nvd-json-data-feeds/CVE-2019/CVE-2019-88xx/CVE-2019-8801.json

{
  "id": "CVE-2019-8801",
  "sourceIdentifier": "product-security@apple.com",
  "published": "2019-12-18T18:15:42.663",
  "lastModified": "2019-12-30T21:20:37.127",
  "vulnStatus": "Analyzed",
  "descriptions": [
    {
      "lang": "en",
      "value": "A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching. This issue is fixed in macOS Catalina 10.15.1, iTunes for Windows 12.10.2. Running the iTunes installer in an untrusted directory may result in arbitrary code execution."
    },
    {
      "lang": "es",
      "value": "Un problema de carga din\u00e1mica de la biblioteca exist\u00eda en la configuraci\u00f3n de iTunes. Esto fue abordado con una mejor b\u00fasqueda de ruta. Este problema es corregido en macOS Catalina versi\u00f3n 10.15.1, iTunes para Windows versi\u00f3n 12.10.2. Ejecutar el instalador de iTunes en un directorio no confiable puede resultar en una ejecuci\u00f3n de c\u00f3digo arbitrario."
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "attackVector": "LOCAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
          "accessVector": "LOCAL",
          "accessComplexity": "MEDIUM",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.4
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 3.4,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-426"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*",
              "versionEndExcluding": "12.10.2",
              "matchCriteriaId": "4A70FE53-CD3F-4296-B209-64C6F24CE3A7"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*",
              "versionEndExcluding": "10.15.1",
              "matchCriteriaId": "E773457A-E670-4DDA-86E2-0923C1DCD9BA"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://support.apple.com/HT210722",
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ]
    },
    {
      "url": "https://support.apple.com/HT210726",
      "source": "product-security@apple.com",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}