Red Hat Security Advisory

RHSA-2019:3553

GNOME security, bug fix, and enhancement update

Released 2019-11-05 · Red Hat rating Low · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) accountsservice-devel-0.6.50-7.el8, gdk-pixbuf2-xlib-2.36.12-5.el8, gdk-pixbuf2-xlib-devel-2.36.12-5.el8 +8
Red Hat Enterprise Linux AppStream (v. 8) SDL-1.2.15-35.el8, SDL-devel-1.2.15-35.el8, accountsservice-0.6.50-7.el8 +47
Red Hat Enterprise Linux BaseOS (v. 8) gdk-pixbuf2-2.36.12-5.el8, gsettings-desktop-schemas-3.32.0-3.el8, mozjs60-60.9.0-3.el8

Fixes 51 records

TI-2019-06084 CVE-2019-8506 · GHSA-fg7h-q67h-82rg

Type confusion in Apple iOS

CRITICAL 97KEV

A type confusion issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.16159 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-843

TI-2019-06256 CVE-2019-8689 · GHSA-jj3w-68r8-9c3g

Out-of-bounds write in Apple iOS

MEDIUM 53

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.13642 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +6 CWE-787

TI-2019-06239 CVE-2019-8672 · GHSA-96vv-4v74-xc29

Out-of-bounds write in Apple iOS

MEDIUM 51

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.11113 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +6 CWE-787

TI-2019-06096 CVE-2019-8518 · GHSA-wvj5-49vm-wf8w

Out-of-bounds write in Apple iOS

MEDIUM 51

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.11189 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06238 CVE-2019-8671 · GHSA-mwvc-v6v5-5p39

Out-of-bounds write in Apple iOS

MEDIUM 49

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.08479 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06197 CVE-2019-8623 · GHSA-vq4j-69c9-q6rm

Out-of-bounds write in Apple iOS

MEDIUM 49

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.08354 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +5 CWE-787

TI-2019-06196 CVE-2019-8622 · GHSA-xfjj-4fqf-vx76

Out-of-bounds write in Apple iOS

MEDIUM 49

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.08354 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +5 CWE-787

TI-2019-06187 CVE-2019-8611 · GHSA-5hrx-6xhx-79cj

Out-of-bounds write in Apple iOS

MEDIUM 49

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.08479 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06134 CVE-2019-8558 · GHSA-jj32-8cmg-q469

Out-of-bounds write in Apple iOS

MEDIUM 48

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.07536 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06177 CVE-2019-8601 · GHSA-4g55-jg35-rh33

Integer overflow in Apple iOS

MEDIUM 45

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.04053 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +5 CWE-190

TI-2019-06243 CVE-2019-8676 · GHSA-f2cm-2ggv-x4xj

Out-of-bounds write in Apple iOS

MEDIUM 43

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02482 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +6 CWE-787

TI-2019-06121 CVE-2019-8544 · GHSA-7cj7-pfg5-fxwf

Out-of-bounds write in Apple iOS

MEDIUM 43

A memory corruption issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02348 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06298 CVE-2019-8735 · GHSA-fq59-5j2w-fw9q

Out-of-bounds write in Apple tvOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01892 Published 2019-12-18 Partial fix · tvOS 13, iTunes for Windows 12.10.1 +2 CWE-787

TI-2019-06290 CVE-2019-8726 · GHSA-mgrw-rrgf-hq58

Out-of-bounds write in Apple tvOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01818 Published 2019-12-18 Partial fix · tvOS 13, iTunes for Windows 12.10.1 +2 CWE-787

TI-2019-06254 CVE-2019-8687 · GHSA-h25q-f2xx-869f

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06253 CVE-2019-8686 · GHSA-x537-37jq-vh38

Use after free in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-416

TI-2019-06248 CVE-2019-8681 · GHSA-2h5v-wwhm-x53c

Use after free in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01797 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-416

TI-2019-06246 CVE-2019-8679 · GHSA-4p6v-55g5-cqg9

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06244 CVE-2019-8677 · GHSA-x56w-f8v2-mmj6

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01797 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06240 CVE-2019-8673 · GHSA-w924-4pr9-6q2j

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01995 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06233 CVE-2019-8666 · GHSA-35q5-r29v-56m2

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01797 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-787

TI-2019-06194 CVE-2019-8619 · GHSA-2c93-2ccm-q98v

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06186 CVE-2019-8610 · GHSA-8v73-q7g9-q8gq

Use after free in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01995 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-416

TI-2019-06185 CVE-2019-8609 · GHSA-7xw9-gpxf-hff3

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01995 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06172 CVE-2019-8596 · GHSA-3rf5-gg5c-jh3p

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01995 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06171 CVE-2019-8595 · GHSA-xhwh-gmq8-c8f4

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06170 CVE-2019-8594 · GHSA-p9hj-jvqg-w5w2

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06163 CVE-2019-8587 · GHSA-4m4c-x36x-m5w4

Improper array index validation in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01797 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-129

TI-2019-06162 CVE-2019-8586 · GHSA-6rcg-qvr5-p3c5

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06160 CVE-2019-8584 · GHSA-58q4-h5mm-8v85

