VARIoT IoT vulnerabilities database
| VAR-201904-1365 | CVE-2018-4304 | plural Apple Updates to product vulnerabilities |
CVSS V2: 4.3 CVSS V3: 5.0 Severity: MEDIUM |
A denial of service issue was addressed with improved validation. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: Detail is Apple See the information provided by. * HTTP Through the client AFP Server attack * Arbitrary code execution * information leak * Buffer overflow * Privilege escalation * Service operation interruption (DoS) * File system tampering * UI Spoofing * Limit avoidance * Cross-site scripting * Address bar impersonation. plural Apple The product has inadequate processing related to verification, so it interferes with service operation. (DoS) Vulnerabilities exist.Service operation interruption (DoS) There is a possibility of being put into a state. Apple macOS Sierra is a dedicated operating system developed by Apple for Mac computers. macOS High Sierra is its next generation. Foundation is a framework that provides basic system services for all applications. An attacker could use a malicious text file to exploit this vulnerability to cause a denial of service. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-2 macOS Mojave 10.14.1, Security Update 2018-001
High Sierra, Security Update 2018-005 Sierra
macOS Mojave 10.14.1, Security Update 2018-001 High Sierra, and
Security Update 2018-005 Sierra are now available and address
the following:
afpserver
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4415: Liang Zhuo working with Beyond Security's SecuriTeam
Secure Disclosure
CoreCrypto
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An attacker may be able to exploit a weakness in the
Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime
numbers.
CVE-2018-4423: an anonymous researcher
EFI
Available for: macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and speculative execution of memory reads before the addresses of all
prior memory writes are known may allow unauthorized disclosure of
information to an attacker with local user access via a side-channel
analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that older data read from
recently-written-to addresses cannot be read via a speculative
side-channel.
CVE-2018-4331: Brandon Azad
Hypervisor
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and address translations may allow unauthorized disclosure of
information residing in the L1 data cache to an attacker with local
user access with guest OS privilege via a terminal page fault and a
side-channel analysis
Description: An information disclosure issue was addressed by
flushing the L1 data cache at the virtual machine entry.
CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas
F.
CVE-2018-4424: Dr.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Microcode
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Systems with microprocessors utilizing speculative execution
and that perform speculative reads of system registers may allow
unauthorized disclosure of system parameters to an attacker with
local user access via a side-channel analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that implementation specific system
registers cannot be leaked via a speculative execution side-channel.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile
Networking Lab at Technische UniversitA$?t Darmstadt
Additional recognition
Calendar
We would like to acknowledge an anonymous researcher for their
assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-9 Additional information for
APPLE-SA-2018-9-24-1 macOS Mojave 10.14
macOS Mojave 10.14 addresses the following:
Bluetooth
Available for: iMac (21.5-inch, Late 2012), iMac (27-inch, Late 2012)
, iMac (21.5-inch, Late 2013), iMac (21.5-inch, Mid 2014), iMac
(Retina 5K, 27-inch, Late 2014), iMac (21.5-inch, Late 2015),
Mac mini (Mid 2011), Mac mini Server (Mid 2011), Mac mini (Late 2012)
, Mac mini Server (Late 2012), Mac mini (Late 2014), Mac Pro
(Late 2013), MacBook Air (11-inch, Mid 2011), MacBook Air
(13-inch, Mid 2011), MacBook Air (11-inch, Mid 2012), MacBook Air
(13-inch, Mid 2012), MacBook Air (11-inch, Mid 2013), MacBook Air
(13-inch, Mid 2013), MacBook Air (11-inch, Early 2015), MacBook Air
(13-inch, Early 2015), MacBook Pro (13-inch, Mid 2012), MacBook Pro
(15-inch, Mid 2012), MacBook Pro (Retina, 13-inch, Early 2013),
MacBook Pro (Retina, 15-inch, Early 2013), MacBook Pro (Retina,
13-inch, Late 2013), and MacBook Pro (Retina, 15-inch, Late 2013)
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
The updates below are available for these Mac models:
MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later),
MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later),
iMac (Late 2012 and later), iMac Pro (all models), Mac Pro
(Late 2013, Mid 2010, and Mid 2012 models with recommended
Metal-capable graphics processor, including MSI Gaming Radeon RX 560
and Sapphire Radeon PULSE RX 580)
afpserver
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4324: Sergii Kryvoblotskyi of MacPaw Inc.
CVE-2018-4353: Abhinav Bansal of LinkedIn Inc.
Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
| VAR-201904-0748 | CVE-2018-4203 | plural Apple Updates to product vulnerabilities |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
An out-of-bounds read was addressed with improved bounds checking. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: Detail is Apple See the information provided by. * HTTP Through the client AFP Server attack * Arbitrary code execution * information leak * Buffer overflow * Privilege escalation * Service operation interruption (DoS) * File system tampering * UI Spoofing * Limit avoidance * Cross-site scripting * Address bar impersonation. plural Apple The product has a flaw in reading outside the boundary due to flaws in processing related to the boundary check.Information may be obtained. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the usymptomsd service. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code within the context of the symptomsd process. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. Symptom Framework is one of the Symptom framework components. A buffer error vulnerability exists in the Symptom Framework component in several Apple products. An attacker can exploit this vulnerability to read restricted memory. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-2 macOS Mojave 10.14.1, Security Update 2018-001
High Sierra, Security Update 2018-005 Sierra
macOS Mojave 10.14.1, Security Update 2018-001 High Sierra, and
Security Update 2018-005 Sierra are now available and address
the following:
afpserver
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4415: Liang Zhuo working with Beyond Security's SecuriTeam
Secure Disclosure
CoreCrypto
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An attacker may be able to exploit a weakness in the
Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime
numbers.
CVE-2018-4423: an anonymous researcher
EFI
Available for: macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and speculative execution of memory reads before the addresses of all
prior memory writes are known may allow unauthorized disclosure of
information to an attacker with local user access via a side-channel
analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that older data read from
recently-written-to addresses cannot be read via a speculative
side-channel.
CVE-2018-4331: Brandon Azad
Hypervisor
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and address translations may allow unauthorized disclosure of
information residing in the L1 data cache to an attacker with local
user access with guest OS privilege via a terminal page fault and a
side-channel analysis
Description: An information disclosure issue was addressed by
flushing the L1 data cache at the virtual machine entry.
CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas
F.
CVE-2018-4424: Dr.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Microcode
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Systems with microprocessors utilizing speculative execution
and that perform speculative reads of system registers may allow
unauthorized disclosure of system parameters to an attacker with
local user access via a side-channel analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that implementation specific system
registers cannot be leaked via a speculative execution side-channel.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile
Networking Lab at Technische UniversitA$?t Darmstadt
Additional recognition
Calendar
We would like to acknowledge an anonymous researcher for their
assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-9 Additional information for
APPLE-SA-2018-9-24-1 macOS Mojave 10.14
macOS Mojave 10.14 addresses the following:
Bluetooth
Available for: iMac (21.5-inch, Late 2012), iMac (27-inch, Late 2012)
, iMac (21.5-inch, Late 2013), iMac (21.5-inch, Mid 2014), iMac
(Retina 5K, 27-inch, Late 2014), iMac (21.5-inch, Late 2015),
Mac mini (Mid 2011), Mac mini Server (Mid 2011), Mac mini (Late 2012)
, Mac mini Server (Late 2012), Mac mini (Late 2014), Mac Pro
(Late 2013), MacBook Air (11-inch, Mid 2011), MacBook Air
(13-inch, Mid 2011), MacBook Air (11-inch, Mid 2012), MacBook Air
(13-inch, Mid 2012), MacBook Air (11-inch, Mid 2013), MacBook Air
(13-inch, Mid 2013), MacBook Air (11-inch, Early 2015), MacBook Air
(13-inch, Early 2015), MacBook Pro (13-inch, Mid 2012), MacBook Pro
(15-inch, Mid 2012), MacBook Pro (Retina, 13-inch, Early 2013),
MacBook Pro (Retina, 15-inch, Early 2013), MacBook Pro (Retina,
13-inch, Late 2013), and MacBook Pro (Retina, 15-inch, Late 2013)
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
The updates below are available for these Mac models:
MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later),
MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later),
iMac (Late 2012 and later), iMac Pro (all models), Mac Pro
(Late 2013, Mid 2010, and Mid 2012 models with recommended
Metal-capable graphics processor, including MSI Gaming Radeon RX 560
and Sapphire Radeon PULSE RX 580)
afpserver
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4324: Sergii Kryvoblotskyi of MacPaw Inc.
CVE-2018-4353: Abhinav Bansal of LinkedIn Inc.
Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains. The issue was addressed with improved data deletion.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
| VAR-201904-0756 | CVE-2018-4126 | Apple macOS nsurlstoraged Out-Of-Bounds Read Information Disclosure Vulnerability |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: LOW |
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, macOS Mojave 10.14, tvOS 12, watchOS 5, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple From macOS An update for has been released.The potential impact depends on each vulnerability, but may be affected as follows: * Arbitrary code execution * information leak * Access restriction bypass. This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.The specific flaw exists within the handling of cookie data. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of the current user. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. Apple macOS Mojave is a dedicated operating system developed for Mac computers. CFNetwork is one of the low-level, high-performance frameworks, which is an extension of BSD sockets (sockets). A buffer error vulnerability exists in the CFNetwork component of several Apple products. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-2 macOS Mojave 10.14.1, Security Update 2018-001
High Sierra, Security Update 2018-005 Sierra
macOS Mojave 10.14.1, Security Update 2018-001 High Sierra, and
Security Update 2018-005 Sierra are now available and address
the following:
afpserver
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: A remote attacker may be able to attack AFP servers through
HTTP clients
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4415: Liang Zhuo working with Beyond Security's SecuriTeam
Secure Disclosure
CoreCrypto
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: An attacker may be able to exploit a weakness in the
Miller-Rabin primality test to incorrectly identify prime numbers
Description: An issue existed in the method for determining prime
numbers.
CVE-2018-4423: an anonymous researcher
EFI
Available for: macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and speculative execution of memory reads before the addresses of all
prior memory writes are known may allow unauthorized disclosure of
information to an attacker with local user access via a side-channel
analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that older data read from
recently-written-to addresses cannot be read via a speculative
side-channel.
CVE-2018-4331: Brandon Azad
Hypervisor
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6
Impact: Systems with microprocessors utilizing speculative execution
and address translations may allow unauthorized disclosure of
information residing in the L1 data cache to an attacker with local
user access with guest OS privilege via a terminal page fault and a
side-channel analysis
Description: An information disclosure issue was addressed by
flushing the L1 data cache at the virtual machine entry.
CVE-2018-3646: Baris Kasikci, Daniel Genkin, Ofir Weisse, and Thomas
F.
CVE-2018-4424: Dr.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Microcode
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Systems with microprocessors utilizing speculative execution
and that perform speculative reads of system registers may allow
unauthorized disclosure of system parameters to an attacker with
local user access via a side-channel analysis
Description: An information disclosure issue was addressed with a
microcode update. This ensures that implementation specific system
registers cannot be leaked via a speculative execution side-channel.
CVE-2018-4400: Yukinobu Nagayasu of LAC Co., Ltd.
CVE-2018-4368: Milan Stute and Alex Mariotto of Secure Mobile
Networking Lab at Technische UniversitA$?t Darmstadt
Additional recognition
Calendar
We would like to acknowledge an anonymous researcher for their
assistance.
