CVE-2019-8801

EPSS 0.16%
Published 18.12.2019 18:15:42
Last modified 21.11.2024 04:50:30
Source product-security@apple.com
Teams watchlist Login
Open Login

A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching. This issue is fixed in macOS Catalina 10.15.1, iTunes for Windows 12.10.2. Running the iTunes installer in an untrusted directory may result in arbitrary code execution.

Affected products Warnungen 0 Metrics 3 CWE 1 References 5

Data is provided by the National Vulnerability Database (NVD)

Apple ≫ iTunes SwPlatformwindows Version < 12.10.2

Apple ≫ macOS X Version < 10.15.1

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.16%	0.336

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	7.8	1.8	5.9	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvd@nist.gov	4.4	3.4	6.4	AV:L/AC:M/Au:N/C:P/I:P/A:P

CWE-426 Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

https://support.apple.com/HT210726

Vendor Advisory

https://support.apple.com/HT210722

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2019-8801

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2019-8801

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2019-8801

EUVD