Use after free in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-416

TI-2019-06159 CVE-2019-8583 · GHSA-jxx3-m83x-x6jh

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02009 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +5 CWE-787

TI-2019-06147 CVE-2019-8571 · GHSA-h2pc-5xwr-hqv8

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01797 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06139 CVE-2019-8563 · GHSA-7j96-jhpg-mggh

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.0174 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06135 CVE-2019-8559 · GHSA-qj23-qqxr-6g3c

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01769 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06114 CVE-2019-8536 · GHSA-3f9p-7mj8-2f34

Out-of-bounds write in Apple iOS

MEDIUM 42

A memory corruption issue was addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02078 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +4 CWE-787

TI-2019-06113 CVE-2019-8535 · GHSA-g65r-99hv-qpfv

Out-of-bounds write in Apple iOS

MEDIUM 42

A memory corruption issue was addressed with improved state management.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02185 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +3 CWE-787

TI-2019-06102 CVE-2019-8524 · GHSA-2g9q-g8g7-r7xw

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01798 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +3 CWE-787

TI-2019-06101 CVE-2019-8523 · GHSA-8hr6-w86p-r6w9

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.02175 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +3 CWE-787

TI-2019-04449 CVE-2019-6251 · GHSA-w36c-w6x2-gj2r

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing…

MEDIUM 42

WebKitGTK and WPE WebKit prior to version 2.24.1 are vulnerable to address bar spoofing upon certain JavaScript redirections.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.04258 Published 2019-01-14 Partial fix

TI-2019-04435 CVE-2019-6237 · GHSA-9qg5-m58m-vw59

Out-of-bounds write in Apple iOS

MEDIUM 42

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.01963 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06257 CVE-2019-8690 · GHSA-hqph-qgx6-8wvx

Cross-site scripting in Apple iOS

LOW 35

A logic issue existed in the handling of document loads.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.04541 Published 2019-12-18 Partial fix · iOS 12.4, macOS Mojave 10.14.6 +5 CWE-79

TI-2019-09579 CVE-2019-12795 · GHSA-whx7-c8j2-42vv

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and…

LOW 34

daemon/gvfsdaemon.c in gvfsd from GNOME gvfs before 1.38.3, 1.40.x before 1.40.2, and 1.41.x before 1.41.3 opened a private D-Bus server socket without configuring an authorization rule.

CVSS 3.0HIGH 7.8 Local Low privileges No interaction EPSS 0.00388 Published 2019-06-11 Partial fix CWE-276

TI-2019-06190 CVE-2019-8615 · GHSA-c9w6-g4p4-77xq

Out-of-bounds read in Apple iOS

LOW 33

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02058 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-125

TI-2019-06173 CVE-2019-8597 · GHSA-2wrv-mv5p-jx2g

Out-of-bounds write in Apple iOS

LOW 33

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.02058 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-787

TI-2019-06183 CVE-2019-8607 · GHSA-2g22-wxjm-8wg2

Out-of-bounds read in Apple iOS

LOW 32

An out-of-bounds read was addressed with improved input validation.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01645 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +5 CWE-125

TI-2019-06184 CVE-2019-8608 · GHSA-wgc7-wq7g-p4gw

Use after free in Apple iOS

LOW 31

Multiple memory corruption issues were addressed with improved memory handling.

CVSS 3.1MEDIUM 6.3 Network No auth User interaction EPSS 0.01593 Published 2019-12-18 Partial fix · iOS 12.3, macOS Mojave 10.14.5 +4 CWE-416

TI-2019-08278 CVE-2019-11070 · GHSA-jcch-9vxr-f9mg

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP…

LOW 30

WebKitGTK and WPE WebKit prior to version 2.24.1 failed to properly apply configured HTTP proxy settings when downloading livestream video (HLS, DASH, or Smooth Streaming), an error resulting in deanonymization.

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.03294 Published 2019-04-10 Partial fix CWE-19

TI-2019-06128 CVE-2019-8551 · GHSA-cmg5-g4rq-vw3j

Cross-site scripting in Apple iOS

LOW 30

A logic issue was addressed with improved validation.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01276 Published 2019-12-18 Partial fix · iOS 12.2, tvOS 12.2 +3 CWE-79

TI-2019-08554 CVE-2019-11459 · GHSA-3q2g-r99g-8h69

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF…

LOW 28

The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from TIFFReadRGBAImageOriented(), leading to uninitialized memory u…

CVSS 3.1MEDIUM 5.5 Local No auth User interaction EPSS 0.01443 Published 2019-04-22 Partial fix CWE-754

TI-2019-06331 CVE-2019-8768 · GHSA-xc3m-grrh-hxmp

"Clear History and Website Data" did not clear the history.

LOW 27

"Clear History and Website Data" did not clear the history.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01645 Published 2019-12-18 Partial fix · macOS Catalina 10.15 CWE-459

TI-2019-02832 CVE-2019-3820 · GHSA-jh4v-7q79-jf56

Improper authorization in gnome-shell

LOW 21

It was discovered that the gnome-shell lock screen since version 3.15.91 did not properly restrict all contextual actions.

CVSS 3.1MEDIUM 4.3 Physical No auth No interaction EPSS 0.00498 Published 2019-02-06 Fixed CWE-285