CVE-2019-20374 | ByteOS Network

Vulnerability Details :

CVE-2019-20374

Assigner-mitre

Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At-09 Jan, 2020 | 22:40

Updated At-05 Aug, 2024 | 02:39

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:mitre

Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca

Published At:09 Jan, 2020 | 22:40

Updated At:05 Aug, 2024 | 02:39

▼CVE Numbering Authority (CNA)

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Affected Products

Vendor

Product

Versions

Affected

n/a

Problem Types

Type	CWE ID	Description
text	N/A	n/a

Type: text

CWE ID: N/A

Description: n/a

Metrics

Version	Base score	Base severity	Vector
3.0	8.3	HIGH	CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R

Version: 3.0

Base score: 8.3

Base severity: HIGH

Vector:

CVSS:3.0/AC:H/AV:N/A:H/C:H/I:H/PR:N/S:C/UI:R

References

Hyperlink	Resource
https://github.com/typora/typora-issues/issues/3124	x_refsource_MISC
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e	x_refsource_MISC

Hyperlink: https://github.com/typora/typora-issues/issues/3124

Resource:

x_refsource_MISC

Hyperlink: https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://github.com/typora/typora-issues/issues/3124	x_refsource_MISC x_transferred
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e	x_refsource_MISC x_transferred

Hyperlink: https://github.com/typora/typora-issues/issues/3124

Resource:

x_refsource_MISC

x_transferred

Hyperlink: https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:cve@mitre.org

Published At:09 Jan, 2020 | 23:15

Updated At:08 Sep, 2021 | 17:22

A mutation cross-site scripting (XSS) issue in Typora through 0.9.9.31.2 on macOS and through 0.9.81 on Linux leads to Remote Code Execution through Mermaid code blocks. To exploit this vulnerability, one must open a file in Typora. The XSS vulnerability is then triggered due to improper HTML sanitization. Given that the application is based on the Electron framework, the XSS leads to remote code execution in an unsandboxed environment.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.6	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Secondary	3.0	8.3	HIGH	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Primary	2.0	6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.6

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Type: Secondary

Version: 3.0

Base score: 8.3

Base severity: HIGH

Vector:

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 6.8

Base severity: MEDIUM

Vector:

AV:N/AC:M/Au:N/C:P/I:P/A:P

CPE Matches

typora>>typora>>Versions up to 0.9.81(inclusive)

cpe:2.3:a:typora:typora:*:*:*:*:*:*:*:*

Linux Kernel Organization, Inc

>>linux_kernel>>-

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

typora>>typora>>Versions up to 0.9.9.31.2(inclusive)

cpe:2.3:a:typora:typora:*:*:*:*:*:*:*:*

>>macos>>-

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-79	Primary	nvd@nist.gov

CWE ID: CWE-79

Type: Primary

Source: nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e	cve@mitre.org	Patch Third Party Advisory
https://github.com/typora/typora-issues/issues/3124	cve@mitre.org	Third Party Advisory

Hyperlink: https://github.com/cure53/DOMPurify/commit/4e8af7b2c4a159b683d317e02c5cbddb86dc4a0e

Source: cve@mitre.org

Resource:

Patch

Third Party Advisory

Hyperlink: https://github.com/typora/typora-issues/issues/3124

Source: cve@mitre.org

Resource:

Third Party Advisory

Similar CVEs

2694Records found

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.10% / 89.44%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:13

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have a buffer overrun vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-125

Out-of-bounds Read

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.85% / 76.43%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.41% / 69.29%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:51

Updated-04 Aug, 2024 | 21:31

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, iOS 13, iCloud for Windows 10.7, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, iCloud for Windows 7.14, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os icloud mac_os_x macOS iOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.80% / 75.72%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:24

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-3.36% / 87.15%

||

7 Day CHG~0.00%

Published-03 Aug, 2007 | 10:00

Updated-23 Apr, 2026 | 00:35

The Java interface to CoreAudio on Apple Mac OS X 10.3.9 and 10.4.10 does not restrict object instantiation and manipulation to valid heap addresses, which allows remote attackers to execute arbitrary code via a crafted applet.

