KLA11603 Multiple vulnerabilities in Apple iCloud

Multiple vulnerabilities were found in Apple iCloud. Malicious users can exploit these vulnerabilities to execute arbitrary code, perform cross-site scripting attack, cause denial of service.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability in libxslt can be exploited remotely to execute arbitrary code;
2. Vulnerabilitiy in WebKit can be exploited remotely via specially crafted text file to execute arbitrary code;
3. Multiple memory corruption vulnerabilities in WebKit Process Model can be exploited to execute arbitrary code;
4. Multiple memory corruption vulnerabilities in WebKit can be exploited to execute arbitrary code;
5. A logic vulnerability in WebKit can be exploited to perform cross-site scripting attacks;
6. A memory corruption vulnerability in Graphics Driver can be exploited to execute arbitrary code;
7. The HTTP referrer header vulnerability in WebKit can be exploited to obtain sensitive information.

Original advisories

HT210728

HT210727

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Apple-iCloud

CVE list

CVE-2019-8750 critical

CVE-2019-8710 high

CVE-2019-8766 high

CVE-2019-8815 critical

CVE-2019-8782 high

CVE-2019-8822 high

CVE-2019-8823 high

CVE-2019-8783 high

CVE-2019-8811 high

CVE-2019-8813 warning

CVE-2019-8814 critical

CVE-2019-8819 high

CVE-2019-8816 critical

CVE-2019-8784 critical

CVE-2019-8820 high

CVE-2019-8821 high

CVE-2019-8827 warning

Solution

Update to the latest version

Download iCloud

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• DoS

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• XSS/CSS

Cross site scripting. Exploitation of vulnerabilities with this impact can lead to partial interception of information transmitted between user and site.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Apple iCloud earlier than 7.15Apple iCloud earlier than 11.0