# MA-738.072019: MyCERT Alert - iOS 12.4 Multiple Vulnerabilities Security Update

**Date:** 31 Jul 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-738.072019  
**Advisory ID:** MA-738.072019

---

**1.0 Introduction**
Apple has released security updates to address vulnerabilities in iOS devices.
|  |  | --- | --- | --- | --- | No | CVE | Bug Type / Impact | Severity | 1 | CVE-2019-8646 | A remote attacker may be able to leak memory. | High | 2 | CVE-2019-8647 | A remote attacker may be able to cause remote code execution. | High | 3 | CVE-2019-8660 | Memory corruption able to terminate an application or perform remote code execution. | High | 4 | CVE-2019-8648 | A remote attacker may be able to cause remote code execution. | High | 5 | CVE-2019-8663 | A remote attacker may be able to leak memory. | High | 6 | CVE-2019-8641 | A remote attacker may be able to cause unexpected application termination or remote code execution. | High | 7 | CVE-2018-16860 | An issue existed in Samba that may allow attackers to perform unauthorized actions by intercepting communications between services. | High | 8 | CVE-2019-13118 | A remote attacker may be able to view sensitive information. | High | 9 | CVE-2019-8665 | A remote attacker may cause an unexpected application termination. | High | 10 | CVE-2019-8698 | A malicious application may be able to restrict access to websites. | High | 11 | CVE-2019-8662 | An attacker may be able to trigger a use-after-free in an application deserializing an untrusted NSDictionary. | Medium | 12 | CVE-2019-8646 | A remote attacker may be able to leak memory. | Medium | 13 | CVE-2019-8699 | The initiator of a phone call may be able to cause the recipient to answer a simultaneous Walkie-Talkie connection. | Medium | 14 | CVE-2019-8657 | Parsing a maliciously crafted office document may lead to an unexpected application termination or remote code execution. | High | 15 | CVE-2019-8682 | A user may inadvertently complete an in-app purchase while on the lock screen. | Medium | 16 | CVE-2019-8690  CVE-2019-8649  CVE-2019-8658  CVE-2019-8644  CVE-2019-8666  CVE-2019-8669  CVE-2019-8671  CVE-2019-8672  CVE-2019-8673  CVE-2019-8676  CVE-2019-8677  CVE-2019-8678  CVE-2019-8679  CVE-2019-8680  CVE-2019-8681  CVE-2019-8683  CVE-2019-8684  CVE-2019-8685  CVE-2019-8686  CVE-2019-8687  CVE-2019-8688  CVE-2019-8689 | Processing maliciously crafted web content may lead to universal cross site scripting or remote code execution. | High |
**2.0 Impact**
Exploitation of these vulnerabilities could potentially cause data leak and remote code execution which consider as high severity. Some may cause the unpatched devices to terminate running processes or even freeze up.
**3.0 Affected System and Devices**
iOS Devices that support iOS 12 with iOS 12.3 and below version installed
- iPhone 5s and later
- iPad Air and later
- iPod touch 6th generation and later
**4.0 Recommendations**
We encourage users and administrators to review the Apple security updates website and apply the necessary updates:
- Apple security updates: <https://support.apple.com/en-my/HT201222>
- About the security content of iOS 12.4: <https://support.apple.com/en-my/HT210346>
To update your iOS devices, please refer:
- Update your iPhone, iPad, or iPod touch: <https://support.apple.com/en-my/HT204204>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Fax: +603 - 8008 7000 (Office Hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. Apple security updates: <https://support.apple.com/en-my/HT201222>
2. About the security content of iOS 12.4: <https://support.apple.com/en-my/HT210346>
3. Update your iPhone, iPad, or iPod touch: <https://support.apple.com/en-my/HT204204>
4. Google reveals exploits for five “interactionless” security flaws in iOS: <https://www.neowin.net/news/google-reveals-exploits-for-five-interactionless-security-flaws-in-ios>
5. Google’s Project Zero (CVE-2019-8573, CVE-2019-8664, CVE-2019-8624, CVE-2019-8646, CVE-2019-8647, CVE-2019-8660): <https://bugs.chromium.org/p/project-zero/issues/list?q=label%3AiMessage&can=1>
6. Apple Security Updates July 2019: <https://www.secpod.com/blog/apple-security-updates-july-2019/>
7. CVE 2018-16860: <https://www.samba.org/samba/security/CVE-2018-16860.html>
8. CVE 2019-13118: <https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=15069>
9. CVE 2019-8682: <https://www.mag-securs.com/alertes/artmid/1894/articleid/70071/apple-ios-up-to-1232-wallet-lockscreen-privilege-escalation.aspx>
10. CVE 2019-8649: <https://bugs.chromium.org/p/project-zero/issues/detail?id=1818>
11. CVE 2019-8658: <https://akayn.github.io/2019/07/25/PwningWebkit.html>
12. CVE 2019-8644: <https://www.zerodayinitiative.com/advisories/ZDI-19-681/>
13. CVE 2019-8669: <https://www.zerodayinitiative.com/advisories/ZDI-19-679/>
14. CVE 2019-8672: <https://bugs.chromium.org/p/project-zero/issues/detail?id=1825>
15. CVE 2019-8681: <https://www.zerodayinitiative.com/advisories/ZDI-19-684/>
16. CVE 2019-8684: <https://bugs.chromium.org/p/project-zero/issues/detail?id=1850>
17. CVE 2019-8686: <https://www.zerodayinitiative.com/advisories/ZDI-19-677/>