CVE-2018-4125: Buffer Overflow

Q: What is CVE-2018-4125?

CVE-2018-4125 is a vulnerability in certain Apple products that affects iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, tvOS before 11.3, and watchOS before 4.3.

Q: What is the severity of CVE-2018-4125?

The severity of CVE-2018-4125 is high with a CVSS score of 8.8.

Q: How does CVE-2018-4125 impact Apple products?

CVE-2018-4125 can lead to multiple memory corruption issues in Apple products, including iOS, Safari, iCloud on Windows, iTunes on Windows, tvOS, and watchOS.

Q: How can I fix CVE-2018-4125?

To fix CVE-2018-4125, update your Apple products to the latest versions of iOS, Safari, iCloud on Windows, iTunes on Windows, tvOS, and watchOS.

Published Mar 29, 2018

Updated

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Yuan Deng(Ant), found by OSS-Fuzz, Jun Kokatsu@@shhnjk, an anonymous researcher(Trend Micro), Hanming Zhang@@4shitak4(Qihoo 360 Vulcan Team), natashenka(Google Project Zero), WanderingGlitch(Trend Micro), Zach Markley, likemeng(Baidu Security Lab working with Trend Micro), Omair(Trend Micro), Natalie Silvanovich(Google Project Zero)

Affected Software

20 affected componentsFixes available

Apple tvOS<11.3

11.3

Apple WatchOS<4.3

4.3

Apple iCloud for Windows<7.4

7.4

Apple Safari<11.1

11.1

Apple iOS<11.3

11.3

Apple Safari<11.1

Apple iPhone OS<11.3

Apple tvOS<11.3

Apple WatchOS<4.3

Apple iCloud<7.4

Microsoft Windows

Apple iTunes<12.7.4

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

WebKitGTK Webkitgtk\+<2.20.4

All of the following

Apple iCloud<7.4

Microsoft Windows

All of the following

Apple iTunes<12.7.4

Microsoft Windows

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 11.3
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 4.3
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 7.4
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 11.1
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 11.3
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.44.2-1~deb11u1Fixed in 2.50.4-1~deb11u1Fixed in 2.50.4-1~deb12u1Fixed in 2.50.4-1~deb13u1Fixed in 2.50.5-1Fixed in 2.50.6-1
Upgrade
Upgrade Apple Safari to a version that resolves this vulnerability.
Fixed in 11.1
Upgrade
Upgrade Apple iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.4
Upgrade
Upgrade Apple iOS to a version that resolves this vulnerability.
Fixed in 11.3
Upgrade
Upgrade Apple iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.7.4
Upgrade
Upgrade Apple tvOS to a version that resolves this vulnerability.
Fixed in 11.3
Upgrade
Upgrade Apple watchOS to a version that resolves this vulnerability.
Fixed in 4.3

Event History

Apr 3, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Data Sourced

via NVD·06:29 AM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2018-4125?

CVE-2018-4125 is a vulnerability in certain Apple products that affects iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, tvOS before 11.3, and watchOS before 4.3.

What is the severity of CVE-2018-4125?

The severity of CVE-2018-4125 is high with a CVSS score of 8.8.

How does CVE-2018-4125 impact Apple products?

CVE-2018-4125 can lead to multiple memory corruption issues in Apple products, including iOS, Safari, iCloud on Windows, iTunes on Windows, tvOS, and watchOS.

How can I fix CVE-2018-4125?

To fix CVE-2018-4125, update your Apple products to the latest versions of iOS, Safari, iCloud on Windows, iTunes on Windows, tvOS, and watchOS.

CVE-2018-4125: Buffer Overflow

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2018-4125?

What is the severity of CVE-2018-4125?

How does CVE-2018-4125 impact Apple products?

How can I fix CVE-2018-4125?

Company

Resources

Contact