ID

VAR-201806-1436


CVE

CVE-2018-4232


TITLE

plural Apple Used in products Webkit In the component Cookie Overwritten vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-005525

DESCRIPTION

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to overwrite cookies via a crafted web site. Apple iOS is an operating system developed for mobile devices; Safari is a web browser that is the default browser included with Mac OS X and iOS operating systems. WebKit is one of the web browser engine components. The following products and versions are affected: Apple iOS prior to 11.4; Safari prior to 11.1.1; Windows-based iCloud prior to 7.5; Windows-based iTunes prior to 12.7.5; tvOS prior to 11.4; watchOS 4.3. 1 previous version. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201808-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Normal Title: WebkitGTK+: Multiple vulnerabilities Date: August 22, 2018 Bugs: #652820, #658168, #662974 ID: 201808-04 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple vulnerabilities have been found in WebKitGTK+, the worst of which may lead to arbitrary code execution. Background ========== WebKitGTK+ is a full-featured port of the WebKit rendering engine, suitable for projects requiring any kind of web integration, from hybrid HTML/CSS applications to full-fledged web browsers. Affected packages ================= ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 net-libs/webkit-gtk < 2.20.4 >= 2.20.4 Description =========== Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the referenced CVE identifiers for details. Workaround ========== There is no known workaround at this time. Resolution ========== All WebkitGTK+ users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose ">=net-libs/webkit-gtk-2.20.4" References ========== [ 1 ] CVE-2018-11646 https://nvd.nist.gov/vuln/detail/CVE-2018-11646 [ 2 ] CVE-2018-11712 https://nvd.nist.gov/vuln/detail/CVE-2018-11712 [ 3 ] CVE-2018-11713 https://nvd.nist.gov/vuln/detail/CVE-2018-11713 [ 4 ] CVE-2018-12293 https://nvd.nist.gov/vuln/detail/CVE-2018-12293 [ 5 ] CVE-2018-12294 https://nvd.nist.gov/vuln/detail/CVE-2018-12294 [ 6 ] CVE-2018-4101 https://nvd.nist.gov/vuln/detail/CVE-2018-4101 [ 7 ] CVE-2018-4113 https://nvd.nist.gov/vuln/detail/CVE-2018-4113 [ 8 ] CVE-2018-4114 https://nvd.nist.gov/vuln/detail/CVE-2018-4114 [ 9 ] CVE-2018-4117 https://nvd.nist.gov/vuln/detail/CVE-2018-4117 [ 10 ] CVE-2018-4118 https://nvd.nist.gov/vuln/detail/CVE-2018-4118 [ 11 ] CVE-2018-4119 https://nvd.nist.gov/vuln/detail/CVE-2018-4119 [ 12 ] CVE-2018-4120 https://nvd.nist.gov/vuln/detail/CVE-2018-4120 [ 13 ] CVE-2018-4121 https://nvd.nist.gov/vuln/detail/CVE-2018-4121 [ 14 ] CVE-2018-4122 https://nvd.nist.gov/vuln/detail/CVE-2018-4122 [ 15 ] CVE-2018-4125 https://nvd.nist.gov/vuln/detail/CVE-2018-4125 [ 16 ] CVE-2018-4127 https://nvd.nist.gov/vuln/detail/CVE-2018-4127 [ 17 ] CVE-2018-4128 https://nvd.nist.gov/vuln/detail/CVE-2018-4128 [ 18 ] CVE-2018-4129 https://nvd.nist.gov/vuln/detail/CVE-2018-4129 [ 19 ] CVE-2018-4133 https://nvd.nist.gov/vuln/detail/CVE-2018-4133 [ 20 ] CVE-2018-4146 https://nvd.nist.gov/vuln/detail/CVE-2018-4146 [ 21 ] CVE-2018-4162 https://nvd.nist.gov/vuln/detail/CVE-2018-4162 [ 22 ] CVE-2018-4163 https://nvd.nist.gov/vuln/detail/CVE-2018-4163 [ 23 ] CVE-2018-4165 https://nvd.nist.gov/vuln/detail/CVE-2018-4165 [ 24 ] CVE-2018-4190 https://nvd.nist.gov/vuln/detail/CVE-2018-4190 [ 25 ] CVE-2018-4192 https://nvd.nist.gov/vuln/detail/CVE-2018-4192 [ 26 ] CVE-2018-4199 https://nvd.nist.gov/vuln/detail/CVE-2018-4199 [ 27 ] CVE-2018-4200 https://nvd.nist.gov/vuln/detail/CVE-2018-4200 [ 28 ] CVE-2018-4201 https://nvd.nist.gov/vuln/detail/CVE-2018-4201 [ 29 ] CVE-2018-4204 https://nvd.nist.gov/vuln/detail/CVE-2018-4204 [ 30 ] CVE-2018-4214 https://nvd.nist.gov/vuln/detail/CVE-2018-4214 [ 31 ] CVE-2018-4218 https://nvd.nist.gov/vuln/detail/CVE-2018-4218 [ 32 ] CVE-2018-4222 https://nvd.nist.gov/vuln/detail/CVE-2018-4222 [ 33 ] CVE-2018-4232 https://nvd.nist.gov/vuln/detail/CVE-2018-4232 [ 34 ] CVE-2018-4233 https://nvd.nist.gov/vuln/detail/CVE-2018-4233 [ 35 ] CVE-2018-4261 https://nvd.nist.gov/vuln/detail/CVE-2018-4261 [ 36 ] CVE-2018-4262 https://nvd.nist.gov/vuln/detail/CVE-2018-4262 [ 37 ] CVE-2018-4263 https://nvd.nist.gov/vuln/detail/CVE-2018-4263 [ 38 ] CVE-2018-4264 https://nvd.nist.gov/vuln/detail/CVE-2018-4264 [ 39 ] CVE-2018-4265 https://nvd.nist.gov/vuln/detail/CVE-2018-4265 [ 40 ] CVE-2018-4266 https://nvd.nist.gov/vuln/detail/CVE-2018-4266 [ 41 ] CVE-2018-4267 https://nvd.nist.gov/vuln/detail/CVE-2018-4267 [ 42 ] CVE-2018-4270 https://nvd.nist.gov/vuln/detail/CVE-2018-4270 [ 43 ] CVE-2018-4272 https://nvd.nist.gov/vuln/detail/CVE-2018-4272 [ 44 ] CVE-2018-4273 https://nvd.nist.gov/vuln/detail/CVE-2018-4273 [ 45 ] CVE-2018-4278 https://nvd.nist.gov/vuln/detail/CVE-2018-4278 [ 46 ] CVE-2018-4284 https://nvd.nist.gov/vuln/detail/CVE-2018-4284 [ 47 ] WebKitGTK+ Security Advisory WSA-2018-0003 https://webkitgtk.org/security/WSA-2018-0003.html [ 48 ] WebKitGTK+ Security Advisory WSA-2018-0004 https://webkitgtk.org/security/WSA-2018-0004.html [ 49 ] WebKitGTK+ Security Advisory WSA-2018-0005 https://webkitgtk.org/security/WSA-2018-0005.html [ 50 ] WebKitGTK+ Security Advisory WSA-2018-0006 https://webkitgtk.org/security/WSA-2018-0006.html Availability ============ This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201808-04 Concerns? ========= Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org. License ======= Copyright 2018 Gentoo Foundation, Inc; referenced text belongs to its owner(s). The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license. https://creativecommons.org/licenses/by-sa/2.5 . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-7-23-4 Additional information for APPLE-SA-2018-06-01-6 tvOS 11.4 tvOS 11.4 addresses the following: Bluetooth Available for: Apple TV 4K Impact: An attacker in a privileged network position may be able to intercept Bluetooth traffic Description: An input validation issue existed in Bluetooth. CVE-2018-5383: Lior Neumann and Eli Biham Entry added July 23, 2018 Crash Reporter Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to gain elevated privileges Description: A memory corruption issue was addressed with improved error handling. CVE-2018-4206: Ian Beer of Google Project Zero FontParser Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing a maliciously crafted font file may lead to arbitrary code execution Description: A memory corruption issue was addressed with improved validation. CVE-2018-4211: Proteas of Qihoo 360 Nirvan Team Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to execute arbitrary code with kernel privileges Description: A buffer overflow was addressed with improved bounds checking. CVE-2018-4241: Ian Beer of Google Project Zero CVE-2018-4243: Ian Beer of Google Project Zero Kernel Available for: Apple TV 4K and Apple TV (4th generation) Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed with improved validation. CVE-2018-4249: Kevin Backhouse of Semmle Ltd. libxpc Available for: Apple TV 4K and Apple TV (4th generation) Impact: An application may be able to gain elevated privileges Description: A logic issue was addressed with improved validation. CVE-2018-4237: Samuel GroA (@5aelo) working with Trend Micro's Zero Day Initiative Messages Available for: Apple TV 4K and Apple TV (4th generation) Impact: A local user may be able to conduct impersonation attacks Description: An injection issue was addressed with improved input validation. CVE-2018-4235: Anurodh Pokharel of Salesforce.com Messages Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing a maliciously crafted message may lead to a denial of service Description: This issue was addressed with improved message validation. CVE-2018-4240: Sriram (@Sri_Hxor) of PrimeFort Pvt. Ltd Security Available for: Apple TV 4K and Apple TV (4th generation) Impact: A local user may be able to read a persistent device identifier Description: An authorization issue was addressed with improved state management. CVE-2018-4224: Abraham Masri (@cheesecakeufo) Security Available for: Apple TV 4K and Apple TV (4th generation) Impact: A local user may be able to read a persistent account identifier Description: An authorization issue was addressed with improved state management. CVE-2018-4223: Abraham Masri (@cheesecakeufo) UIKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing a maliciously crafted text file may lead to a denial of service Description: A validation issue existed in the handling of text. CVE-2018-4192: Markus Gaasedelen, Nick Burnett, and Patrick Biernat of Ret2 Systems, Inc working with Trend Micro's Zero Day Initiative WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4204: found by OSS-Fuzz, Richard Zhu (fluorescence) working with Trend Micro's Zero Day Initiative WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4200: Ivan Fratric of Google Project Zero WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4188: YoKo Kho (@YoKoAcc) of Mitra Integrasi Informatika, PT WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4201: an anonymous researcher CVE-2018-4218: Natalie Silvanovich of Google Project Zero CVE-2018-4233: Samuel GroA (@5aelo) working with Trend Micro's Zero Day Initiative WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A buffer overflow issue was addressed with improved memory handling. CVE-2018-4199: Alex Plaskett, Georgi Geshev, Fabi Beterke, and Nils of MWR Labs working with Trend Micro's Zero Day Initiative WebKit Available for: Apple TV 4K and Apple TV (4th generation) Impact: Visiting a maliciously crafted website may leak sensitive data Description: Credentials were unexpectedly sent when fetching CSS mask images. Alternatively, you may manually check for software updates by selecting "Settings -> System -> Software Update -> Update Software." To check the current version of software, select "Settings -> General -> About." Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltUsiMACgkQ8ecVjteJ iCYcZBAAusSQ6lM5Qebyc48iNEu/DUrOwUVyN6MNjo0699Xm+kbu+0u/JQNf75jw ZeelK31NLRyRx9BuK7u4J20gi+hsWI7N9wtVkeOaPiE/Ha45uEVaJ6lSSJOIZ3rZ oXb4PiL8+bSukiRgBvFhnxDwGCGefg8udRjtONRlCuMvyZAY09LT6cgZOXSEJEbF ecVmvDAEEwH1hcTV7PJbQ4nCkv97DA8dPVTbUUbtPXCOPYjsClz1JSUubOSDw3d4 7tq4pfs6ZJFZCE8JFJFY+CCIWuE1FppTE7FVJVfFdpAri+prTeGZJppzEjJDZR2g 4lCOyx926Mp5tqZx6WZc1Xkz8LJaZbEWPrfGW4wKMFIC7WPwhyi7y2NqVfcjbubW aOsfQFwbCx9KlfOfUMJtbAaha7TBiDJV5u2PMILL3ct2BRX+LqEUrlrR1uwhF5VZ npPX9cEwMbWRCj7QJC9bmRT1mPYKD+sK5HqBc7Ftp3NYv1hjhEz6iVcF7HYY9T2j aYzvsXaMilihEaDRu4H/0wLX4abUrOtUwFowuehUkNF30cgBrtyWcJl6K6/WaW2C IdmF0IB4T4MRWyPKY2r1A+rBerCaoxb0IBucOP9JO4V1uDrCoHdxEL9LfjXlz/tx CiPvy4EaV2aIDjSfkf75IXtHx2ueIFfdTGVH1OEdX9JoCSqNRPQ= =8ofX -----END PGP SIGNATURE----- . ------------------------------------------------------------------------ WebKitGTK+ and WPE WebKit Security Advisory WSA-2018-0005 ------------------------------------------------------------------------ Date reported : June 13, 2018 Advisory ID : WSA-2018-0005 WebKitGTK+ Advisory URL : https://webkitgtk.org/security/WSA-2018-0005.html WPE WebKit Advisory URL : https://wpewebkit.org/security/WSA-2018-0005.html CVE identifiers : CVE-2018-4190, CVE-2018-4192, CVE-2018-4199, CVE-2018-4201, CVE-2018-4214, CVE-2018-4218, CVE-2018-4222, CVE-2018-4232, CVE-2018-4233, CVE-2018-11646, CVE-2018-11712, CVE-2018-11713, CVE-2018-12293, CVE-2018-12294. Several vulnerabilities were discovered in WebKitGTK+ and WPE WebKit. Credit to Jun Kokatsu (@shhnjk). Impact: Visiting a maliciously crafted website may leak sensitive data. Description: Credentials were unexpectedly sent when fetching CSS mask images. This was addressed by using a CORS-enabled fetch method. Credit to Markus Gaasedelen, Nick Burnett, and Patrick Biernat of Ret2 Systems, Inc working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A race condition was addressed with improved locking. Credit to Alex Plaskett, Georgi Geshev, Fabi Beterke, and Nils of MWR Labs working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: A buffer overflow issue was addressed with improved memory handling. Credit to an anonymous researcher. