An out-of-bounds read was addressed with improved input validation.

The version of Apple iOS running on the mobile device is prior to 13.0. It is, therefore, affected by multiple vulnerabilities.

  - A remote attacker may be able to cause unexpected application termination or arbitrary code execution in     iOS Foundation. (CVE-2019-8641)

  - A cross-site scripting (XSS) vulnerability exists due to improper validation of user-supplied input before     returning it to users. Processing maliciously crafted web content during WebKit page loading may lead to     universal cross site scripting. (CVE-2019-8674)

  - An information disclosure vulnerability exists in iOS Keyboards. An authenticated, local attacker can exploit     this, to disclose potentially sensitive information. (CVE-2019-8704)

  - An out-of-bounds read error exists in CoreAudio. An authenticated, local attacker can exploit this, via     processing a maliciously crafted movie may result in the disclosure of process memory. (CVE-2019-8705)

  - A logic issue existed in with display notifications of iOS Bluetooth. Notification previews may show on     bluetooth accessories even when previews are disabled. (CVE-2019-8711)

  - A logic issue was addressed in iOS Safari. An authenticated, local attacker can exploit this, by Visiting     a malicious website may lead to address bar spoofing. (CVE-2019-8727)

  - An information disclosure vulnerability exists in iOS Quick look. A permission issue existed in which execute     permission was incorrectly granted. Processing malicious crafted file may disclose sensitive users     information. (CVE-2019-8731)

  - An information disclosure vulnerability exists in iOS Messages. A person with physical access to an iOS device     may be able to access contacts from the lock screen. (CVE-2019-8742)

  - A machine learning logic bug exists in iOS FaceID. A 3D model constructed to look like the enrolled user may     authenticate via Face ID. (CVE-2019-8760)

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6 Supplemental Update 2, 10.13.x prior to 10.13.6 Security Update 2019-005, or 10.12.x prior to 10.12.6 Security Update 2019-005. It is, therefore, affected by an out-of-bounds read vulnerability. An attacker could exploit this vulnerability to cause an application crash, or potentially achieve arbitrary code execution.

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of Apple iOS running on the mobile device is prior to 12.4.2. It is, therefore, affected by an out-of-bounds read vulnerability.
An attacker can exploit this to cause an application crash, or potentially achieve arbitrary code execution.

The remote host is running Mac OS X 10.12.6 or Mac OS X 10.13.6 and is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An application may be able to read restricted memory     (CVE-2019-8691, CVE-2019-8692, CVE-2019-8693)

  - Extracting a zip file containing a symbolic link to an     endpoint in an NFS mount that is attacker controlled may     bypass Gatekeeper (CVE-2019-8656)

  - A remote attacker may be able to cause arbitrary code     execution (CVE-2019-8648, CVE-2018-19860, CVE-2019-8661)

  - A remote attacker may be able to leak memory     (CVE-2019-8646, CVE-2019-8663)

  - A remote attacker may be able to cause unexpected     application termination or arbitrary code execution     ( CVE-2019-8641, CVE-2019-8660)

  - An application may be able to execute arbitrary code     with system privileges (CVE-2019-8695, CVE-2019-8697)

  - An issue existed in Samba that may allow attackers to     perform unauthorized actions by intercepting     communications between services (CVE-2018-16860)

  - An application may be able to execute arbitrary code     with kernel privileges (CVE-2019-8694)

  - A remote attacker may be able to view sensitive     information (CVE-2019-13118)

  - An attacker may be able to trigger a use-after-free in     an application deserializing an untrusted NSDictionary     (CVE-2019-8662)

  - Visiting a malicious website may lead to address bar     spoofing (CVE-2019-8670)

  - The encryption status of a Time Machine backup may be     incorrect (CVE-2019-8667)

  - Parsing a maliciously crafted office document may lead     to an unexpected application termination or arbitrary     code execution (CVE-2019-8657)

  - Processing maliciously crafted web content may lead to     universal cross site scripting (CVE-2019-8649,     CVE-2019-8658, CVE-2019-8690)

