CVE-2019-8820

high-risk
Published 2019-12-18

Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1, Safari 13.0.3, iTunes for Windows 12.10.2, iCloud for Windows 11.0, iCloud for Windows 7.15. Processing maliciously crafted web content may lead to arbitrary code execution.

Do I need to act?

~
6.5% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
1 public exploit available
47590
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.8/10 High
NETWORK / LOW complexity

Affected Products (7)

Affected Vendors

Apple

References (16)

Third Party Advisory https://security.gentoo.org/glsa/202003-22
Vendor Advisory https://support.apple.com/HT210721
Vendor Advisory https://support.apple.com/HT210723
Vendor Advisory https://support.apple.com/HT210724
Vendor Advisory https://support.apple.com/HT210725
Vendor Advisory https://support.apple.com/HT210726
Vendor Advisory https://support.apple.com/HT210727
Vendor Advisory https://support.apple.com/HT210728
Third Party Advisory https://security.gentoo.org/glsa/202003-22
Vendor Advisory https://support.apple.com/HT210721
Vendor Advisory https://support.apple.com/HT210723
Vendor Advisory https://support.apple.com/HT210724
Vendor Advisory https://support.apple.com/HT210725
Vendor Advisory https://support.apple.com/HT210726
Vendor Advisory https://support.apple.com/HT210727
Vendor Advisory https://support.apple.com/HT210728
60
/ 100
high-risk
Severity 30/34 · Critical
Exploitability 16/34 · Moderate
Exposure 14/34 · Moderate