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to OSS-Fuzz. Impact: Processing maliciously crafted web content may lead to an unexpected application crash. Description: A memory corruption issue was addressed with improved input validation. Credit to Natalie Silvanovich of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Natalie Silvanovich of Google Project Zero. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: An out-of-bounds read was addressed with improved input validation. Credit to Aymeric Chaib. Description: A permissions issue existed in the handling of web browser cookies. This issue was addressed with improved restrictions. Credit to Samuel Gross (@5aelo) working with Trend Micro's Zero Day Initiative. Impact: Processing maliciously crafted web content may lead to arbitrary code execution. Description: Multiple memory corruption issues were addressed with improved memory handling. Credit to Mishra Dhiraj. Maliciously crafted web content could trigger an application crash in WebKitFaviconDatabase, caused by mishandling unexpected input. Credit to Metrological Group B.V. The libsoup network backend of WebKit failed to perform TLS certificate verification for WebSocket connections. Credit to Dirkjan Ochtman. The libsoup network backend of WebKit unexpectedly failed to use system proxy settings for WebSocket connections. Credit to ADlab of Venustech. Maliciously crafted web content could achieve a heap buffer overflow in ImageBufferCairo by exploiting multiple integer overflow issues. Credit to ADlab of Venustech. Maliciously crafted web content could trigger a use-after-free of a TextureMapperLayer object. We recommend updating to the latest stable versions of WebKitGTK+ and WPE WebKit. It is the best way to ensure that you are running a safe version of WebKit. Please check our websites for information about the latest stable releases. Further information about WebKitGTK+ and WPE WebKit security advisories can be found at https://webkitgtk.org/security.html or https://wpewebkit.org/security/. The WebKitGTK+ and WPE WebKit team, June 13, 2018 . ========================================================================== Ubuntu Security Notice USN-3687-1 June 18, 2018 webkit2gtk vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 18.04 LTS - Ubuntu 17.10 - Ubuntu 16.04 LTS Summary: Several security issues were fixed in WebKitGTK+. Software Description: - webkit2gtk: Web content engine library for GTK+ Details: A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 18.04 LTS: libjavascriptcoregtk-4.0-18 2.20.3-0ubuntu0.18.04.1 libwebkit2gtk-4.0-37 2.20.3-0ubuntu0.18.04.1 Ubuntu 17.10: libjavascriptcoregtk-4.0-18 2.20.3-0ubuntu0.17.10.1 libwebkit2gtk-4.0-37 2.20.3-0ubuntu0.17.10.1 Ubuntu 16.04 LTS: libjavascriptcoregtk-4.0-18 2.20.3-0ubuntu0.16.04.1 libwebkit2gtk-4.0-37 2.20.3-0ubuntu0.16.04.1 This update uses a new upstream release, which includes additional bug fixes. After a standard system update you need to restart any applications that use WebKitGTK+, such as Epiphany, to make all the necessary changes. References: https://usn.ubuntu.com/usn/usn-3687-1 CVE-2018-12293, CVE-2018-4190, CVE-2018-4199, CVE-2018-4218, CVE-2018-4222, CVE-2018-4232, CVE-2018-4233 Package Information: https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.18.04.1 https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.17.10.1 https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.16.04.1

