CVE-2018-4360: Buffer Overflow
First published: Wed Sep 12 2018(Updated: )
WebKit. Multiple memory corruption issues were addressed with improved memory handling.
Credit: Samuel Groβ (saelo) Trend MicroIvan Fratric Google Project ZeroIvan Fratric Google Project Zeroteam (@bkth_ @5aelo @_niklasb) @phoenhex Trend MicroSamuel Groß @5aelo William Bowling @wcbowling Samuel Groβ (saelo) Trend Micro's Zero Day InitiativeIvan Fratric Google Project ZeroIvan Fratric Google Project Zeroteam (@bkth_ @5aelo @_niklasb) @phoenhex Trend Micro's Zero Day InitiativeSamuel Groß @5aelo William Bowling @wcbowling Samuel Groβ (saelo) Trend MicroIvan Fratric Google Project ZeroIvan Fratric Google Project Zeroteam (@bkth_ @5aelo @_niklasb) @phoenhex Trend MicroSamuel Groß @5aelo William Bowling @wcbowling Samuel Groβ (saelo) Trend MicroIvan Fratric Google Project ZeroIvan Fratric Google Project Zeroteam (@bkth_ @5aelo @_niklasb) @phoenhex Trend MicroSamuel Groß @5aelo William Bowling @wcbowling Samuel Groβ (saelo) Trend MicroIvan Fratric Google Project ZeroIvan Fratric Google Project Zeroteam (@bkth_ @5aelo @_niklasb) @phoenhex Trend MicroSamuel Groß @5aelo William Bowling @wcbowling product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple iTunes for Windows | <12.9 | 12.9 |
| Apple iCloud for Windows | <7.7 | 7.7 |
| Apple Safari | <12 | 12 |
| Apple tvOS | <12 | 12 |
| Apple iOS | <12 | 12 |
| Apple Safari | <12 | |
| Apple iPhone OS | <12.0 | |
| Apple tvOS | <12 | |
| Apple iCloud | <7.7 | |
| Apple iTunes | <12.9 | |
| Microsoft Windows |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://support.apple.com/en-us/HT209106 (Advisory)
- https://support.apple.com/en-us/HT209107 (Advisory)
- https://support.apple.com/en-us/HT209109 (Advisory)
- https://support.apple.com/en-us/HT209140 (Advisory)
- https://support.apple.com/en-us/HT209141 (Advisory)
- https://devcraft.io/2019/02/19/cve-2018-4360-webkit-information-leakage-with-dommatrixinvertself.html
- https://github.com/WebKit/webkit/commit/a0b0e01648892b0bb60a01aca619eec85eb27f7a
- https://support.apple.com/kb/HT209106
- https://support.apple.com/kb/HT209107
- https://support.apple.com/kb/HT209109
- https://support.apple.com/kb/HT209140
- https://support.apple.com/kb/HT209141
Peer vulnerabilities
(Found alongside the following vulnerabilities)
- CVE-2018-4126
- CVE-2018-4414
- CVE-2018-4412
- CVE-2018-4347
- CVE-2018-4191
- CVE-2018-4311
- CVE-2018-4316
- CVE-2018-4299
- CVE-2018-4323
- CVE-2018-4328
- CVE-2018-4358
- CVE-2018-4359
- CVE-2018-4360
- CVE-2018-4319
- CVE-2018-4309
- CVE-2018-4197
- CVE-2018-4306
- CVE-2018-4312
- CVE-2018-4314
- CVE-2018-4315
- CVE-2018-4317
- CVE-2018-4318
- CVE-2018-4345
- CVE-2018-4361
- CVE-2018-4474
- CVE-2018-4307
- CVE-2018-4329
- CVE-2018-4195
- CVE-2018-4321
- CVE-2018-5383
- CVE-2018-4433
- CVE-2018-4426
- CVE-2018-4331
- CVE-2018-4332
- CVE-2018-4343
- CVE-2018-4408
- CVE-2018-4341
- CVE-2018-4354
- CVE-2018-4383
- CVE-2018-4401
- CVE-2018-4305
- CVE-2018-4399
- CVE-2018-4407
- CVE-2018-4363
- CVE-2018-4336
- CVE-2018-4337
- CVE-2018-4340
- CVE-2018-4344
- CVE-2018-4425
- CVE-2018-4313
- CVE-2016-1777
- CVE-2018-4395
- CVE-2018-4203
- CVE-2018-4304
- CVE-2018-4322
- CVE-2018-4356
- CVE-2018-4333
- CVE-2018-4355
- CVE-2018-4335
- CVE-2018-4326
- CVE-2018-4310
- CVE-2018-4352
- CVE-2018-4362
- CVE-2018-4325
Frequently Asked Questions
What is CVE-2018-4360?
CVE-2018-4360 is a vulnerability in WebKit that allows for multiple memory corruption issues with improved memory handling.
Which versions of iOS and tvOS are affected by CVE-2018-4360?
Versions prior to iOS 12 and tvOS 12 are affected by CVE-2018-4360.
Which versions of Safari, iTunes, and iCloud for Windows are affected by CVE-2018-4360?
Versions prior to Safari 12, iTunes 12.9, and iCloud for Windows 7.7 are affected by CVE-2018-4360.
What is the severity of CVE-2018-4360?
CVE-2018-4360 has a severity rating of 8.8 (high).
How can CVE-2018-4360 be fixed?
To fix CVE-2018-4360, update to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, or iCloud for Windows 7.7.
- collector/apple-support
- alias/CVE-2018-4323
- alias/CVE-2018-4328
- alias/CVE-2018-4358
- alias/CVE-2018-4359
- alias/CVE-2018-4360
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/software-canonical-lookup-request
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- agent/event
- collector/nvd-index
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/apple
- canonical/apple itunes for windows
- canonical/apple icloud for windows
- canonical/apple safari
- canonical/apple tvos
- canonical/apple ios
- canonical/apple iphone os
- canonical/apple icloud
- canonical/apple itunes
- vendor/microsoft
- canonical/microsoft windows