  - Processing maliciously crafted web content may lead to     arbitrary code execution (CVE-2019-8644, CVE-2019-8666,     CVE-2019-8669, CVE-2019-8671, CVE-2019-8672,     CVE-2019-8673, CVE-2019-8676, CVE-2019-8677,     CVE-2019-8678, CVE-2019-8679, CVE-2019-8680,     CVE-2019-8681, CVE-2019-8683, CVE-2019-8684,     CVE-2019-8685, CVE-2019-8686, CVE-2019-8687,     CVE-2019-8688, CVE-2019-8689)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.6. It is, therefore, affected by multiple vulnerabilities :

  - An application may be able to read restricted memory     (CVE-2019-8691, CVE-2019-8692, CVE-2019-8693)

  - Extracting a zip file containing a symbolic link to an     endpoint in an NFS mount that is attacker controlled may     bypass Gatekeeper (CVE-2019-8656)

  - A remote attacker may be able to cause arbitrary code     execution (CVE-2019-8648, CVE-2018-19860, CVE-2019-8661)

  - A remote attacker may be able to leak memory     (CVE-2019-8646, CVE-2019-8663)

  - A remote attacker may be able to cause unexpected     application termination or arbitrary code execution     (CVE-2019-8641, CVE-2019-8660)

  - An application may be able to execute arbitrary code     with system privileges (CVE-2019-8695, CVE-2019-8697)

  - An issue existed in Samba that may allow attackers to     perform unauthorized actions by intercepting     communications between services (CVE-2018-16860)

  - An application may be able to execute arbitrary code     with kernel privileges (CVE-2019-8694)

  - A remote attacker may be able to view sensitive     information (CVE-2019-13118)

  - An attacker may be able to trigger a use-after-free in     an application deserializing an untrusted NSDictionary     (CVE-2019-8662)

  - Visiting a malicious website may lead to address bar     spoofing (CVE-2019-8670)

  - The encryption status of a Time Machine backup may be     incorrect (CVE-2019-8667)

  - Parsing a maliciously crafted office document may lead     to an unexpected application termination or arbitrary     code execution (CVE-2019-8657)

  - Processing maliciously crafted web content may lead to     universal cross site scripting (CVE-2019-8690,     CVE-2019-8649, CVE-2019-8658)

  - Processing maliciously crafted web content may lead to     arbitrary code execution (CVE-2019-8644, CVE-2019-8666,     CVE-2019-8669, CVE-2019-8671, CVE-2019-8672,     CVE-2019-8673, CVE-2019-8676, CVE-2019-8677,     CVE-2019-8678, CVE-2019-8679, CVE-2019-8680,     CVE-2019-8681, CVE-2019-8683, CVE-2019-8684,     CVE-2019-8685, CVE-2019-8686, CVE-2019-8687,     CVE-2019-8688, CVE-2019-8689)

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

According to its banner, the version of Apple TV on the remote device is prior to 12.4. It is therefore affected by multiple vulnerabilities as described in HT210351.

The version of Apple iOS running on the mobile device is prior to 12.4. It is, therefore, affected by multiple vulnerabilities.

ID	Name	Product	Family	Severity
129587	Apple iOS < 13.0 Multiple Vulnerabilities	Nessus	Mobile Devices	critical
129467	macOS 10.14.x < 10.14.6 SU2 / 10.13.x < 10.13.6 Update 2019-005 / 10.12.x < 10.12.6 Update 2019-005 Out-of-Bounds Read Vulnerability	Nessus	MacOS X Local Security Checks	critical
129391	Apple iOS < 12.4.2 Vulnerability	Nessus	Mobile Devices	critical
127055	macOS Sierra / High Sierra Multiple Vulnerabilities (Security Update 2019-004)	Nessus	MacOS X Local Security Checks	critical
127054	macOS 10.14.x < 10.14.6 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
127048	Apple TV < 12.4 Multiple Vulnerabilities	Nessus	Misc.	critical
126951	Apple iOS < 12.4 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2019-8641

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical