CVE-2018-4316: Buffer Overflow
First published: Wed Sep 12 2018(Updated: )
A memory corruption issue was addressed with improved state management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.
Credit: crixer Hanming Zhang @4shitak4 Qihoo 360 Vulcan Teamcrixer Qihoo 360 Vulcan TeamHanming Zhang @4shitak4 Qihoo 360 Vulcan Teamcrixer Hanming Zhang @4shitak4 Qihoo 360 Vulcan Teamcrixer Hanming Zhang @4shitak4 Qihoo 360 Vulcan Teamcrixer Hanming Zhang @4shitak4 Qihoo 360 Vulcan Team product-security@apple.com product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iTunes for Windows | <12.9 | 12.9 |
| Apple Safari | <12 | 12 |
| Apple iCloud for Windows | <7.7 | 7.7 |
| Apple tvOS | <12 | 12 |
| Apple iOS | <12 | 12 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-0ubuntu0.18.04.1 | 2.22.2-0ubuntu0.18.04.1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| ubuntu/webkit2gtk | <2.22.0 | 2.22.0 |
| ubuntu/webkit2gtk | <2.22.2-1ubuntu1 | 2.22.2-1ubuntu1 |
| debian/webkit2gtk | 2.36.4-1~deb10u1 2.38.6-0+deb10u1 2.42.2-1~deb11u1 2.42.5-1~deb11u1 2.42.2-1~deb12u1 2.42.5-1~deb12u1 2.42.5-1 | |
| Apple Safari | <12 | |
| Apple iPhone OS | <12.0 | |
| Apple tvOS | <12 | |
| All of | ||
| Any of | ||
| Apple iCloud | <7.7 | |
| Apple iTunes | <12.9 | |
| Microsoft Windows | ||
| Apple iCloud | <7.7 | |
| Apple iTunes | <12.9 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT209106 (Advisory)
- https://support.apple.com/en-us/HT209107 (Advisory)
- https://support.apple.com/en-us/HT209109 (Advisory)
- https://support.apple.com/en-us/HT209140 (Advisory)
- https://support.apple.com/en-us/HT209141 (Advisory)
- https://support.apple.com/kb/HT209106
- https://support.apple.com/kb/HT209107
- https://support.apple.com/kb/HT209109
- https://support.apple.com/kb/HT209140
- https://support.apple.com/kb/HT209141
- https://launchpad.net/bugs/cve/CVE-2018-4316
- https://webkitgtk.org/security/WSA-2018-0007.html
- https://security-tracker.debian.org/tracker/CVE-2018-4316
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-4316
- https://www.openwall.com/lists/oss-security/2018/09/29/1
- https://ubuntu.com/security/notices/USN-3781-1
- https://nvd.nist.gov/vuln/detail/CVE-2018-4316
- https://ubuntu.com/security/CVE-2018-4316
Parent vulnerabilities
(Appears in the following advisories)
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2018-4126
- CVE-2018-4414
- CVE-2018-4412
- CVE-2018-4347
- CVE-2018-4191
- CVE-2018-4311
- CVE-2018-4316
- CVE-2018-4299
- CVE-2018-4323
- CVE-2018-4328
- CVE-2018-4358
- CVE-2018-4359
- CVE-2018-4360
- CVE-2018-4319
- CVE-2018-4309
- CVE-2018-4197
- CVE-2018-4306
- CVE-2018-4312
- CVE-2018-4314
- CVE-2018-4315
- CVE-2018-4317
- CVE-2018-4318
- CVE-2018-4345
- CVE-2018-4361
- CVE-2018-4474
- CVE-2018-4307
- CVE-2018-4329
- CVE-2018-4195
- CVE-2018-4321
- CVE-2018-5383
- CVE-2018-4433
- CVE-2018-4426
- CVE-2018-4331
- CVE-2018-4332
- CVE-2018-4343
- CVE-2018-4408
- CVE-2018-4341
- CVE-2018-4354
- CVE-2018-4383
- CVE-2018-4401
- CVE-2018-4305
- CVE-2018-4399
- CVE-2018-4407
- CVE-2018-4363
- CVE-2018-4336
- CVE-2018-4337
- CVE-2018-4340
- CVE-2018-4344
- CVE-2018-4425
- CVE-2018-4313
- CVE-2016-1777
- CVE-2018-4395
- CVE-2018-4203
- CVE-2018-4304
- CVE-2018-4322
- CVE-2018-4356
- CVE-2018-4333
- CVE-2018-4355
- CVE-2018-4335
- CVE-2018-4326
- CVE-2018-4310
- CVE-2018-4352
- CVE-2018-4362
- CVE-2018-4325
Frequently Asked Questions
What is CVE-2018-4316?
CVE-2018-4316 is a vulnerability in WebKit that allows for memory corruption.
Which software versions are affected by CVE-2018-4316?
Versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7 are affected by CVE-2018-4316.
What is the severity of CVE-2018-4316?
CVE-2018-4316 has a severity rating of 8.8, which is considered high.
How do I fix CVE-2018-4316?
To fix CVE-2018-4316, update to iOS 12 (or later), tvOS 12 (or later), Safari 12 (or later), iTunes 12.9 for Windows (or later), iCloud for Windows 7.7 (or later).
Where can I find more information about CVE-2018-4316?
You can find more information about CVE-2018-4316 at the following references: [link1](https://support.apple.com/kb/HT209106), [link2](https://support.apple.com/kb/HT209107), [link3](https://support.apple.com/kb/HT209109).
- collector/apple-support
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- collector/launchpad-cve
- source/Launchpad
- agent/software-canonical-lookup-request
- agent/author
- collector/usn-cve
- source/Ubuntu
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/security-tracker-debian
- source/Debian
- agent/tags
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- collector/nvd-index
- vendor/apple
- canonical/apple itunes for windows
- canonical/apple safari
- canonical/apple icloud for windows
- canonical/apple tvos
- canonical/apple ios
- package-manager/ubuntu
- package-manager/debian
- canonical/apple iphone os
- canonical/apple icloud
- canonical/apple itunes
- vendor/microsoft
- canonical/microsoft windows