Trust: 2.43

sources: NVD: CVE-2018-4232 // JVNDB: JVNDB-2018-005525 // VULHUB: VHN-134263 // VULMON: CVE-2018-4232 // PACKETSTORM: 148017 // PACKETSTORM: 149059 // PACKETSTORM: 148644 // PACKETSTORM: 148200 // PACKETSTORM: 148028 // PACKETSTORM: 148027 // PACKETSTORM: 148219

AFFECTED PRODUCTS

vendor:applemodel:icloudscope:ltversion:7.5

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:18.04

Trust: 1.0

vendor:applemodel:itunesscope:ltversion:12.7.5

Trust: 1.0

vendor:applemodel:tvosscope:ltversion:11.4

Trust: 1.0

vendor:applemodel:iphone osscope:ltversion:11.4

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:16.04

Trust: 1.0

vendor:applemodel:safariscope:ltversion:11.1.1

Trust: 1.0

vendor:canonicalmodel:ubuntu linuxscope:eqversion:17.10

Trust: 1.0

vendor:canonicalmodel:ubuntuscope: - version: -

Trust: 0.8

vendor:applemodel:icloudscope:ltversion:7.5 (windows 7 or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.4 (ipad air or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.4 (iphone 5s or later )

Trust: 0.8

vendor:applemodel:iosscope:ltversion:11.4 (ipod touch first 6 generation )

Trust: 0.8

vendor:applemodel:itunesscope:ltversion:for windows 12.7.5 (windows 7 or later )

Trust: 0.8

vendor:applemodel:safariscope:ltversion:11.1.1 (macos high sierra 10.13.4)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:11.1.1 (macos sierra 10.12.6)

