CVE-2018-4222: Input Validation

Q: What is CVE-2018-4222?

CVE-2018-4222 is a vulnerability in certain Apple products, including iOS, Safari, iCloud, iTunes, tvOS, and watchOS.

Q: What is the severity of CVE-2018-4222?

The severity of CVE-2018-4222 is high, with a CVSS score of 8.8.

Q: How does CVE-2018-4222 affect Apple Safari?

CVE-2018-4222 affects Safari versions before 11.1.1.

Q: How does CVE-2018-4222 affect Apple iOS?

CVE-2018-4222 affects iOS versions before 11.4.

Q: How can I mitigate CVE-2018-4222?

To mitigate CVE-2018-4222, update to the latest version of the affected software, such as iOS 11.4 or Safari 11.1.1.

Published May 29, 2018

Updated

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.

Other sources

WebKit. An out-of-bounds read was addressed with improved input validation.

Credit

natashenka(Google Project Zero)

Affected Software

16 affected componentsFixes available

Apple iTunes for Windows<12.7.5

12.7.5

Apple Safari<11.1.1

Apple iPhone OS<11.4

Apple tvOS<11.4

Apple WatchOS<4.3.1

Apple iCloud<7.5

Microsoft Windows

Apple iTunes<12.7.5

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

Canonical Ubuntu Linux=18.04

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-1

All of the following

Apple iCloud<7.5

Microsoft Windows

All of the following

Apple iTunes<12.7.5

Microsoft Windows

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.7.5
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.44.2-1~deb11u1Fixed in 2.50.4-1~deb11u1Fixed in 2.50.4-1~deb12u1Fixed in 2.50.4-1~deb13u1Fixed in 2.50.5-1
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 11.1.1
Upgrade
Upgrade iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.5
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 11.4
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.7.5
Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 11.4
Upgrade
Upgrade watchOS to a version that resolves this vulnerability.
Fixed in 4.3.1

Event History

Jun 8, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via NVD·06:29 PM

DescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

HT208852

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2018-4222?

CVE-2018-4222 is a vulnerability in certain Apple products, including iOS, Safari, iCloud, iTunes, tvOS, and watchOS.

What is the severity of CVE-2018-4222?

The severity of CVE-2018-4222 is high, with a CVSS score of 8.8.

How does CVE-2018-4222 affect Apple Safari?

CVE-2018-4222 affects Safari versions before 11.1.1.

How does CVE-2018-4222 affect Apple iOS?

CVE-2018-4222 affects iOS versions before 11.4.

How can I mitigate CVE-2018-4222?

To mitigate CVE-2018-4222, update to the latest version of the affected software, such as iOS 11.4 or Safari 11.1.1.

CVE-2018-4222: Input Validation

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is CVE-2018-4222?

What is the severity of CVE-2018-4222?

How does CVE-2018-4222 affect Apple Safari?

How does CVE-2018-4222 affect Apple iOS?

How can I mitigate CVE-2018-4222?

Company

Resources

Contact