# MA-757.112019: MyCERT Advisory - iOS 13.2 and iPadOS 13.2 Security Updates

**Date:** 01 Nov 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-757.112019  
**Advisory ID:** MA-757.112019

---

**1.0 Introduction**
Apple has released security updates to address vulnerabilities in iOS devices.
|  |  | --- | --- | --- | --- | No. | Component | CVE | Bug Type | 1. | Account | CVE-2019-8787 | An out-of-bounds memory read where remote attacker may be able to leak memory. | 2. | App Store | CVE-2019-8803 | An authentication issue where user able to login into a previously logged in user without valid credential. | 3. | Associated Domain | CVE-2019-8788 | An issue existed in the parsing of URLs where it can lead to data exfiltration. | 4 | Audio | CVE-2019-8785  CVE-2019-8797 | A memory corruption issue where an application may be able to execute arbitrary code with system privileges. | 5 | AVEVideoEncoder | CVE-2019-8795 | A memory corruption issue where an application may be able to execute arbitrary code with system privileges. | 6 | Books | CVE-2019-8789 | A validation issue existed in the handling of symlinks. | 7 | Contacts | CVE-2017-7152 | An inconsistent user interface issue. | 8 | File System Events | CVE-2019-8798 | A memory corruption issue where an application may be able to execute arbitrary code with system privileges. | 9 | Graphic Driver | CVE-2019-8784 | A memory corruption issue where an application may be able to execute arbitrary code with system privileges. | 10 | Kernel | CVE-2019-8794 | A validation issue where aAn application may be able to read restricted memory. | 11 | Kernel | CVE-2019-8786 | A memory corruption issue where an application may be able to execute arbitrary code with kernel privileges. | 12 | Setup Assistant | CVE-2019-8804 | An inconsistency in Wi-Fi network configuration settings. | 13 | Screen Recording | CVE-2019-8793 | A consistency issue existed in deciding when to show the screen recording indicator. | 14 | WebKit | CVE-2019-8813 | A logic issue  where browser can process maliciously crafted web content may lead to universal cross site scripting. | 15 | WebKit Process Model | CVE-2019-8815 | Multiple memory corruption issues found which attacker can use maliciously crafted web content to perform arbitrary code execution . |
In addition to above vulnerabilities, there are also additional 12 vulnerabilities associated with WebKit. These vulnerabilities only have general description where multiple memory corruption issues discovered.
|  | --- | --- | No. | CVE | 1 | CVE-2019-8782 | 2 | CVE-2019-8783 | 3 | CVE-2019-8808 | 4 | CVE-2019-8811 | 5 | CVE-2019-8812 | 6 | CVE-2019-8814 | 7 | CVE-2019-8816 | 8 | CVE-2019-8819 | 9 | CVE-2019-8820 | 10 | CVE-2019-8821 | 11 | CVE-2019-8822 | 12 | CVE-2019-8823 |
**2.0 Impact**
Exploitation of these vulnerabilities could potentially cause data leak and remote code execution which considered as high severity. Some may cause the unpatched devices to terminate running processes or even freeze up.
**3.0 Affected Products**
iOS and iPadOS Devices that support iOS 13/ iPadOS 13 with iOS 13.1.3/ iPadOS 13.1.3 and below version installed
- iPhone 6s and later.
- iPad Air 2 and later.
- iPad mini 4 and later.
- iPod touch 7th generation.
**4.0 Recommendations**
We encourage users and administrators to review the Apple security updates website and apply the necessary updates:
- Apple security updates: <https://support.apple.com/en-my/HT201222>
- About the security content of iOS 13.2 and iPadOS 13.2: <https://support.apple.com/en-my/HT210721>
To update your iOS devices, please refer:
- Update your iPhone, iPad, or iPod touch: <https://support.apple.com/en-my/HT204204>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- https://support.apple.com/en-my/HT210721