Alternatively, on your watch, select "My Watch > General > About". -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
| VAR-201904-1473 | CVE-2018-4359 | plural Apple Memory corruption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A buffer error vulnerability exists in the WebKit component of several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Impact
======
A remote attacker could execute arbitrary commands or cause a Denial of
Service condition via maliciously crafted web content.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, and Zach Malone of CA Technologies for their assistance. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-10 Additional information for
APPLE-SA-2018-9-24-5 watchOS 5
watchOS 5 addresses the following:
CFNetwork
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreText
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Grand Central Dispatch
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
IOHIDFamily
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOUserEthernet
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel. This
issue was addressed with improved input validation.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Security
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Symptom Framework
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: Apple Watch Series 1 and later
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
WebKit
Available for: Apple Watch Series 1 and later
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
WebKit
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgUpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GbihAA
rJrGRlOECVnj/z6kzobQ6SjqeXQanrEJKOEbP12pOEgOcqhJd/CsRIGMGxtG8cRC
H60/qGsVtDXhqmGZQl2cBaMeg+bagLvSaRUC6urXqYLIKoGay7zsbQyWS4hAbyNu
Gpu0k5bvb2tr3IZIfqHfUcScxpsB3zJiYejtgLow2MDbkt84qNqx73xYbOIXDJoc
kfyNhb/RKqiXOi5Yvh+E84GARjUSGUFD5fMbIMu7Lf0cwGpL3XakKG8S+8L0W3/W
vGsl7V8DWeH6qbVoMkLUxWGxWzCd4bUr88J0cybski3L4SvpYbDPMMKxQkyn4Rfq
qSDG3RMS0MUeoGn/iwRcJ8p6gPMGjWTT+lvX0XaZzG3b/mkOw8C2jRs1Ds8vUbRB
Pxn1AQvg0x+EW/HIKqrvbE6i5pLjhurHYChy9tI9AS2iSHsAnrSB8DV8mc4T4v6a
zJqJO5qPPCVJ9K328l+FyXe+X5erQP4/dwol71VjweA/peSJCL34/YL3oSs9e41R
ApabYVIphnq0Ion5gVNancPhgQEbkIjMncFiGRg4wF0jly2Ni+NsnDquTKEM3VvG
mOlo0VVw3XxLhtiQF/RKbQSy+6dK0YGykIsmnz/DsstxS4xRiWbk75XErA/nSwPs
fHAicxI2AmpI+PbdYcPI4D3eJr/1ZDH8NvY1897WX5c=
=fz+z
-----END PGP SIGNATURE-----
.
CVE-2018-4329: Hugo S.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-1475 | CVE-2018-4361 | plural Apple Memory consumption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A memory consumption issue was addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple The product has a memory consumption vulnerability due to flaws in memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A resource management error vulnerability exists in the WebKit component of several Apple products. An attacker could exploit this vulnerability to cause an assertion failure (memory consumption). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-10 Additional information for
APPLE-SA-2018-9-24-5 watchOS 5
watchOS 5 addresses the following:
CFNetwork
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: Apple Watch Series 1 and later
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreText
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Grand Central Dispatch
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
IOHIDFamily
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOUserEthernet
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple Watch Series 1 and later
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Kernel
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: Apple Watch Series 1 and later
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Safari
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Security
Available for: Apple Watch Series 1 and later
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: Apple Watch Series 1 and later
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Symptom Framework
Available for: Apple Watch Series 1 and later
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: Apple Watch Series 1 and later
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: Apple Watch Series 1 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Installation note:
Instructions on how to update your Apple Watch software are
available at https://support.apple.com/kb/HT204641
To check the version on your Apple Watch, open the Apple Watch app
on your iPhone and select "My Watch > General > About".
Alternatively, on your watch, select "My Watch > General > About".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgUpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3GbihAA
rJrGRlOECVnj/z6kzobQ6SjqeXQanrEJKOEbP12pOEgOcqhJd/CsRIGMGxtG8cRC
H60/qGsVtDXhqmGZQl2cBaMeg+bagLvSaRUC6urXqYLIKoGay7zsbQyWS4hAbyNu
Gpu0k5bvb2tr3IZIfqHfUcScxpsB3zJiYejtgLow2MDbkt84qNqx73xYbOIXDJoc
kfyNhb/RKqiXOi5Yvh+E84GARjUSGUFD5fMbIMu7Lf0cwGpL3XakKG8S+8L0W3/W
vGsl7V8DWeH6qbVoMkLUxWGxWzCd4bUr88J0cybski3L4SvpYbDPMMKxQkyn4Rfq
qSDG3RMS0MUeoGn/iwRcJ8p6gPMGjWTT+lvX0XaZzG3b/mkOw8C2jRs1Ds8vUbRB
Pxn1AQvg0x+EW/HIKqrvbE6i5pLjhurHYChy9tI9AS2iSHsAnrSB8DV8mc4T4v6a
zJqJO5qPPCVJ9K328l+FyXe+X5erQP4/dwol71VjweA/peSJCL34/YL3oSs9e41R
ApabYVIphnq0Ion5gVNancPhgQEbkIjMncFiGRg4wF0jly2Ni+NsnDquTKEM3VvG
mOlo0VVw3XxLhtiQF/RKbQSy+6dK0YGykIsmnz/DsstxS4xRiWbk75XErA/nSwPs
fHAicxI2AmpI+PbdYcPI4D3eJr/1ZDH8NvY1897WX5c=
=fz+z
-----END PGP SIGNATURE-----
.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Visiting a malicious website by clicking a link may lead to
user interface spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
The issue was addressed by removing origin information.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1406 | CVE-2018-4314 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple There is a vulnerability in the use of freed memory due to a lack of memory management in the product.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. tvOS is a smart TV operating system. Safari is a web browser developed as the default browser included with MacOSX and iOS operating systems. WebKit is one of the web browser engine components. A use-after-free vulnerability exists in WebKit components in several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1404 | CVE-2018-4312 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A use-after-free vulnerability exists in WebKit components in several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1407 | CVE-2018-4315 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple There is a vulnerability in the use of freed memory due to a lack of memory management in the product.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. tvOS is a smart TV operating system. Safari is a web browser developed as the default browser included with MacOSX and iOS operating systems. WebKit is one of the web browser engine components. A use-after-free vulnerability exists in WebKit components in several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Impact
======
A remote attacker could execute arbitrary commands or cause a Denial of
Service condition via maliciously crafted web content.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-1460 | CVE-2018-4345 | plural Apple Product cross-site scripting vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
A cross-site scripting issue existed in Safari. This issue was addressed with improved URL validation. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple The product includes URL A cross-site scripting vulnerability exists due to a lack of validation processing.Information may be obtained and information may be altered. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A remote attacker could exploit this vulnerability via a specially crafted website to steal cross-origin image data. ==========================================================================
Ubuntu Security Notice USN-3828-1
November 27, 2018
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.10
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in WebKitGTK+.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines. If a user were tricked into viewing a malicious
website, a remote attacker could exploit a variety of issues related to web
browser security, including cross-site scripting attacks, denial of service
attacks, and arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.10:
libjavascriptcoregtk-4.0-18 2.22.4-0ubuntu0.18.10.1
libwebkit2gtk-4.0-37 2.22.4-0ubuntu0.18.10.1
Ubuntu 18.04 LTS:
libjavascriptcoregtk-4.0-18 2.22.4-0ubuntu0.18.04.1
libwebkit2gtk-4.0-37 2.22.4-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3828-1
CVE-2018-4345, CVE-2018-4372, CVE-2018-4386
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.22.4-0ubuntu0.18.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.22.4-0ubuntu0.18.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-6 Additional information for
APPLE-SA-2018-9-17-3 tvOS 12
tvOS 12 addresses the following:
Auto Unlock
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Entry added September 24, 2018
Bluetooth
Available for: Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
iTunes Store
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Entry added September 24, 2018
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Safari
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu
of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi - Ankara/TA1/4rkiye,
Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l University, Metin Altug
Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western
Governor's University (WGU)
Security
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Entry added September 24, 2018
Additional recognition
Assets
We would like to acknowledge Brandon Azad for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, and Zach Malone of CA Technologies for their assistance.
