Every CVE Search/ Get API key

CVE-2019-6215

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12...

8.8 HighPublic exploitFix available

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

9.75%Down 13.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
CVE-2019-6215
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-843
Updated
2026-11-02
CVE List No score

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
CVE-2019-6215
Updated
2026-11-02
EUVDEUVD-2019-15782 No score

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
EUVD-2019-15782
Updated
2026-11-03
GitHub AdvisoriesGHSA-59wc-xc28-qhhh 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12...

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
GHSA-59wc-xc28-qhhh
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-843
Updated
2026-11-02
OSVALPINE-CVE-2019-6215 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
ALPINE-CVE-2019-6215
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
OSV 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
CVE-2019-6215
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2019-6215 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
DEBIAN-CVE-2019-6215
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2019-6215 8.8

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.1.3, tvOS 12.1.2, Safari 12.0.3, iTunes 12.9.3 for Windows, iCloud for Windows 7.10. Processing maliciously crafted web content may lead to arbitrary code execution.

Record
UBUNTU-CVE-2019-6215
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2019:0308-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

  • CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
  • CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
  • CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
  • CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
  • CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
  • CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
  • CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
  • CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
  • CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
  • CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
  • CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

  • Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
  • Fix Web inspector magnifier under Wayland.
  • Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
  • Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

This update was imported from the SUSE:SLE-15:Update update project.

Record
openSUSE-SU-2019:0308-1
Updated
2026-11-02
OSVSUSE-SU-2019:0497-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

  • CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
  • CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
  • CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
  • CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
  • CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
  • CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
  • CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
  • CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
  • CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
  • CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
  • CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
  • CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

  • Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
  • Fix Web inspector magnifier under Wayland.
  • Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
  • Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

Record
SUSE-SU-2019:0497-1
Updated
2026-11-02
OSVSUSE-SU-2019:0511-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues:

Security issues fixed:

  • CVE-2019-6212: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6215: Fixed a type confusion vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6216: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6217: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6226: Fixed multiple memory corruption vulnerabilities which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6227: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6229: Fixed a logic issue by improving validation which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6233: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.
  • CVE-2019-6234: Fixed a memory corruption vulnerability which could allow arbitrary code execution during the processing of special crafted web-content.

Other issues addressed:

  • Update to version 2.22.6 (bsc#1124937).
  • Kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
  • Fixed Web inspector magnifier under Wayland.
  • Fixed garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
  • Fixed several crashes, race conditions, and rendering issues.
Record
SUSE-SU-2019:0511-1
Updated
2026-11-02
OSVUSN-3889-1 No score

webkit2gtk vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Record
USN-3889-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
webkit2gtk
Alpine:v3.10
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.11
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.12
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.13
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.14
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.15
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.16
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.17
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.18
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.19
 before 2.22.7-r0
2.22.7-r0
Show 35 moreShow less
Affected packages
PackageAffectedFixed
webkit2gtk
Alpine:v3.20
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Alpine:v3.9
 before 2.22.7-r0
2.22.7-r0
webkit2gtk
Debian:12
 before 2.22.6-1
2.22.6-1
webkit2gtk
Debian:13
 before 2.22.6-1
2.22.6-1
webkit2gtk
Debian:14
 before 2.22.6-1
2.22.6-1
webkit2gtk3
SUSE:Linux Enterprise Module for Basesystem 15
From an advisory covering 15 CVEs
 before 2.22.6-3.18.2
2.22.6-3.18.2
webkit2gtk3
SUSE:Linux Enterprise Module for Desktop Applications 15
From an advisory covering 15 CVEs
 before 2.22.6-3.18.2
2.22.6-3.18.2
webkit2gtk3
SUSE:OpenStack Cloud 7
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Desktop 12 SP3
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Desktop 12 SP4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server for SAP Applications 12 SP2
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Software Development Kit 12 SP3
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Software Development Kit 12 SP4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP2-LTSS
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP2-BCL
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP3
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server for SAP Applications 12 SP3
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server 12 SP4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Server for SAP Applications 12 SP4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Workstation Extension 12 SP3
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Linux Enterprise Workstation Extension 12 SP4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
webkit2gtk3
SUSE:Enterprise Storage 4
From an advisory covering 9 CVEs
 before 2.22.6-2.35.1
2.22.6-2.35.1
qtwebkit-opensource-src
Ubuntu:16.04:LTS
 All versions, plus listed versions
5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1
 None known
webkit2gtk
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1
Show 21 moreShow less
2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1
 None known
qtwebkit-source
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.3.2-0ubuntu102.3.2-0ubuntu11
 None known
webkitgtk
Ubuntu:16.04:LTS
 All versions, plus listed versions
2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1
 None known
webkit2gtk
Ubuntu:18.04:LTS
 before 2.22.6-0ubuntu0.18.04.1, plus listed versions
2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1
Show 14 moreShow less
2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.1
2.22.6-0ubuntu0.18.04.1
qtwebkit-opensource-src
Ubuntu:18.04:LTS
 All versions, plus listed versions
5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1
 None known
qtwebkit-source
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.3.2-0ubuntu13
 None known
webkitgtk
Ubuntu:18.04:LTS
 All versions, plus listed versions
2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3
 None known
qtwebkit-opensource-src
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1
 None known
qtwebkit-opensource-src
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1
 None known
qtwebkit-opensource-src
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36
 None known
webkit2gtk
Ubuntu:18.04:LTS
From an advisory covering 2 CVEs
 before 2.22.6-0ubuntu0.18.04.1, plus listed versions
2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1
Show 14 moreShow less
2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.1
2.22.6-0ubuntu0.18.04.1
webkit2gtk3
openSUSE:Leap 15.0
From an advisory covering 15 CVEs
 before 2.22.6-lp150.2.12.1
2.22.6-lp150.2.12.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
Exploit-DBWebKit JSC - reifyStaticProperty Needs to set the PropertyAttribute::CustomAccessor flag for CustomGetterSetter2019-02-22

History

History
RecordedChangedSources
affected, facts
affected, aliases, referencesOSV
aliases, productsEUVD
first indexedCVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-6215 is a high vulnerability (CVSS 8.8) in Apple Icloud, published February 11, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.75%, the 95th percentile. Fixed in webkit2gtk 2.22.7-r0.

References

Show 37 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open