CVE-2019-6235

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 12.1.3, macOS Mojave 10.14.3, tvOS 12.1.2, watchOS 5.1.3, iTunes 12.9.3 for Windows. A sandboxed process may be able to circumvent sandbox restrictions.

Metrics

CVSS 3.0 10.0/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Apple	iOS	>= unspecified, < iOS 12.1.3
Apple	macOS	>= unspecified, < macOS Mojave 10.14.3
Apple	tvOS	>= unspecified, < tvOS 12.1.2
Apple	watchOS	>= unspecified, < watchOS 5.1.3
Apple	iTunes for Windows	>= unspecified, < iTunes 12.9.3 for Windows

References

http://www.securityfocus.com/bid/106724Third Party Advisory, VDB Entry
https://support.apple.com/HT209443Vendor Advisory
https://support.apple.com/HT209446Vendor Advisory
https://support.apple.com/HT209447Vendor Advisory
https://support.apple.com/HT209448Vendor Advisory
https://support.apple.com/HT209450Vendor Advisory
http://www.securityfocus.com/bid/106724Third Party Advisory, VDB Entry
https://support.apple.com/HT209443Vendor Advisory
https://support.apple.com/HT209446Vendor Advisory
https://support.apple.com/HT209447Vendor Advisory
https://support.apple.com/HT209448Vendor Advisory
https://support.apple.com/HT209450Vendor Advisory

Timeline

Published: Mar 4, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-62367.5A race condition existed during the installation of iCloud for Windows. This was addressed with improved state handling. This issue is fixed CVE-2019-62378.8Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.3, macOS Mojave 10.14.5, tvOS CVE-2019-62387.8A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed i CVE-2019-62397.8This issue was addressed with improved handling of file metadata. This issue is fixed in macOS Mojave 10.14.4. A malicious application may b CVE-2019-62407.5An issue was discovered in GitLab Community and Enterprise Edition before 11.4. It allows Directory Traversal.CVE-2019-62417.5In Bevywise MQTTRoute 1.1 build 1018-002, a connect packet combined with a malformed unsubscribe request packet can be used to cause a Denia CVE-2019-62427.2Kentico v10.0.42 allows Global Administrators to read the cleartext SMTP Password by navigating to the SMTP configuration page. NOTE: the ve CVE-2019-62436.1Frog CMS 0.9.5 allows XSS via the forgot password page (aka the /admin/?/login/forgot URI).CVE-2019-62448.8An issue was discovered in UsualToolCMS 8.0. cmsadmin/a_sqlbackx.php?t=sql allows CSRF attacks that can execute SQL statements, and conseque CVE-2019-62458.8An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. In the function agg::cell_aa::not_equal, dx is CVE-2019-62469.8An issue was discovered in SVG++ (aka svgpp) 1.2.3. After calling the gil::get_color function in Generic Image Library in Boost, the return CVE-2019-62478.8An issue was discovered in Anti-Grain Geometry (AGG) 2.4 as used in SVG++ (aka svgpp) 1.2.3. A heap-based buffer overflow bug in svgpp_agg_r