deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2019-10607
Published: 2019-12-18
Description: Out of bounds memcpy can occur by providing the embedded NULL character string and length greater than the actual string length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9615, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8996, MSM8996AU, QCA4531, QCA8081, QCA9531, QCA9558, QCA9886, QCA9980, QCN7605, QCS605, SDA660, SDX20, SDX24, SDX55, SM8150, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CVE: CVE-2019-10614
Published: 2019-12-18
Description: Out of boundary access is possible as there is no validation of data accessed against the received size of the packet in case of malicious firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SA6155P, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CVE: CVE-2019-19880
Published: 2019-12-18
Description: exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.
CVSS Score: 7.5 (HIGH)
CWE: CWE-476
References: http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00010.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00015.html; http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00025.html
CVE: CVE-2019-2242
Published: 2019-12-18
Description: Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8016, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SM6150, SM7150, SXR1130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CVE: CVE-2019-2274
Published: 2019-12-18
Description: Improper Access Control for RPU write access from secure processor in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8098, IPQ8074, MDM9150, MDM9650, MDM9655, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCA8081, QCN7605, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX55, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CVE: CVE-2019-2304
Published: 2019-12-18
Description: Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, QCN7605, QCS405, QCS605, SDA845, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-190, CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin
CVE: CVE-2019-19742
Published: 2019-12-18
Description: On D-Link DIR-615 devices, the User Account Configuration page is vulnerable to blind XSS via the name field.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://infosecsanyam.blogspot.com/2019/12/d-link-dir-615-wireless-router.html; https://medium.com/%40infosecsanyam/d-link-dir-615-wireless-router-persistent-cross-site-scripting-6ee00f5c694d; https://pastebin.com/edit/MZV6DNg7
CVE: CVE-2019-4388
Published: 2019-12-18
Description: HCL AppScan Source 9.0.3.13 and earlier is susceptible to cross-site scripting (XSS) attacks by allowing users to embed arbitrary JavaScript code in the Web UI.
CVSS Score: 4.8 (MEDIUM)
CWE: CWE-79
References: https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0074364; https://hclpnpsupport.hcltech.com/csm?id=kb_article&sysparm_article=KB0074364
CVE: CVE-2019-19235
Published: 2019-12-18
Description: AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user must put an application at a particular path, with a particular file name.
CVSS Score: 7.0 (HIGH)
CWE: CWE-427
References: https://safebreach.com/blog; https://www.asus.com/Static_WebPage/ASUS-Product-Security-Advisory/; https://www.asus.com/support/faq/1041545
CVE: CVE-2019-11399
Published: 2019-12-18
Description: An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. OS command injection occurs through the get_set.ccp lanHostCfg_HostName_1.1.1.0.0 parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/pr0v3rbs/CVE/blob/master/CVE-2019-11399/ticket.png; https://www.trendnet.com/support/; https://github.com/pr0v3rbs/CVE/blob/master/CVE-2019-11399/ticket.png
CVE: CVE-2019-11400
Published: 2019-12-18
Description: An issue was discovered on TRENDnet TEW-651BR 2.04B1, TEW-652BRP 3.04b01, and TEW-652BRU 1.00b12 devices. A buffer overflow occurs through the get_set.ccp ccp_act parameter.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: https://github.com/pr0v3rbs/CVE/blob/master/CVE-2019-11400/ticket.png; https://www.trendnet.com/support/; https://github.com/pr0v3rbs/CVE/blob/master/CVE-2019-11400/ticket.png
CVE: CVE-2019-5152
Published: 2019-12-18
Description: An exploitable information disclosure vulnerability exists in the network packet handling functionality of Shadowsocks-libev 3.3.2. When utilizing a Stream Cipher, a specially crafted set of network packets can cause an outbound connection from the server, resulting in information disclosure. An attacker can send arbitrary packets to trigger this vulnerability.
CVSS Score: 7.4 (HIGH)
CWE: CWE-306, CWE-306
References: https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942; https://talosintelligence.com/vulnerability_reports/TALOS-2019-0942
CVE: CVE-2019-11992
Published: 2019-12-18
Description: A security vulnerability in HPE OneView for VMware vCenter 9.5 could be exploited remotely to allow Cross-Site Scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03957en_us; https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbgn03957en_us
CVE: CVE-2019-19882
Published: 2019-12-18
Description: shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing --disable-account-tools-setuid, and without a PAM configuration suitable for use with setuid account management tools. This combination leads to account management tools (groupadd, groupdel, groupmod, useradd, userdel, usermod) that can easily be used by unprivileged local users to escalate privileges to root in multiple ways. This issue became much more relevant in approximately December 2019 when an unrelated bug was fixed (i.e., the chmod calls to suidusbins were fixed in the upstream Makefile which is now included in the release version 4.8).