Trust: 0.8

vendor:applemodel:safariscope:ltversion:11.1.1 (os x el capitan 10.11.6)

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:11.4 (apple tv 4k)

Trust: 0.8

vendor:applemodel:tvosscope:ltversion:11.4 (apple tv first 4 generation )

Trust: 0.8

vendor:applemodel:iphone osscope:eqversion:1.1.0

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:8.0.0

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:7.6.2

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:7.7.1

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:7.7.0

Trust: 0.6

vendor:applemodel:itunesscope:eqversion:7.7

Trust: 0.6

sources: JVNDB: JVNDB-2018-005525 // CNNVD: CNNVD-201806-602 // NVD: CVE-2018-4232

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-4232
value: MEDIUM

Trust: 1.0

NVD: CVE-2018-4232
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201806-602
value: MEDIUM

Trust: 0.6

VULHUB: VHN-134263
value: MEDIUM

Trust: 0.1

VULMON: CVE-2018-4232
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-4232
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-134263
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-4232
baseSeverity: MEDIUM
baseScore: 4.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 1.4
version: 3.0

Trust: 1.0

NVD: CVE-2018-4232
baseSeverity: MEDIUM
baseScore: 6.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: VULHUB: VHN-134263 // VULMON: CVE-2018-4232 // JVNDB: JVNDB-2018-005525 // CNNVD: CNNVD-201806-602 // NVD: CVE-2018-4232

PROBLEMTYPE DATA

problemtype:NVD-CWE-noinfo

Trust: 1.0

problemtype:CWE-19

Trust: 0.9

sources: VULHUB: VHN-134263 // JVNDB: JVNDB-2018-005525 // NVD: CVE-2018-4232

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 148219 // CNNVD: CNNVD-201806-602

TYPE

code problem

Trust: 0.6

sources: CNNVD: CNNVD-201806-602

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-005525

PATCH

title:HT208854url:https://support.apple.com/en-us/HT208854

Trust: 0.8

title:HT208848url:https://support.apple.com/en-us/HT208848

Trust: 0.8

title:HT208850url:https://support.apple.com/en-us/HT208850

Trust: 0.8

title:HT208852url:https://support.apple.com/en-us/HT208852

Trust: 0.8

title:HT208853url:https://support.apple.com/en-us/HT208853

Trust: 0.8

title:HT208848url:https://support.apple.com/ja-jp/HT208848

Trust: 0.8

title:HT208850url:https://support.apple.com/ja-jp/HT208850

Trust: 0.8

title:HT208852url:https://support.apple.com/ja-jp/HT208852

Trust: 0.8

title:HT208853url:https://support.apple.com/ja-jp/HT208853

Trust: 0.8

title:HT208854url:https://support.apple.com/ja-jp/HT208854

Trust: 0.8

title:USN-3687-1url:https://usn.ubuntu.com/3687-1/

Trust: 0.8

title:Multiple Apple product WebKit Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80796

Trust: 0.6

title:Ubuntu Security Notice: webkit2gtk vulnerabilitiesurl:https://vulmon.com/vendoradvisory?qidtp=ubuntu_security_notice&qid=USN-3687-1

Trust: 0.1

title:Apple: Safari 11.1.1url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=a694f067de60896ce5475c3b24f85ae2

Trust: 0.1

title:Apple: iTunes 12.7.5 for Windowsurl:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=427778ba6ddba25910ede3bba3ecff86

Trust: 0.1

title:Apple: iCloud for Windows 7.5url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=02a7454fe2f6b5665d8cc96d80b7dfc4

Trust: 0.1

title:Apple: tvOS 11.4url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=d2d0b1ec71830547fb971d63ee3beadb

Trust: 0.1

title:Apple: iOS 11.4url:https://vulmon.com/vendoradvisory?qidtp=apple_security_advisories&qid=0f3db097f895347566033494c2dda90b

