CVE-2019-6201
Multiple memory corruption issues were addressed with improved memory handling. This issue is...
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
CVE-2019-6201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
CVE-2019-6201- Updated
- 2026-11-02
EUVDEUVD-2019-15768 No score
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
EUVD-2019-15768- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fvg7-8gpm-h9v4 No score
Multiple memory corruption issues were addressed with improved memory handling. This issue is...
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
GHSA-fvg7-8gpm-h9v4- Updated
- 2026-11-02
OSV
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
CVE-2019-6201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-6201
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
DEBIAN-CVE-2019-6201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2019-6201
Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.
- Record
UBUNTU-CVE-2019-6201- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1374-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 to version 2.24.1 fixes the following issues:
Security issues fixed:
- CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256).
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1374-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1137-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 to version 2.24.1 fixes the following issues:
Security issues fixed:
- CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8518, CVE-2019-8523, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256).
- Record
SUSE-SU-2019:1137-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1155-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 to version 2.24.1 fixes the following issues:
Security issues fixed:
- CVE-2019-6201, CVE-2019-6251, CVE-2019-7285, CVE-2019-7292, CVE-2019-8503, CVE-2019-8506, CVE-2019-8515, CVE-2019-8524, CVE-2019-8535, CVE-2019-8536, CVE-2019-8544, CVE-2019-8551, CVE-2019-8558, CVE-2019-8559, CVE-2019-8563, CVE-2019-11070 (bsc#1132256).
- Record
SUSE-SU-2019:1155-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkDebian:12 |
before 2.24.1-1 | 2.24.1-1 |
webkit2gtkDebian:13 |
before 2.24.1-1 | 2.24.1-1 |
webkit2gtkDebian:14 |
before 2.24.1-1 | 2.24.1-1 |
webkit2gtk3SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 18 CVEs |
before 2.24.1-3.24.1 | 2.24.1-3.24.1 |
webkit2gtk3SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 18 CVEs |
before 2.24.1-3.24.1 | 2.24.1-3.24.1 |
webkit2gtk3SUSE:OpenStack Cloud 7 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
Show 22 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
webkit2gtk3SUSE:Enterprise Storage 4 From an advisory covering 16 CVEs |
before 2.24.1-2.41.5 | 2.24.1-2.41.5 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
webkit2gtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
webkit2gtkUbuntu:18.04:LTS |
before 2.22.6-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 14 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.12.22.5-0ubuntu0.18.04.1 |
2.22.6-0ubuntu0.18.04.1 |
qtwebkit-opensource-srcUbuntu:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 |
None known |
qtwebkit-sourceUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu13 |
None known |
webkitgtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 |
None known |
qtwebkit-opensource-srcUbuntu:20.04:LTS |
All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 |
None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 |
None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 |
None known |
webkit2gtk3openSUSE:Leap 15.0 From an advisory covering 18 CVEs |
before 2.24.1-lp150.2.19.1 | 2.24.1-lp150.2.19.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-6201 is a high vulnerability (CVSS 8.8) in Apple Icloud, published May 3, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.95%, the 80th percentile. Fixed in webkit2gtk 2.24.1-1.
References
support.apple.com/HT209599
nvd.nist.gov/vuln/detail/CVE-2019-6201
Show 27 moreShow less
github.com/advisories/GHSA-fvg7-8gpm-h9v4
security-tracker.debian.org/tracker/CVE-2019-6201
suse.com/support/update/announcement/2019/suse-su-20191137-1
bugzilla.suse.com/1132256
ubuntu.com/security/CVE-2019-6201
webkitgtk.org/security/WSA-2019-0002.html
cve.org/CVERecord?id=CVE-2019-6201
lists.opensuse.org/archives/list/[email protected]/thread/CGMQTO45E47X7O5HB3O7ZWDQLHRQ7G2Q