CVE-2019-7288

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The issue was addressed with improved validation on the FaceTime server. This issue is fixed in macOS Mojave 10.14.3 Supplemental Update, iOS 12.1.4. A thorough security audit of the FaceTime service uncovered an issue with Live Photos .

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
Apple	iOS	>= unspecified, < 12.1
Apple	macOS	>= unspecified, < 10.14

References

https://support.apple.com/en-us/HT209520Vendor Advisory
https://support.apple.com/en-us/HT209521Vendor Advisory
https://support.apple.com/en-us/HT209520Vendor Advisory
https://support.apple.com/en-us/HT209521Vendor Advisory

Timeline

Published: Oct 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-72895.5A parsing issue in the handling of directory paths was addressed with improved path validation. This issue is fixed in Shortcuts 2.1.3 for i CVE-2019-729010.0An access issue was addressed with additional sandbox restrictions. This issue is fixed in Shortcuts 2.1.3 for iOS. A sandboxed process may CVE-2019-72916.5A denial of service issue was addressed with improved memory handling. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, Ai CVE-2019-72926.5A validation issue was addressed with improved logic. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 fo CVE-2019-72935.5A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, macOS Mojave 10.14.4, tvOS 12.2, wat CVE-2019-72956.1typora through 0.9.63 has XSS, with resultant remote command execution, during block rendering of a mathematical formula.CVE-2019-72966.1typora through 0.9.64 has XSS, with resultant remote command execution, during inline rendering of a mathematical formula.CVE-2019-72979.8An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72988.1An issue was discovered on D-Link DIR-823G devices with firmware through 1.02B03. A command Injection vulnerability allows attackers to exec CVE-2019-72996.1A stored cross-site scripting (XSS) vulnerability in the submit_ticket.php module in the WP Support Plus Responsive Ticket System plugin 9.1 CVE-2019-73007.2Artica Proxy 3.06.200056 allows remote attackers to execute arbitrary commands as root by reading the ressources/settings.inc ldap_admin and CVE-2019-73017.2Zen Load Balancer 3.10.1 allows remote authenticated admin users to execute arbitrary commands as root via shell metacharacters in the index