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."
To check the current version of software, select
"Settings -> General -> About."
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUMACgkQeC9tht7T
K3H35Q//UwJyTZpRVx33z/T3GxYfFX9dxg2fwdkVFxCGWR/yGCL/pMwNH/UwerQH
qcdzG3VopySXXJy/goEJD+w+f8QNtueysfE7+MrYvogVD1OVALDc0xaZvudKmSoo
d0APBDtlkkLn4evwwpIYfl6Ikje/j40ZOfzSZ8+9hsoq6b+tkhSo8UC+hphUBi4L
lMshXi5OmekimBWgGdPGN77UQoFAJriMQHLppQ4x46qHuiMSAKHeCz+AdL4Xk1dh
fzdbizI4p7CssUzJHOPU61NPB28AoPsVJ8yEQpKDvHcnkPxtgtAzoIBWl0MwUCXg
OaT+8poN/HsMVJYtM2vi322IJGfMtcWtU/TJ1TbhAih6Bal2paIEj4zBirEXc9sF
dQyWB+EB8h+g4MtXyo6ax7OyO3UmRsISyCQhCNKWhXjTt4/9Q6xMbGxfW6X7EtHN
mgM/74rqkM53Tfy3kqywBDi90v4aNMUGdbYcK3YJldayW++K2J6OtxZZmflfYkbU
GTnAaEFIa0dLX/e+uqGRtz2F0K8mr9/9VwiwrH3et2FALvU6RyFLX7jqnKFyGpUp
LdXH6Mz6xBYS7Rg2vKVjUsHXlutpknmDxyx8Orirgb2gNHN97w8GDCnmOAd2euoL
HZdlwhs4SLaLqyNegbG3y3MD7gK8oRTZx3tXeJRmYV6UGp+d9QI=
=pj7d
-----END PGP SIGNATURE-----
.
CVE-2018-4329: Hugo S.
CVE-2018-4195: xisigr of Tencent's Xuanwu Lab (www.tencent.com)
Security
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-1414 | CVE-2018-4323 | plural Apple Memory corruption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A buffer error vulnerability exists in the WebKit component of several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore. This issue was addressed with improved checks.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
This issue was addressed with improved URL validation.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
The issue was addressed by removing origin information.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements. This was addressed
with improved tracking of security origins.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1411 | CVE-2018-4319 | plural Apple Product iframe Cross-origin vulnerability in elements |
CVSS V2: 5.8 CVSS V3: 8.1 Severity: HIGH |
A cross-origin issue existed with "iframe" elements. This was addressed with improved tracking of security origins. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple Product iframe The element has a flaw in cross-origin because it lacks security origin tracking.Information may be obtained and information may be altered. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A security feature vulnerability exists in the WebKit component of several Apple products. An attacker could exploit this vulnerability to bypass security restrictions. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1398 | CVE-2018-4306 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple There is a vulnerability in the use of freed memory due to a lack of memory management in the product.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A use-after-free vulnerability exists in WebKit components in several Apple products.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-4 Additional information for
APPLE-SA-2018-9-17-1 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Entry added September 24, 2018
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Entry added September 24, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Entry added September 24, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu
of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi - Ankara/TA1/4rkiye,
Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l University, Metin Altug
Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western
Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: an anonymous researcher
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu
of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi - Ankara/TA1/4rkiye,
Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l University, Metin Altug
Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western
Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4319: John Pettitt of Google
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
Entry added September 24, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Entry added September 24, 2018
Wi-Fi
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket
Internet SE, Gunnar Diepenbruck, and Zbyszek A>>A3Akiewski for their
assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUMACgkQeC9tht7T
K3Gpbg/9HBJDw9agGt5ZwLBzc5njAETI5Hxk0LDn5PjvmXpxD0kB/GcuH5vODNfi
TOUNox5KfIIaD0HB1qo5zq4zdh1VmnCNKALJK0wY0U3KaACRghu0xTjpbXsYcYQy
4aGdt+UuiPBqsMkSUrakba1JHcYWrpc4GfUaxIUZw+aFdA0G2oUOYAN5w3a3I01A
aVY1Qzq93MdUCjdr3ASXn4gdMtZeYAze4dXCkmvOXS8CPG4xok2C/MdwaTRKh1ex
S74YkM+Oz+mAG+3uebwexeHWLUbFHKBr4KXu2DFvpJ4JxNu57SOqwEDDfauVOCHb
13YFf+i+Zh5g9SODQJFXDXk6Cl6MlTuEsLcr1YX8xqmSLilaFJTiz7nxxAG0Qctb
Z80wHbzQeGaGQwEy1A99X7X33PupzyaJFiK/4F8O5neo18LliunU01Tzk16sgYFt
4Jg/e5+EkcGf1TJiCTMzIPDVsMBDRcTV9KMBUjr+LmbBJ5T8XKdg5nuEURKT3QFQ
h05+La/AFn+sJ8FFTK0WQmvM96vKQELyBBC9Npa7n1riCPHldPt9+vQ3wVwo5MD4
SdGfACevV+Qf8G1A064fM74nrJOnoqLowQiCtMSOpMx3PWwX0Pzw2SVyaFG3cLAv
221+OCYYcniG7UPdjoFv7kObGFEUC9vt1TS76VfolzKWd/fcakg=
=JOUe
-----END PGP SIGNATURE-----
. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1409 | CVE-2018-4317 | Multiple Apple product WebKit Security hole |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A use-after-free vulnerability exists in WebKit components in several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. ==========================================================================
Ubuntu Security Notice USN-3781-1
October 03, 2018
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in WebKitGTK+.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libjavascriptcoregtk-4.0-18 2.22.2-0ubuntu0.18.04.1
libwebkit2gtk-4.0-37 2.22.2-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3781-1
CVE-2018-4191, CVE-2018-4197, CVE-2018-4207, CVE-2018-4208,
CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316,
CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323,
CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.22.2-0ubuntu0.18.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1403 | CVE-2018-4311 | plural Apple Information disclosure vulnerability in products |
CVSS V2: 5.8 CVSS V3: 8.1 Severity: HIGH |
The issue was addressed by removing origin information. This issue affected versions prior to iOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple There is a vulnerability related to information disclosure because the product does not properly handle origin information.Information may be obtained and information may be altered. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. An attacker could exploit this vulnerability to determine the source of an access frame. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution. A memory corruption issue was addressed with
improved state management.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution. Multiple memory corruption issues were addressed
with improved memory handling.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. A memory corruption
issue was addressed with improved memory handling.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1419 | CVE-2018-4328 | plural Apple Memory corruption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple The product has a memory corruption vulnerability due to incomplete memory handling.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. tvOS is a smart TV operating system. Safari is a web browser developed as the default browser included with MacOSX and iOS operating systems. WebKit is one of the web browser engine components. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. ==========================================================================
Ubuntu Security Notice USN-3781-1
October 03, 2018
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
Several security issues were fixed in WebKitGTK+.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
A large number of security issues were discovered in the WebKitGTK+ Web and
JavaScript engines.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
libjavascriptcoregtk-4.0-18 2.22.2-0ubuntu0.18.04.1
libwebkit2gtk-4.0-37 2.22.2-0ubuntu0.18.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK+, such as Epiphany, to make all the necessary changes.
