior to 12.2. It is, therefore, affected by multiple vulnerabilities:

 - An unspecified memory corruption issue could allow an attacker to execute code with kernel privileges. (CVE-2019-8529)

 - An unspecified buffer overflow issues was addressed that could address an attacker to cause unexpected system termination or corrupt kernel memory. (CVE-2019-8527)

 - An unspecified memory corruption issue in an SMS Link could allow an attacker arbitrary execute code. (CVE-2019-8553)

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.4. It is, therefore, affected by multiple vulnerabilities, including:

 - Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges. (CVE-2019-8508)

 - An application may be able to execute arbitrary code with kernel privileges. (CVE-2019-8529)

 - A malicious application may be able to execute arbitrary code with system privileges (CVE-2019-8549)

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.4. It is, therefore, affected by multiple vulnerabilities, including:

  - Mounting a maliciously crafted NFS network share may lead to     arbitrary code execution with system privileges. (CVE-2019-8508)

  - An application may be able to execute arbitrary code with kernel     privileges. (CVE-2019-8529)

  - A malicious application may be able to execute arbitrary code     with system privileges (CVE-2019-8549)

The version of Apple iOS running on the mobile device is prior to 12.2. It is, therefore, affected by multiple vulnerabilities:

  - An unspecified memory corruption issue could allow an     attacker to execute code with kernel privileges.
    (CVE-2019-8529)

  - An unspecified buffer overflow issues was addressed     that could address an attacker to cause unexpected     system termination or corrupt kernel memory.
    (CVE-2019-8527)

  - An unspecified memory corruption issue in an SMS Link     could allow an attacker arbitrary execute code.     (CVE-2019-8553)

ID	Name	Product	Family	Type	Severity
700558	Apple iOS < 12.2 Multiple Vulnerabilities (APPLE-SA-2019-3-25-1)	Nessus Network Monitor	Mobile Devices		high
700522	macOS 10.14.x < 10.14.4 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection		critical
123128	macOS 10.14.x < 10.14.4 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Combined	critical
123080	Apple iOS < 12.2 Multiple Vulnerabilities	Nessus	Mobile Devices	Local	critical

Detections

Analytics

CVE-2019-8502

low

Tenable Plugins

high

critical

critical

critical