Trust: 0.1

title:Oracle Solaris Third Party Bulletins: Oracle Solaris Third Party Bulletin - October 2018url:https://vulmon.com/vendoradvisory?qidtp=oracle_solaris_third_party_bulletins&qid=2196fa008592287290cbd6678fbe10d4

Trust: 0.1

sources: VULMON: CVE-2018-4232 // JVNDB: JVNDB-2018-005525 // CNNVD: CNNVD-201806-602

EXTERNAL IDS

db:NVDid:CVE-2018-4232

Trust: 3.3

db:SECTRACKid:1041029

Trust: 1.8

db:JVNid:JVNVU98864649

Trust: 0.8

db:JVNDBid:JVNDB-2018-005525

Trust: 0.8

db:CNNVDid:CNNVD-201806-602

Trust: 0.7

db:VULHUBid:VHN-134263

Trust: 0.1

db:VULMONid:CVE-2018-4232

Trust: 0.1

db:PACKETSTORMid:148017

Trust: 0.1

db:PACKETSTORMid:149059

Trust: 0.1

db:PACKETSTORMid:148644

Trust: 0.1

db:PACKETSTORMid:148200

Trust: 0.1

db:PACKETSTORMid:148028

Trust: 0.1

db:PACKETSTORMid:148027

Trust: 0.1

db:PACKETSTORMid:148219

Trust: 0.1

sources: VULHUB: VHN-134263 // VULMON: CVE-2018-4232 // JVNDB: JVNDB-2018-005525 // PACKETSTORM: 148017 // PACKETSTORM: 149059 // PACKETSTORM: 148644 // PACKETSTORM: 148200 // PACKETSTORM: 148028 // PACKETSTORM: 148027 // PACKETSTORM: 148219 // CNNVD: CNNVD-201806-602 // NVD: CVE-2018-4232

REFERENCES

url:https://security.gentoo.org/glsa/201808-04

Trust: 1.9

url:https://usn.ubuntu.com/3687-1/

Trust: 1.9

url:https://support.apple.com/ht208848

Trust: 1.8

url:https://support.apple.com/ht208850

Trust: 1.8

url:https://support.apple.com/ht208852

Trust: 1.8

url:https://support.apple.com/ht208853

Trust: 1.8

url:https://support.apple.com/ht208854

Trust: 1.8

url:http://www.securitytracker.com/id/1041029

Trust: 1.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-4232

Trust: 1.5

url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4232

Trust: 0.8

url:https://jvn.jp/vu/jvnvu98864649/index.html

Trust: 0.8

url:https://nvd.nist.gov/vuln/detail/cve-2018-4233

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2018-4190

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2018-4222

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2018-4199

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2018-4218

Trust: 0.7

url:https://nvd.nist.gov/vuln/detail/cve-2018-4214

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2018-4192

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2018-4201

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2018-4204

Trust: 0.5

url:https://nvd.nist.gov/vuln/detail/cve-2018-4200

Trust: 0.5

url:https://support.apple.com/kb/ht201222

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2018-4188

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2018-4246

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2018-4224

Trust: 0.4

url:https://www.apple.com/support/security/pgp/

Trust: 0.4

url:https://nvd.nist.gov/vuln/detail/cve-2018-12293

Trust: 0.3

url:https://nvd.nist.gov/vuln/detail/cve-2018-4225

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4226

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-11713

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-11646

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-12294

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-11712

Trust: 0.2

url:https://webkitgtk.org/security/wsa-2018-0005.html

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4249

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4235

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4243

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4198

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4240

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4237

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4223

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4206

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4211

Trust: 0.2

url:https://nvd.nist.gov/vuln/detail/cve-2018-4241

Trust: 0.2

url:https://cwe.mitre.org/data/definitions/.html

Trust: 0.1

url:https://nvd.nist.gov

Trust: 0.1

url:https://support.apple.com/ht204283

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4265

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4101

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4114

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4120

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2018-0003.html

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2018-0004.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4264

