A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2. A malicious application may be able to elevate privileges.

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

 - Multiple unspecified vulnerabilities in WebKit can lead to arbitrary code execution if a user is enticed to visit a malicious web page. (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

 - A maliciously crafted SQL query could lead to arbitrary code execution. (CVE-2018-20346, CVE-2018-20505, CVE-2018-20506)

 - A malicious application could lead to arbitrary code execution with kernel privileges. (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

 - AppleKeyStore
 - Bluetooth
 - Core Media
 - CoreAnimation
 - FaceTime
 - IOKit
 - Kernel
 - libxpc
 - Natural Language Processing
 - QuartzCore
 - SQLite
 - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running a version of macOS / Mac OS X that is 10.14.x prior to 10.14.3. It is, therefore, affected by multiple vulnerabilities related to the following components:

  - AppleKeyStore
  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - IOKit
  - Kernel
  - libxpc
  - Natural Language Processing
  - QuartzCore
  - SQLite
  - WebRTC

Note that successful exploitation of the most serious issues can result in arbitrary code execution.

The remote host is running macOS 10.13.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components:

  - Bluetooth
  - Core Media
  - CoreAnimation
  - FaceTime
  - Hypervisor
  - Intel Graphics Driver
  - IOKit
  - Kernel
  - libxpc
  - QuartzCore

The remote host is running Mac OS X 10.12.6 and is missing a security update. It is therefore, affected by multiple vulnerabilities in the following components:

  - CoreAnimation
  - Hypervisor
  - Intel Graphics Driver
  - IOKit
  - Kernel
  - libxpc
  - QuartzCore

The version of Apple iOS running on the mobile device is prior to 12.1.3. It is, therefore, affected by multiple vulnerabilities:

  - Multiple unspecified vulnerabilities in WebKit     can lead to arbitrary code execution if a user     is enticed to visit a malicious web page.
    (CVE-2019-6227, CVE-2019-6233, CVE-2019-6234)

  - A maliciously crafted SQL query could lead to     arbitrary code execution.
    (CVE-2018-20346, CVE-2018-20505,     CVE-2018-20506)

  - A malicious application could lead to arbitrary     code execution with kernel privileges.
    (CVE-2019-6218)

Additionally several other vulnerabilities exist, the highest of which could allow an attacker to perform a remote code execution attack by enticing a user to view malicious web content.

ID	Name	Product	Family	Severity
700556	Apple iOS < 12.1.3 Multiple Vulnerabilities (APPLE-SA-2019-1-22-1)	Nessus Network Monitor	Mobile Devices	medium
700521	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus Network Monitor	Operating System Detection	critical
121393	macOS 10.14.x < 10.14.3 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
121392	macOS 10.13.6 Multiple Vulnerabilities (Security Update 2019-001)	Nessus	MacOS X Local Security Checks	high
121391	macOS and Mac OS X Multiple Vulnerabilities (Security Update 2019-001)	Nessus	MacOS X Local Security Checks	high
121331	Apple iOS < 12.1.3 Multiple Vulnerabilities	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2019-6225

high

Tenable Plugins

medium

critical

critical

high

high

critical