References:
https://usn.ubuntu.com/usn/usn-3781-1
CVE-2018-4191, CVE-2018-4197, CVE-2018-4207, CVE-2018-4208,
CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316,
CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323,
CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.22.2-0ubuntu0.18.04.1
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-6 Additional information for
APPLE-SA-2018-9-17-3 tvOS 12
tvOS 12 addresses the following:
Auto Unlock
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Entry added September 24, 2018
Bluetooth
Available for: Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
iTunes Store
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Entry added September 24, 2018
Kernel
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Safari
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert Ulu
of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi - Ankara/TA1/4rkiye,
Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l University, Metin Altug
Karakaya of Kaliptus Medical Organization, Vinodh Swami of Western
Governor's University (WGU)
Security
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2018-4345: an anonymous researcher
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
Entry added September 24, 2018
WebKit
Available for: Apple TV 4K and Apple TV (4th generation)
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by Google OSS-Fuzz
Entry added September 24, 2018
Additional recognition
Assets
We would like to acknowledge Brandon Azad for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, and Zach Malone of CA Technologies for their assistance.
Installation note:
Apple TV will periodically check for software updates. Alternatively,
you may manually check for software updates by selecting
"Settings -> System -> Software Update -> Update Software."
To check the current version of software, select
"Settings -> General -> About."
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUMACgkQeC9tht7T
K3H35Q//UwJyTZpRVx33z/T3GxYfFX9dxg2fwdkVFxCGWR/yGCL/pMwNH/UwerQH
qcdzG3VopySXXJy/goEJD+w+f8QNtueysfE7+MrYvogVD1OVALDc0xaZvudKmSoo
d0APBDtlkkLn4evwwpIYfl6Ikje/j40ZOfzSZ8+9hsoq6b+tkhSo8UC+hphUBi4L
lMshXi5OmekimBWgGdPGN77UQoFAJriMQHLppQ4x46qHuiMSAKHeCz+AdL4Xk1dh
fzdbizI4p7CssUzJHOPU61NPB28AoPsVJ8yEQpKDvHcnkPxtgtAzoIBWl0MwUCXg
OaT+8poN/HsMVJYtM2vi322IJGfMtcWtU/TJ1TbhAih6Bal2paIEj4zBirEXc9sF
dQyWB+EB8h+g4MtXyo6ax7OyO3UmRsISyCQhCNKWhXjTt4/9Q6xMbGxfW6X7EtHN
mgM/74rqkM53Tfy3kqywBDi90v4aNMUGdbYcK3YJldayW++K2J6OtxZZmflfYkbU
GTnAaEFIa0dLX/e+uqGRtz2F0K8mr9/9VwiwrH3et2FALvU6RyFLX7jqnKFyGpUp
LdXH6Mz6xBYS7Rg2vKVjUsHXlutpknmDxyx8Orirgb2gNHN97w8GDCnmOAd2euoL
HZdlwhs4SLaLqyNegbG3y3MD7gK8oRTZx3tXeJRmYV6UGp+d9QI=
=pj7d
-----END PGP SIGNATURE-----
.
CVE-2018-4329: Hugo S.
CVE-2018-4195: xisigr of Tencent's Xuanwu Lab (www.tencent.com)
Security
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore. This issue was addressed with improved checks.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure. This issue was
addressed with improved checks.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
This issue was addressed with improved URL validation.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
The issue was addressed by removing origin information.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements. This was addressed
with improved tracking of security origins.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1408 | CVE-2018-4316 | plural Apple Memory corruption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that comes with the default browser on MacOSX and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A security vulnerability exists in the WebKit component of several Apple products. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-0753 | CVE-2018-4191 | plural Apple Memory corruption vulnerability in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A memory corruption issue was addressed with improved validation. This issue affected versions prior to iOS 12, tvOS 12, watchOS 5, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple iOS, etc. are all products of Apple (Apple). Apple iOS is an operating system developed for mobile devices. tvOS is a smart TV operating system. Safari is a web browser developed as the default browser included with MacOSX and iOS operating systems. WebKit is one of the web browser engine components. A security vulnerability exists in the WebKit component of several Apple products. An attacker could exploit this vulnerability to cause an assertion failure (memory corruption). - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Impact
======
A remote attacker could execute arbitrary commands or cause a Denial of
Service condition via maliciously crafted web content.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-0755 | CVE-2018-4197 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. plural Apple There is a vulnerability in the use of freed memory due to a lack of memory management in the product.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A resource management error vulnerability exists in the WebKit component of several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store. -----------------------------------------------------------------------
WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0007
------------------------------------------------------------------------
Date reported : September 26, 2018
Advisory ID : WSA-2018-0007
WebKitGTK+ Advisory URL :
https://webkitgtk.org/security/WSA-2018-0007.html
WPE WebKit Advisory URL :
https://wpewebkit.org/security/WSA-2018-0007.html
CVE identifiers : CVE-2018-4207, CVE-2018-4208, CVE-2018-4209,
CVE-2018-4210, CVE-2018-4212, CVE-2018-4213,
CVE-2018-4191, CVE-2018-4197, CVE-2018-4299,
CVE-2018-4306, CVE-2018-4309, CVE-2018-4311,
CVE-2018-4312, CVE-2018-4314, CVE-2018-4315,
CVE-2018-4316, CVE-2018-4317, CVE-2018-4318,
CVE-2018-4319, CVE-2018-4323, CVE-2018-4328,
CVE-2018-4358, CVE-2018-4359, CVE-2018-4361.
Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit.
CVE-2018-4207
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4208
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4209
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4210
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction with indexing types caused a failure. An
array indexing issue existed in the handling of a function in
JavaScriptCore.
CVE-2018-4212
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4213
Versions affected: WebKitGTK+ before 2.20.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4191
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
CVE-2018-4197
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4299
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroI2 (saelo) working with Trend Micro's Zero Day
Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4306
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4309
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to an anonymous researcher working with Trend Micro's Zero
Day Initiative.
A malicious website may be able to execute scripts in the context of
another website. A cross-site scripting issue existed in WebKit.
CVE-2018-4311
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Erling Alf Ellingsen (@steike).
Cross-origin SecurityErrors includes the accessed frameas origin.
CVE-2018-4312
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4314
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4315
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4316
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4317
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4318
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4319
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to John Pettitt of Google.
A malicious website may cause unexepected cross-origin behavior. A
cross-origin issue existed with iframe elements.
CVE-2018-4323
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4328
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Ivan Fratric of Google Project Zero.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4358
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative.
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4359
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Samuel GroA (@5aelo).
Processing maliciously crafted web content may lead to arbitrary
code execution.
CVE-2018-4361
Versions affected: WebKitGTK+ and WPE WebKit before 2.22.0.
Credit to Google OSS-Fuzz.
Unexpected interaction causes an ASSERT failure.
We recommend updating to the latest stable versions of WebKitGTK+ and
WPE WebKit. It is the best way to ensure that you are running safe
versions of WebKit. Please check our websites for information about the
latest stable releases.
Further information about WebKitGTK+ and WPE WebKit security advisories
can be found at: https://webkitgtk.org/security.html or
https://wpewebkit.org/security/.
The WebKitGTK+ and WPE WebKit team,
September 26, 2018
| VAR-201904-1410 | CVE-2018-4318 | plural Apple Vulnerability in using freed memory in products |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Service operation interruption (DoS) * Arbitrary code execution * Script execution * information leak * Access restriction avoidance. Apple Safari, etc. are all products of Apple (Apple). Apple Safari is a web browser that is the default browser included with the Mac OS X and iOS operating systems. Apple iOS is an operating system developed for mobile devices. Apple tvOS is a smart TV operating system. WebKit is one of the web browser engine components. A resource management error vulnerability exists in the WebKit component of several Apple products. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebkitGTK+: Multiple vulnerabilities
Date: December 02, 2018
Bugs: #667892
ID: 201812-04
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.22.0 >= 2.22.0
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Impact
======
A remote attacker could execute arbitrary commands or cause a Denial of
Service condition via maliciously crafted web content.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebkitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.22.0"
References
==========
[ 1 ] CVE-2018-4191
https://nvd.nist.gov/vuln/detail/CVE-2018-4191
[ 2 ] CVE-2018-4197
https://nvd.nist.gov/vuln/detail/CVE-2018-4197
[ 3 ] CVE-2018-4207
https://nvd.nist.gov/vuln/detail/CVE-2018-4207
[ 4 ] CVE-2018-4208
https://nvd.nist.gov/vuln/detail/CVE-2018-4208
[ 5 ] CVE-2018-4209
https://nvd.nist.gov/vuln/detail/CVE-2018-4209
[ 6 ] CVE-2018-4210
https://nvd.nist.gov/vuln/detail/CVE-2018-4210
[ 7 ] CVE-2018-4212
https://nvd.nist.gov/vuln/detail/CVE-2018-4212
[ 8 ] CVE-2018-4213
https://nvd.nist.gov/vuln/detail/CVE-2018-4213
[ 9 ] CVE-2018-4299
https://nvd.nist.gov/vuln/detail/CVE-2018-4299
[ 10 ] CVE-2018-4306
https://nvd.nist.gov/vuln/detail/CVE-2018-4306
[ 11 ] CVE-2018-4309
https://nvd.nist.gov/vuln/detail/CVE-2018-4309
[ 12 ] CVE-2018-4311
https://nvd.nist.gov/vuln/detail/CVE-2018-4311
[ 13 ] CVE-2018-4312
https://nvd.nist.gov/vuln/detail/CVE-2018-4312
[ 14 ] CVE-2018-4314
https://nvd.nist.gov/vuln/detail/CVE-2018-4314
[ 15 ] CVE-2018-4315
https://nvd.nist.gov/vuln/detail/CVE-2018-4315
[ 16 ] CVE-2018-4316
https://nvd.nist.gov/vuln/detail/CVE-2018-4316
[ 17 ] CVE-2018-4317
https://nvd.nist.gov/vuln/detail/CVE-2018-4317
[ 18 ] CVE-2018-4318
https://nvd.nist.gov/vuln/detail/CVE-2018-4318
[ 19 ] CVE-2018-4319
https://nvd.nist.gov/vuln/detail/CVE-2018-4319
[ 20 ] CVE-2018-4323
https://nvd.nist.gov/vuln/detail/CVE-2018-4323
[ 21 ] CVE-2018-4328
https://nvd.nist.gov/vuln/detail/CVE-2018-4328
[ 22 ] CVE-2018-4358
https://nvd.nist.gov/vuln/detail/CVE-2018-4358
[ 23 ] CVE-2018-4359
https://nvd.nist.gov/vuln/detail/CVE-2018-4359
[ 24 ] CVE-2018-4361
https://nvd.nist.gov/vuln/detail/CVE-2018-4361
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201812-04
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-8 Additional information for
APPLE-SA-2018-9-24-4 iOS 12
iOS 12 addresses the following:
Accounts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local app may be able to read a persistent account
identifier
Description: This issue was addressed with improved entitlements.