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4163

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4261

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4127

Trust: 0.1

url:https://security.gentoo.org/

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4263

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4165

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4270

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4162

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4125

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4128

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4262

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4284

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4266

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4273

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4121

Trust: 0.1

url:https://webkitgtk.org/security/wsa-2018-0006.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4267

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4272

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4118

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4113

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4133

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4122

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4117

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4119

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4278

Trust: 0.1

url:https://creativecommons.org/licenses/by-sa/2.5

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4146

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-4129

Trust: 0.1

url:https://bugs.gentoo.org.

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2018-5383

Trust: 0.1

url:https://webkitgtk.org/security.html

Trust: 0.1

url:https://wpewebkit.org/security/wsa-2018-0005.html

Trust: 0.1

url:https://wpewebkit.org/security/.

Trust: 0.1

url:https://www.apple.com/itunes/download/

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.16.04.1

Trust: 0.1

url:https://usn.ubuntu.com/usn/usn-3687-1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.18.04.1

Trust: 0.1

url:https://launchpad.net/ubuntu/+source/webkit2gtk/2.20.3-0ubuntu0.17.10.1

Trust: 0.1

sources: VULHUB: VHN-134263 // VULMON: CVE-2018-4232 // JVNDB: JVNDB-2018-005525 // PACKETSTORM: 148017 // PACKETSTORM: 149059 // PACKETSTORM: 148644 // PACKETSTORM: 148200 // PACKETSTORM: 148028 // PACKETSTORM: 148027 // PACKETSTORM: 148219 // CNNVD: CNNVD-201806-602 // NVD: CVE-2018-4232

CREDITS

Apple

Trust: 0.4

sources: PACKETSTORM: 148017 // PACKETSTORM: 148644 // PACKETSTORM: 148028 // PACKETSTORM: 148027

SOURCES

db:VULHUBid:VHN-134263
db:VULMONid:CVE-2018-4232
db:JVNDBid:JVNDB-2018-005525
db:PACKETSTORMid:148017
db:PACKETSTORMid:149059
db:PACKETSTORMid:148644
db:PACKETSTORMid:148200
db:PACKETSTORMid:148028
db:PACKETSTORMid:148027
db:PACKETSTORMid:148219
db:CNNVDid:CNNVD-201806-602
db:NVDid:CVE-2018-4232

LAST UPDATE DATE

2024-11-21T20:29:20.301000+00:00


SOURCES UPDATE DATE

db:VULHUBid:VHN-134263date:2019-10-03T00:00:00
db:VULMONid:CVE-2018-4232date:2019-10-03T00:00:00
db:JVNDBid:JVNDB-2018-005525date:2018-07-20T00:00:00
db:CNNVDid:CNNVD-201806-602date:2019-10-23T00:00:00
db:NVDid:CVE-2018-4232date:2019-10-03T00:03:26.223

SOURCES RELEASE DATE

db:VULHUBid:VHN-134263date:2018-06-08T00:00:00
db:VULMONid:CVE-2018-4232date:2018-06-08T00:00:00
db:JVNDBid:JVNDB-2018-005525date:2018-07-20T00:00:00
db:PACKETSTORMid:148017date:2018-06-04T15:58:18
db:PACKETSTORMid:149059date:2018-08-23T18:40:24
db:PACKETSTORMid:148644date:2018-07-23T14:04:44
db:PACKETSTORMid:148200date:2018-06-14T18:32:22
db:PACKETSTORMid:148028date:2018-06-04T16:10:27
db:PACKETSTORMid:148027date:2018-06-04T16:10:01
db:PACKETSTORMid:148219date:2018-06-18T16:11:08
db:CNNVDid:CNNVD-201806-602date:2018-06-11T00:00:00
db:NVDid:CVE-2018-4232date:2018-06-08T18:29:01.993