Vendor-n/a Apple Inc.

Product-ichat mac_os_x mac_os_x_server n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-3.10% / 86.05%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A logic issue was addressed with improved state management. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, watchOS 5.2. An application may be able to gain elevated privileges.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos tvos tvOS macOS watchOS iOS

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.66% / 73.68%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.81% / 75.84%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iCloud for Windows (Microsoft Store)iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.84% / 76.25%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.94% / 77.47%

||

7 Day CHG+0.01%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:18

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:17

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:26

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.29% / 86.88%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:19

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an out-of-bounds write vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-7.78% / 93.88%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iCloud for Windows (Microsoft Store)iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.36% / 68.11%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:45

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13, iCloud for Windows 7.14, iCloud for Windows 10.7, Safari 13, tvOS 13, watchOS 6, iTunes 12.10.1 for Windows. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari icloud iTunes for Windows watchOS Safari iCloud for Windows iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:17

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.22% / 64.92%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:38

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 5.2, iCloud for Windows 7.11, iOS 12.2, iTunes 12.9.4 for Windows, Safari 12.1. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos safari icloud iTunes for Windows watchOS iCloud for Windows Safari iOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.05% / 60.02%

||

7 Day CHG~0.00%

Published-27 Oct, 2020 | 19:43

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Catalina 10.15, iOS 13.1 and iPadOS 13.1, tvOS 13, macOS Catalina 10.15.1, Security Update 2019-001, and Security Update 2019-006, watchOS 6. Processing a maliciously crafted audio file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-iphone_os ipad_os watchos tvos mac_os_x tvOS macOS watchOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.08% / 79.14%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.81% / 75.84%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.84% / 76.24%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.98% / 57.69%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.57% / 72.19%

||

7 Day CHG+0.01%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-watchos watchOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.80% / 75.72%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iCloud for Windows (Microsoft Store)iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-416

Use After Free

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-8.32% / 94.22%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:17

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-3.22% / 86.61%

||

7 Day CHG~0.00%

Published-03 Aug, 2007 | 10:00

Updated-23 Apr, 2026 | 00:35

Quartz Composer on Apple Mac OS X 10.4.10 does not initialize a certain object pointer, which might allow user-assisted remote attackers to execute arbitrary code via a crafted Quartz Composer file.

Vendor-n/a Apple Inc.

Product-quartz_composer mac_os_x mac_os_x_server n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.97% / 77.82%

||

7 Day CHG+0.01%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.80% / 84.65%

||

7 Day CHG~0.00%

Published-16 Feb, 2022 | 16:38

Updated-23 Apr, 2025 | 19:03

Adobe After Effects 3GP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

Adobe After Effects versions 22.1.1 (and earlier) and 18.4.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows macos after_effects After Effects

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.98% / 57.69%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

A memory corruption issue was addressed with improved validation. This issue is fixed in Xcode 11.2. Processing a maliciously crafted file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-10.26% / 95.09%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed by removing the vulnerable code. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A malicious application may be able to elevate privileges.

Vendor-Apple Inc.

Product-itunes iphone_os watchos tvos safari mac_os_x icloud iTunes for Windows watchOS iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.84% / 76.24%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, Safari 12.1.2, iTunes for Windows 12.9.6, iCloud for Windows 7.13, iCloud for Windows 10.6. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari mac_os_x icloud iCloud for Windows (Microsoft Store)iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-7.8||HIGH

EPSS-2.23% / 80.51%

||

7 Day CHG~0.00%

Published-16 Feb, 2022 | 16:38

Updated-23 Apr, 2025 | 19:04

Adobe Illustrator Out-of-bounds Write could lead to Arbitrary code execution

Adobe Illustrator versions 25.4.3 (and earlier) and 26.0.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

Vendor-Adobe Inc.Apple Inc.Microsoft Corporation

Product-windows macos illustrator Illustrator

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:18

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.64% / 88.09%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:26

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.90% / 77.00%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes icloud tvos tvOS iTunes for Windows iCloud for Windows iCloud for Windows (Legacy)

