CVE-2019-8600

—

CVSS 3.1

9.8 critical

EPSS

20%p97

Published

Dec 18, 2019 (Dec 18, 2019)

Modified

Jun 17, 2026

Description

A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS 12.3, watchOS 5.2.1, iTunes for Windows 12.9.5, iCloud for Windows 7.12. A maliciously crafted SQL query may lead to arbitrary code execution.

Vendors: apple
Products: icloud, itunes, iphone os, mac os x, tvos, watchos
Weakness: CWE-89, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (20.0%)

In the news2 stories

Gaining remote code execution using a tainted SQLite database

Security AffairsAug 11, 16:18 UTC · Aug 11, 2019Vulnerability CVE-2019-8600 CVE-2019-8598 CVE-2019-8602+1 CVEs1

Apple updates fix SQLite, WebKit issues in iTunes and iCloud for Windows

Security AffairsJun 1, 14:34 UTC · Jun 1, 2019Vulnerability CVE-2019-8577 CVE-2019-8602 CVE-2019-8600+2 CVEs