CVE-2018-4322: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Auto Unlock
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Bluetooth
Available for: iPhone SE, iPhone 6s, iPhone 6s Plus, iPhone 7,
iPhone 7 Plus, iPad Mini 4, 12.9-inch iPad Pro 1st generation,
12.9-inch iPad Pro 2nd generation, 10.5-inch iPad Pro,
9.7-inch iPad Pro, iPad 5th generation, and iPod Touch 6th generation
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
CFNetwork
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreFoundation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018
CoreMedia
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An app may be able to learn information about the current
camera view before being granted camera access
Description: A permissions issue existed.
CVE-2018-4356: an anonymous researcher
CoreText
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018
Crash Reporter
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Grand Central Dispatch
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4426: Brandon Azad
Entry added October 30, 2018
Heimdal
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4331: Brandon Azad
CVE-2018-4332: Brandon Azad
CVE-2018-4343: Brandon Azad
Entry added October 30, 2018
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Parsing a maliciously crafted iBooks file may lead to
disclosure of user information
Description: A configuration issue was addressed with additional
restrictions.
CVE-2018-4355: evi1m0 of bilibili security team
Entry added October 30, 2018
IOHIDFamily
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed with improved
input validation
CVE-2018-4408: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to break out of its
sandbox
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4341: Ian Beer of Google Project Zero
CVE-2018-4354: Ian Beer of Google Project Zero
Entry added October 30, 2018
IOKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4383: Apple
Entry added October 30, 2018
IOMobileFrameBuffer
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4335: Brandon Azad
IOUserEthernet
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4401: Apple
Entry added October 30, 2018
iTunes Store
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in the iTunes Store
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4305: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to leak sensitive user
information
Description: An access issue existed with privileged API calls. This
issue was addressed with additional restrictions.
CVE-2018-4399: Fabiano Anemone (@anoane)
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An input validation issue existed in the kernel.
CVE-2018-4363: Ian Beer of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
execute arbitrary code
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4407: Kevin Backhouse of Semmle Ltd.
Entry added October 30, 2018
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4337: Ian Beer of Google Project Zero
CVE-2018-4340: Mohamed Ghannam (@_simo36)
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
CVE-2018-4425: cc working with Trend Micro's Zero Day Initiative,
Juwei Lin (@panicaII) of Trend Micro working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
mDNSOffloadUserClient
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4326: an anonymous researcher working with Trend Micro's
Zero Day Initiative, Zhuo Liang of Qihoo 360 Nirvan Team
Entry added October 30, 2018
MediaRemote
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed with additional sandbox
restrictions.
CVE-2018-4310: CodeColorist of Ant-Financial LightYear Labs
Entry added October 30, 2018
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted
messages
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Notes
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover a user's deleted notes
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4352: Utku Altinkaynak
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to discover websites a user has
visited
Description: A consistency issue existed in the handling of
application snapshots.
CVE-2018-4313: 11 anonymous researchers, David Scott, Enes Mert
Ulu of Abdullah MA1/4rAide AzA1/4nenek Anadolu Lisesi -
Ankara/TA1/4rkiye, Mehmet Ferit DaAtan of Van YA1/4zA1/4ncA1/4 YA+-l
University, Metin Altug Karakaya of Kaliptus Medical Organization,
Vinodh Swami of Western Governor's University (WGU)
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)
SafariViewController
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4362: Jun Kokatsu (@shhnjk)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to cause a denial of service
Description: This issue was addressed with improved checks.
CVE-2018-4395: Patrick Wardle of Digita Security
Entry added October 30, 2018
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Status Bar
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
determine the last used app from the lock screen
Description: A logic issue was addressed with improved restrictions.
CVE-2018-4325: Brian Adeloye
Symptom Framework
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed with improved bounds
checking.
CVE-2018-4203: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018
Text
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4304: jianan.huang (@Sevck)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
CVE-2018-4319: John Pettitt of Google
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4345: an anonymous researcher
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz
Additional recognition
APFS
We would like to acknowledge Umang Raghuvanshi for their assistance.
Assets
We would like to acknowledge Brandon Azad for their assistance.
configd
We would like to acknowledge Sabri Haddouche (@pwnsdx) of Wire Swiss
GmbH for their assistance.
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreSymbolication
We would like to acknowledge Brandon Azad for their assistance.
Exchange ActiveSync
We would like to acknowledge Jesse Thompson of University of
Wisconsin-Madison for their assistance.
Feedback Assistant
We would like to acknowledge Marco Grassi (@marcograss) of KeenLab
(@keen_lab) Tencent working with Trend Micro's Zero Day Initiative
for their assistance.
Kernel
We would like to acknowledge Brandon Azad for their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, Gunnar Diepenbruck,
and Zbyszek A>>A3Akiewski for their assistance.
MediaRemote
We would like to acknowledge Brandon Azad for their assistance.
Quick Look
We would like to acknowledge lokihardt of Google Project Zero for
their assistance.
Safari
We would like to acknowledge Marcel Manz of SIMM-Comm GmbH and Vlad
Galbin for their assistance.
Sandbox Profiles
We would like to acknowledge Tencent Keen Security Lab working with
Trend Micro's Zero Day Initiative for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Status Bar
We would like to acknowledge Ju Zhu of Meituan and Moony Li and
Lilang Wu of Trend Micro for their assistance.
WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 12".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3HbuA//
ZOEwXUyLVS3SqfEjU3MRUoTp1x+Ow+fd5co9B6v7bY+Ebc2KmSZjpPuNPjouRHmf
RbWpZ0Mc52NYm+OdYqPu/Tg94wRi6tlrYusk6GngVH4IBER4TqiFrLNSzAjXL0xP
qWv3JQcAIFNbNWpSEzDzEbuq85q4BIuP/+v2LpTc1ZWqIYt9TQHxUpyjoTXZvQhL
8L9ZM/dj8BC+m713LeC/KzveaDpaqnVJUDbgUkzRyFfFqOJt+hlaTS8yMUM3G+TX
cblL8bvFNIxtUrt4Rf2TwDRVxUZIw/aFK2APmxVZ44UAT+2o+WFxBkHRXQiZc4Lk
OaTzzkocdZu4q4MibrxELBWtW46AcGMqQKUpFZ6GR+4U2c1ICRwKnjQTn0iY7mg7
d+M+bTx8T2knwV7lSwvnHz79rysvOuCF3QCAZ4tW4PvLHWSZ0TpJho8z23PLHFQd
J3cOYPby6SM9YP6SBISX5OI8xnvr1XIAPIBnOy0ScaMFsu0Er8j1hvbF1fXiaYOJ
CSUUXR2th3jPW0g9L0j4vWGURG1h0psIN2MxTSHbmm4KXBAYngZ0wDOeJMUe8YMy
IG0UBDqKNh8lzKHcc4aYA1WyaNsqbgbngBqDATp/XyWRzd+Py/U06MVuIaV095Rv
s9WW67M1kLHy4BeutXt+xLBp9AugI+gU53uysxcnBx4=
=dGPm
-----END PGP SIGNATURE-----
.