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-4.17% / 89.58%

||

7 Day CHG~0.00%

Published-20 Aug, 2019 | 20:06

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-7.78% / 93.88%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, Safari 12.1.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os safari mac_os_x icloud iTunes for Windows Safari iCloud for Windows macOS iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.42% / 69.39%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-416

Use After Free

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.88% / 76.69%

||

7 Day CHG+0.01%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes iphone_os ipados tvos safari icloud iTunes for Windows iCloud for Windows Safari iOS tvOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-1.83% / 76.14%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes icloud tvos tvOS iTunes for Windows iCloud for Windows iCloud for Windows (Legacy)

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-6.98% / 93.32%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in watchOS 6.1. Processing maliciously crafted web content may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-watchos watchOS

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-8.8||HIGH

EPSS-2.22% / 80.42%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:31

A buffer overflow was addressed with improved bounds checking. This issue is fixed in macOS Catalina 10.15, tvOS 13, iTunes for Windows 12.10.1, iCloud for Windows 10.7, iCloud for Windows 7.14. Processing a maliciously crafted text file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-itunes icloud mac_os_x tvos iTunes for Windows iCloud for Windows macOS iCloud for Windows (Legacy)tvOS

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.98% / 57.69%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:24

A memory corruption issue was addressed with improved state management. This issue is fixed in Xcode 11.0. Processing a maliciously crafted file may lead to arbitrary code execution.

Vendor-Apple Inc.

Product-xcode Xcode

CWE ID-CWE-787

Out-of-bounds Write

Matching Score-8

Assigner-Adobe Systems Incorporated

Matching Score-8

Assigner-Adobe Systems Incorporated

CVSS Score-8.8||HIGH

EPSS-3.67% / 88.22%

||

7 Day CHG~0.00%

Published-17 Oct, 2019 | 20:16

Updated-04 Aug, 2024 | 21:10

Adobe Acrobat and Reader versions , 2019.012.20040 and earlier, 2017.011.30148 and earlier, 2017.011.30148 and earlier, 2015.006.30503 and earlier, and 2015.006.30503 and earlier have an untrusted pointer dereference vulnerability. Successful exploitation could lead to arbitrary code execution .

Vendor-Apple Inc.Microsoft Corporation Adobe Inc.

Product-acrobat_dc windows macos acrobat_reader_dc Adobe Acrobat and Reader

CWE ID-CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-0.97% / 57.45%

||

7 Day CHG~0.00%

Published-18 Dec, 2019 | 17:33

Updated-04 Aug, 2024 | 21:17

A buffer overflow issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, watchOS 5.2. A malicious application may be able to elevate privileges.

Vendor-Apple Inc.

Product-mac_os_x iphone_os watchos watchOS macOS iOS

CWE ID-CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Matching Score-8

Assigner-MITRE Corporation

Matching Score-8

Assigner-MITRE Corporation

CVSS Score-6.8||MEDIUM

EPSS-1.42% / 69.47%

||

7 Day CHG~0.00%

Published-03 Aug, 2007 | 10:00

Updated-23 Apr, 2026 | 00:35

CFNetwork on Apple Mac OS X 10.3.9 and 10.4.10 does not properly validate ftp: URIs, which allows remote attackers to trigger the transmission of arbitrary FTP commands to arbitrary FTP servers.

Vendor-n/a Apple Inc.

Product-cfnetwork mac_os_x mac_os_x_server n/a

Matching Score-8

Assigner-Apple Inc.

Matching Score-8

Assigner-Apple Inc.

CVSS Score-7.8||HIGH

EPSS-1.27% / 66.09%

||

7 Day CHG~0.00%

Published-18 Mar, 2022 | 18:00

Updated-03 Aug, 2024 | 03:21

A memory corruption issue was addressed with improved validation. This issue is fixed in tvOS 15.4, iOS 15.4 and iPadOS 15.4, watchOS 8.5. Processing a maliciously crafted image may lead to heap corruption.

Vendor-Apple Inc.

Product-iphone_os tvos watchos ipados tvOS watchOS iOS and iPadOS

CWE ID-CWE-787

Out-of-bounds Write