CVE-2019-8856: 
macOS vulnerability analysis and mitigation

CVE-2019-8856 is a vulnerability discovered in Apple's CallKit API that affects the handling of outgoing phone calls initiated with Siri. The vulnerability was addressed in iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra, released in December 2019. The vulnerability affected multiple Apple devices including iPhone 6s and later, iPad Air 2 and later, iPad mini 4 and later, iPod touch 7th generation, Apple Watch Series 1 and later, and certain Mac models (Apple iOS, Apple macOS, Apple Watch).

The vulnerability stems from an API issue in the handling of outgoing phone calls initiated with Siri. The technical issue specifically relates to state handling in the CallKit framework. Apple addressed this vulnerability by implementing improved state handling mechanisms (Apple iOS).

The primary impact of this vulnerability was that calls made using Siri could be initiated using the wrong cellular plan on devices with two active plans (Apple iOS, Apple Watch).

Apple released patches for this vulnerability across multiple operating systems: iOS 13.3 and iPadOS 13.3, watchOS 6.1.1, macOS Catalina 10.15.2, Security Update 2019-002 Mojave, and Security Update 2019-007 High Sierra. Users are advised to update their devices to these versions or later to address the vulnerability (Apple iOS, Apple macOS, Apple Watch).