CVE-2019-6223

Apple iOS and macOS: Group Facetime

As of , CVE-2019-6223 in Apple iOS and macOS is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 3 November 2021
US federal deadline
3 May 2022181 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.03Higher than 85% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
EPSS when listed
Not availableCISA listed it before 4 February 2022, where the EPSS files we read begin.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
No vendor link in CISA's entry

What CISA says to do

Apply updates per vendor instructions.

CISA's required action

What the flaw is

Apple iOS and macOS Group FaceTime contains an unspecified vulnerability where the call initiator can cause the recipient's Apple device to answer unknowingly or without user interaction.

CISA's description

A logic issue existed in the handling of Group FaceTime calls. The issue was addressed with improved state management. This issue is fixed in iOS 12.1.4, macOS Mojave 10.14.3 Supplemental Update. The initiator of a Group FaceTime call may be able to cause the recipient to answer.

The CVE record's description, from apple

CVE published
5 March 2019
Assigned by
apple
CVSS
7.5 High (CVSS 3.1, from CISA-ADP)
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

iOS and macOS: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2022-32893Out-of-Bounds WriteApple iOS and macOSPatch soon0.10
CVE-2022-22587Memory CorruptionApple iOS and macOSPatch soon0.12
CVE-2022-32894Out-of-Bounds WriteApple iOS and macOSPatch soon0.03

Read further