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://bugs.archlinux.org/task/64836; https://bugs.gentoo.org/702252; https://github.com/shadow-maint/shadow/commit/edf7547ad5aa650be868cf2dac58944773c12d75
CVE: CVE-2019-4609
Published: 2019-12-18
Description: IBM API Connect 2018.4.1.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 168510.
CVSS Score: 7.5 (HIGH)
CWE: CWE-327
References: https://exchange.xforce.ibmcloud.com/vulnerabilities/168510; https://www.ibm.com/support/pages/node/1137460; https://exchange.xforce.ibmcloud.com/vulnerabilities/168510
CVE: CVE-2019-4716
Published: 2019-12-18
Description: IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and then execute code as root or SYSTEM via TM1 scripting. IBM X-Force ID: 172094.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-94, CWE-94
References: http://packetstormsecurity.com/files/156953/IBM-Cognos-TM1-IBM-Planning-Analytics-Server-Configuration-Overwrite-Code-Execution.html; http://seclists.org/fulldisclosure/2020/Mar/44; https://exchange.xforce.ibmcloud.com/vulnerabilities/172094
CVE: CVE-2012-2312
Published: 2019-12-18
Description: An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: https://access.redhat.com/security/cve/cve-2012-2312; https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-2312; https://security-tracker.debian.org/tracker/CVE-2012-2312
CVE: CVE-2019-19829
Published: 2019-12-18
Description: A cross-site scripting (XSS) vulnerability exists in SolarWinds Serv-U FTP Server 15.1.7 in the email parameter, a different vulnerability than CVE-2018-19934 and CVE-2019-13182.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/155708/Serv-U-FTP-Server-15.1.7-Cross-Site-Scripting.html; http://packetstormsecurity.com/files/155708/Serv-U-FTP-Server-15.1.7-Cross-Site-Scripting.html
CVE: CVE-2019-19832
Published: 2019-12-18
Description: Xerox AltaLink C8035 printers allow CSRF. A request to add users is made in the Device User Database form field to the xerox.set URI. (The frmUserName value must have a unique name.)
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155709/Xerox-AltaLink-C8035-Printer-Cross-Site-Request-Forgery.html; http://packetstormsecurity.com/files/155709/Xerox-AltaLink-C8035-Printer-Cross-Site-Request-Forgery.html
CVE: CVE-2019-19833
Published: 2019-12-18
Description: In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-352
References: http://packetstormsecurity.com/files/155710/Tautulli-2.1.9-Cross-Site-Request-Forgery.html; http://packetstormsecurity.com/files/155974/Tautulli-2.1.9-Denial-Of-Service.html; https://github.com/Tautulli/Tautulli/compare/v2.1.9...v2.1.10-beta
CVE: CVE-2019-6201
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT209599; https://support.apple.com/HT209601; https://support.apple.com/HT209603
CVE: CVE-2019-6204
Published: 2019-12-18
Description: A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/HT209599; https://support.apple.com/HT209603; https://support.apple.com/HT209599
CVE: CVE-2019-6207
Published: 2019-12-18
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209601
CVE: CVE-2019-6222
Published: 2019-12-18
Description: A consistency issue was addressed with improved state handling. This issue is fixed in iOS 12.2. A website may be able to access the microphone without the microphone use indicator being shown.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/HT209599; https://support.apple.com/HT209599
CVE: CVE-2019-6232
Published: 2019-12-18
Description: A race condition existed during the installation of iTunes for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://support.apple.com/HT209605; https://support.apple.com/HT209605
CVE: CVE-2019-6236
Published: 2019-12-18
Description: A race condition existed during the installation of iCloud for Windows. This was addressed with improved state handling. This issue is fixed in iCloud for Windows 7.11. Running the iCloud installer in an untrusted directory may result in arbitrary code execution.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://support.apple.com/HT209605; https://support.apple.com/HT209605
CVE: CVE-2019-6237
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-787
References: https://support.apple.com/HT210118; https://support.apple.com/HT210119; https://support.apple.com/HT210120
CVE: CVE-2019-6239
Published: 2019-12-18
Description: This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Mojave 10.14.4. A malicious application may bypass Gatekeeper checks.
