{"schemaVersion":3,"id":"CVE-2019-8506","aliases":["UBUNTU-CVE-2019-8506","DEBIAN-CVE-2019-8506"],"status":"published","duplicateOf":null,"title":"Apple Multiple Products Type Confusion Vulnerability","description":"A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.","dates":{"published":"2019-12-18T17:33:16.000Z","modified":"2025-10-21T23:35:55.429Z","reserved":null,"kevAdded":["2022-05-04T00:00:00.000Z"],"kevDue":["2022-05-25T00:00:00.000Z"]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.16159,"percentile":0.96907,"severity":"medium","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":-1.948999999999998,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.18108},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.16159,"percentile":0.96907}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.18108,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.16159,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.16159,"percentile":0.96907}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-04T00:00:00.000Z","dueDate":"2022-05-25T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products Type Confusion Vulnerability","description":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-8506","label":"nvd.nist.gov/vuln/detail/CVE-2019-8506"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2022-05-04T00:00:00.000Z","dueDate":"2022-05-25T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Apple Multiple Products Type Confusion Vulnerability","description":"A type confusion issue affecting multiple Apple products allows processing of maliciously crafted web content, leading to arbitrary code execution.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2019-8506","label":"nvd.nist.gov/vuln/detail/CVE-2019-8506"}],"vendor":"Apple","product":"Multiple Products","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"46647","name":"WebKit JavaScriptCore - 'createRegExpMatchesArray' Type Confusion","source":"exploit-database","url":"https://www.exploit-db.com/exploits/46647","maturity":"poc","reliabilityScore":0.8,"verified":true,"type":"dos","platforms":["multiple"],"requiresAuth":null,"exploitdb":{"verified":true,"type":"dos","platform":"multiple","file":"exploits/multiple/dos/46647.js","codes":["CVE-2019-8506"]},"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-843","name":"Access of Resource Using Incompatible Type ('Type Confusion')","description":"The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/843.html"}],"affected":[{"vendor":"apple","product":"icloud","name":"icloud","label":"icloud","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 7.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.11","eol":null,"hubHref":"/vendor/apple/icloud"},{"vendor":"apple","product":"icloud for windows","name":"iCloud for Windows","label":"icloud for windows","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < iCloud for Windows 7.11","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < iCloud for Windows 7.11","eol":null,"hubHref":"/vendor/apple/icloud_for_windows"},{"vendor":"apple","product":"ios","name":"iOS","label":"ios","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < iOS 12.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < iOS 12.2","eol":null,"hubHref":"/vendor/apple/ios"},{"vendor":"apple","product":"iphone_os","name":"iphone os","label":"iphone_os","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"< 12.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"ios","label":"Apple iOS","category":"os"}},"hubHref":"/vendor/apple/iphone_os"},{"vendor":"apple","product":"itunes","name":"itunes","label":"itunes","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"< 12.9.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 12.9.4","eol":null,"hubHref":"/vendor/apple/itunes"},{"vendor":"apple","product":"itunes for windows","name":"iTunes for Windows","label":"itunes for windows","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < iTunes 12.9.4 for Windows","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < iTunes 12.9.4 for Windows","eol":null,"hubHref":"/vendor/apple/itunes_for_windows"},{"vendor":"apple","product":"safari","name":"Safari","label":"safari","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < Safari 12.1","noFixRecorded":false,"fixedIn":null},{"text":"< 12.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < Safari 12.1 | < 12.1","eol":null,"hubHref":"/vendor/apple/safari"},{"vendor":"apple","product":"tvos","name":"tvOS","label":"tvos","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < tvOS 12.2","noFixRecorded":false,"fixedIn":null},{"text":"< 12.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < tvOS 12.2 | < 12.2","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"tvos","label":"Apple tvOS","category":"os"}},"hubHref":"/vendor/apple/tvos"},{"vendor":"apple","product":"watchos","name":"watchOS","label":"watchos","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < watchOS 5.2","noFixRecorded":false,"fixedIn":null},{"text":"< 5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < watchOS 5.2 | < 5.2","eol":null,"hubHref":"/vendor/apple/watchos"},{"vendor":"debian","product":"webkit2gtk","name":"webkit2gtk","label":"webkit2gtk","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/webkit2gtk","purlType":"deb","versions":[{"text":"< 2.24.1-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.24.1-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"qtwebkit-opensource-src","name":"qtwebkit-opensource-src","label":"qtwebkit-opensource-src","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/qtwebkit-opensource-src","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"qtwebkit-source","name":"qtwebkit-source","label":"qtwebkit-source","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/qtwebkit-source","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"webkit2gtk","name":"webkit2gtk","label":"webkit2gtk","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/webkit2gtk","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 2.24.1-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 2.24.1-0ubuntu0.18.04.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"webkitgtk","name":"webkitgtk","label":"webkitgtk","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/webkitgtk","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"redhat","product":"enterprise_linux_desktop","name":"enterprise linux desktop","label":"enterprise_linux_desktop","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server","name":"enterprise linux server","label":"enterprise_linux_server","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation","name":"enterprise linux workstation","label":"enterprise_linux_workstation","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0","eol":null,"hubHref":"/vendor/redhat/enterprise_linux_workstation"}],"affectedCount":17,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://support.apple.com/HT209599","label":"support.apple.com/HT209599","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209601","label":"support.apple.com/HT209601","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209603","label":"support.apple.com/HT209603","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209604","label":"support.apple.com/HT209604","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209605","label":"support.apple.com/HT209605","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://support.apple.com/HT209602","label":"support.apple.com/HT209602","hostname":"support.apple.com","tags":["X Refsource MISC","Release Notes","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8506","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8506","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://ubuntu.com/security/CVE-2019-8506","label":"ubuntu.com/security/CVE-2019-8506","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://webkitgtk.org/security/WSA-2019-0002.html","label":"webkitgtk.org/security/WSA-2019-0002.html","hostname":"webkitgtk.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-3948-1","label":"ubuntu.com/security/notices/USN-3948-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-8506","label":"www.cve.org/CVERecord?id=CVE-2019-8506","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-8506","label":"security-tracker.debian.org/tracker/CVE-2019-8506","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2019:1374-1","RHSA-2019:3553","RHSA-2020:4035","SUSE-SU-2019:1137-1","SUSE-SU-2019:1155-1","USN-3948-1"],"duplicates":[],"related":["OPENSUSE-SU-2019:1374-1","SUSE-SU-2019:1137-1","SUSE-SU-2019:1155-1","USN-3948-1"]},"timeline":[{"kind":"published","date":"2019-12-18T17:33:16.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2022-05-04T00:00:00.000Z","label":"Added to CISA KEV","detail":"Apple Multiple Products Type Confusion Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-25T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:35:55.429Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T11:41:08.580Z","stale":false,"partial":false}}