Installation note:
Safari 12 may be obtained from the Mac App Store
| VAR-201904-1467 | CVE-2018-4353 | macOS Configuration vulnerability |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
A configuration issue was addressed with additional restrictions. This issue affected versions prior to macOS Mojave 10.14. macOS Has a configuration vulnerability due to flaws in handling restrictions.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Apple From macOS An update for has been released.The potential impact depends on each vulnerability, but may be affected as follows: * Arbitrary code execution * information leak * Access restriction bypass. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-9-24-1 macOS Mojave 10.14
macOS Mojave 10.14 is now available and addresses the following:
Bluetooth
Available for: iMac (21.5-inch, Late 2012), iMac (27-inch, Late 2012)
, iMac (21.5-inch, Late 2013), iMac (21.5-inch, Mid 2014), iMac
(Retina 5K, 27-inch, Late 2014), iMac (21.5-inch, Late 2015),
Mac mini (Mid 2011), Mac mini Server (Mid 2011), Mac mini (Late 2012)
, Mac mini Server (Late 2012), Mac mini (Late 2014), Mac Pro
(Late 2013), MacBook Air (11-inch, Mid 2011), MacBook Air
(13-inch, Mid 2011), MacBook Air (11-inch, Mid 2012), MacBook Air
(13-inch, Mid 2012), MacBook Air (11-inch, Mid 2013), MacBook Air
(13-inch, Mid 2013), MacBook Air (11-inch, Early 2015), MacBook Air
(13-inch, Early 2015), MacBook Pro (13-inch, Mid 2012), MacBook Pro
(15-inch, Mid 2012), MacBook Pro (Retina, 13-inch, Early 2013),
MacBook Pro (Retina, 15-inch, Early 2013), MacBook Pro (Retina,
13-inch, Late 2013), and MacBook Pro (Retina, 15-inch, Late 2013)
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth.
CVE-2018-5383: Lior Neumann and Eli Biham
The updates below are available for these Mac models:
MacBook (Early 2015 and later), MacBook Air (Mid 2012 and later),
MacBook Pro (Mid 2012 and later), Mac mini (Late 2012 and later),
iMac (Late 2012 and later), iMac Pro (all models), Mac Pro
(Late 2013, Mid 2010, and Mid 2012 models with recommended
Metal-capable graphics processor, including MSI Gaming Radeon RX 560
and Sapphire Radeon PULSE RX 580)
App Store
Impact: A malicious application may be able to determine the Apple ID
of the owner of the computer
Description: A permissions issue existed in the handling of the Apple
ID.
CVE-2018-4324: Sergii Kryvoblotskyi of MacPaw Inc.
CVE-2018-4353: Abhinav Bansal of Zscaler, Inc.
Auto Unlock
Impact: A malicious application may be able to access local users
AppleIDs
Description: A validation issue existed in the entitlement
verification.
CVE-2018-4321: Min (Spark) Zheng, Xiaolong Bai of Alibaba Inc.
Crash Reporter
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4333: Brandon Azad
Kernel
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4336: Brandon Azad
CVE-2018-4344: The UK's National Cyber Security Centre (NCSC)
Security
Impact: An attacker may be able to exploit weaknesses in the RC4
cryptographic algorithm
Description: This issue was addressed by removing RC4.
CVE-2016-1777: Pepi Zawodsky
Accessibility Framework
We would like to acknowledge Ryan Govostes for their assistance.
Additional recognition
Core Data
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
CoreGraphics
We would like to acknowledge Nitin Arya of Roblox Corporation for
their assistance.
Mail
We would like to acknowledge Alessandro Avagliano of Rocket Internet
SE, John Whitehead of The New York Times, Kelvin Delbarre of Omicron
Software Systems, and Zbyszek A>>A3Akiewski for their assistance.
Security
We would like to acknowledge Christoph Sinai, Daniel Dudek
(@dannysapples) of The Irish Times and Filip KlubiAka (@lemoncloak)
of ADAPT Centre, Dublin Institute of Technology, Istvan Csanady of
Shapr3D, Omar Barkawi of ITG Software, Inc., Phil Caleno, Wilson
Ding, and an anonymous researcher for their assistance.
SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.
Installation note:
macOS Mojave 10.14 may be obtained from the Mac App Store or
Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlupFUIACgkQeC9tht7T
K3FSKQ//YXQwJ6lpCD/rqdM/MAa4eZ4y/vyyhMc0t9Q32smmeFEPuM2MG3+Sh7Xc
c2nAgTBDu5NdLvY1qxIsHV+NINHJZexTX5kOBqzY5YL5peYDAdaBINwDMzfuNQHD
L6X3gtbOXrsAsfdJHZaV+GyEqPaJ65fdWxuql3g3ecXKDCzYF1Gb9FUhyvTHYm+I
Uwqn5rBtgviAYyHAr5RAl8J4G8yshp4sdw3gKeQ9xxcrhfhRKbTOQCVdXcjXInh+
asC07y843MYc5rdp8WWKO5yPmg6frj8ss1cp3zRVQCk41WTsfwI319I63GvGAEZA
nvMLxs16y8Wp8dPCQBUBuC0Pr+PvWWzA8CFv7feFcgylectrOQjNlg1ybRlg6org
4QPL6vGfo1dQJ4F3t+h7VnOaKulD83UyGkI+DtSMvqEJyvYnOg3tmbI1pv8lHu9c
ZTWrCxpm59KOGYi9ODJ1dzqUIWcrPQBmJa1eN5ZaFOl2/QVmrVztvplV9CvChVte
w/TqWlcdvBt4z4LE9yCua82TtRxy4vWbSU/xYILGixJjBjK+ff4mEZGXul8A7yV9
lhhGENXrwgEYUHcnMkTTvSdHg8ASuCVvbn+2EgoyykWnwUjlxqzm0pukMB9Uq/wm
IHV+qibDoI4szssR0nx9IHv+YeG7HZdq6599PRnF2/xiXwJKcLE=
=EzzA
-----END PGP SIGNATURE-----