CVSS Score: 7.8 (HIGH)
References: https://support.apple.com/HT209446; https://support.apple.com/HT209600; https://support.apple.com/HT209446
CVE: CVE-2019-7284
Published: 2019-12-18
Description: This issue was addressed with improved checks. This issue is fixed in iOS 12.2. Processing a maliciously crafted mail message may lead to S/MIME signature spoofing.
CVSS Score: 4.3 (MEDIUM)
References: https://support.apple.com/HT209599; https://support.apple.com/HT209599
CVE: CVE-2019-7285
Published: 2019-12-18
Description: A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-416
References: https://support.apple.com/HT209599; https://support.apple.com/HT209601; https://support.apple.com/HT209603
CVE: CVE-2019-7286
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. An application may be able to gain elevated privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT209520; https://support.apple.com/HT209521; https://support.apple.com/HT209601
CVE: CVE-2019-7287
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.1.4. An application may be able to execute arbitrary code with kernel privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787, CWE-787
References: https://support.apple.com/HT209520; https://support.apple.com/HT209520; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-7287
CVE: CVE-2019-7289
Published: 2019-12-18
Description: A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for iOS. A local user may be able to view senstive user information.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-22
References: https://support.apple.com/HT209522; https://support.apple.com/HT209522
CVE: CVE-2019-7290
Published: 2019-12-18
Description: An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may be able to circumvent sandbox restrictions.
CVSS Score: 10.0 (CRITICAL)
CWE: CWE-610
References: https://support.apple.com/HT209522; https://support.apple.com/HT209522
CVE: CVE-2019-7292
Published: 2019-12-18
Description: A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may result in the disclosure of process memory.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT209599; https://support.apple.com/HT209601; https://support.apple.com/HT209602
CVE: CVE-2019-7293
Published: 2019-12-18
Description: A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-787
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209601
CVE: CVE-2019-8502
Published: 2019-12-18
Description: An API issue existed in the handling of dictation requests. This issue was addressed with improved validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to initiate a Dictation request without user authorization.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209601
CVE: CVE-2019-8503
Published: 2019-12-18
Description: A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. A malicious website may be able to execute scripts in the context of another website.
CVSS Score: 8.8 (HIGH)
CWE: CWE-20
References: https://support.apple.com/HT209599; https://support.apple.com/HT209601; https://support.apple.com/HT209603
CVE: CVE-2019-8504
Published: 2019-12-18
Description: A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4. A local user may be able to read kernel memory.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-665
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209599
CVE: CVE-2019-8505
Published: 2019-12-18
Description: A logic issue was addressed with improved validation. This issue is fixed in iOS 12.2, Safari 12.1. Enabling the Safari Reader feature on a maliciously crafted webpage may lead to universal cross site scripting.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://support.apple.com/HT209599; https://support.apple.com/HT209603; https://support.apple.com/HT209599
CVE: CVE-2019-8506
Published: 2019-12-18
Description: A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
CVSS Score: 8.8 (HIGH)
CWE: CWE-843, CWE-843
References: https://support.apple.com/HT209599; https://support.apple.com/HT209601; https://support.apple.com/HT209602
CVE: CVE-2019-8507
Published: 2019-12-18
Description: Multiple memory corruption issues were addressed with improved input validation. This issue is fixed in macOS Mojave 10.14.4. Processing malicious data may lead to unexpected application termination.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: https://support.apple.com/HT209600; https://support.apple.com/HT209600
CVE: CVE-2019-8508
Published: 2019-12-18
Description: A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Mojave 10.14.4. Mounting a maliciously crafted NFS network share may lead to arbitrary code execution with system privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/HT209600; https://support.apple.com/HT209600
CVE: CVE-2019-8510
Published: 2019-12-18
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. A malicious application may be able to determine kernel memory layout.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209601
CVE: CVE-2019-8511
Published: 2019-12-18
Description: A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A malicious application may be able to elevate privileges.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://support.apple.com/HT209599; https://support.apple.com/HT209600; https://support.apple.com/HT209602
CVE: CVE-2019-8512
Published: 2019-12-18
Description: This issue was addressed with improved transparency. This issue is fixed in iOS 12.2. A user may authorize an enterprise administrator to remotely wipe their device without appropriate disclosure.
CVSS Score: 5.7 (MEDIUM)
CWE: CWE-863
References: https://support.apple.com/HT209599; https://support.apple.com/HT209599
CVE: CVE-2019-8513
Published: 2019-12-18
Description: This issue was addressed with improved checks. This issue is fixed in macOS Mojave 10.14.4. A local user may be able to execute arbitrary shell commands.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: https://support.apple.com/HT209600; https://support.apple.com/HT209600