CVE-2018-4262: Buffer Overflow

Q: What is CVE-2018-4262?

CVE-2018-4262 is a vulnerability in WebKit that allows remote attackers to execute arbitrary code or cause a denial of service.

Q: What is the severity of CVE-2018-4262?

CVE-2018-4262 has a severity rating of 8.8 (High).

Q: How can I fix CVE-2018-4262?

Update to the latest version of Safari, iTunes, iOS, tvOS, or iCloud for Windows to fix CVE-2018-4262.

Q: Where can I find more information about CVE-2018-4262?

You can find more information about CVE-2018-4262 at the following references: [CVE-2018-4262 on Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4262), [Apple Security Update](https://support.apple.com/en-us/HT208934), [WebKit Security Advisory](https://webkitgtk.org/security/WSA-2018-0006.html).

Published Jul 9, 2018

Updated

In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Omair(Trend Micro), Mateusz Krzywicki(Trend Micro), Arayz(Trend Micro), found by OSS-Fuzz, Yu Zhou, Jundong Xie(Ant), cc(Trend Micro), Arayz(Pangu team working with Trend Micro)

Affected Software

20 affected componentsFixes available

debian/webkit2gtk

2.44.2-1~deb11u12.44.3-1~deb11u12.44.2-1~deb12u12.44.3-1~deb12u12.46.0-22.46.1-1

Apple tvOS<11.4.1

11.4.1

Apple WatchOS<4.3.2

4.3.2

Apple iCloud for Windows<7.6

7.6

Apple iTunes for Windows<12.8

12.8

Apple Safari<11.1.2

11.1.2

Apple iOS<11.4.1

11.4.1

Apple Safari<11.1.2

Apple iPhone OS<11.4.1

Apple tvOS<11.4.1

Apple WatchOS<4.3.2

All of the following

Any of the following

Apple iCloud<7.6

Apple iTunes<12.8

Microsoft Windows

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=18.04

Apple iCloud<7.6

Apple iTunes<12.8

Microsoft Windows

alpine/webkit2gtk<2.20.4-r0

2.20.4-r0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.44.2-1~deb11u1Fixed in 2.44.3-1~deb11u1Fixed in 2.44.2-1~deb12u1Fixed in 2.44.3-1~deb12u1Fixed in 2.46.0-2Fixed in 2.46.1-1
Upgrade
Upgrade tvOS to a version that resolves this vulnerability.
Fixed in 11.4.1
Upgrade
Upgrade Apple iOS, iPadOS, and watchOS to a version that resolves this vulnerability.
Fixed in 4.3.2
Upgrade
Upgrade Apple iCloud to a version that resolves this vulnerability.
Fixed in 7.6
Upgrade
Upgrade iTunes to a version that resolves this vulnerability.
Fixed in 12.8
Upgrade
Upgrade Safari to a version that resolves this vulnerability.
Fixed in 11.1.2
Upgrade
Upgrade Apple iOS and iPadOS to a version that resolves this vulnerability.
Fixed in 11.4.1
Upgrade
Upgrade alpine/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.20.4-r0
Upgrade
Upgrade iTunes for Windows to a version that resolves this vulnerability.
Fixed in 12.8
Upgrade
Upgrade iOS to a version that resolves this vulnerability.
Fixed in 11.4.1
Upgrade
Upgrade iCloud for Windows to a version that resolves this vulnerability.
Fixed in 7.6

Event History

Jan 11, 2019

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Data Sourced

via OSV·06:29 PM

DescriptionSeverityAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is CVE-2018-4262?

CVE-2018-4262 is a vulnerability in WebKit that allows remote attackers to execute arbitrary code or cause a denial of service.

What is the severity of CVE-2018-4262?