KLA11579 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack.

Below is a complete list of vulnerabilities:

1. Vulnerabilitiy in WebKit can be exploited remotely via specially crafted text file to execute arbitrary code;
2. Vulnerabilitiy in WebKit can be exploited remotely via specially crafted web content to perform cross-site scripting attacks;
3. Vulnerabilitiy in UIFoundation can be exploited remotely via specially crafted text file to execute arbitrary code;

Original advisories

HT210636

HT210637

Related products

Apple-iCloud

CVE list

CVE-2019-8726 high

CVE-2019-8733 high

CVE-2019-8707 high

CVE-2019-8719 warning

CVE-2019-8745 high

CVE-2019-8625 warning

CVE-2019-8735 high

CVE-2019-8763 high

Solution

Update to the latest version

Download iCloud

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

Affected Products

• Apple iCloud earlier than 7.14Apple iCloud earlier than 10.7