Memory corruption in Apple Safari - CVE-2018-4200

Vulnerability identifier: #VU12145

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-4200

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to boundary error in the WebKit component when handling malicious input. A remote attacker can trick the victim into loading a specially crafted web content, trigger memory corruption and execute arbitrary code with elevated privileges.

Apple Safari
Arch Linux
Gentoo Linux
tvOS
Apple iOS
Fedora
Opensuse
iCloud for Windows
iTunes
webkitgtk4
webkit2gtk3

Update to version 11.1.

webkitgtk4 - addressed in versions 2.20.2-1.fc26, 2.20.2-1.fc27
webkit2gtk3 - update to 2.20.2-1.fc28

• https://support.apple.com/en-us/HT208741

• Remote code execution in Apple Safari
• Multiple vulnerabilities in Apple iOS
• Arch Linux update for webkit2gtk
• Multiple vulnerabilities in Apple tvOS
• Multiple vulnerabilities in Apple iTunes
• Multiple vulnerabilities in Apple iCloud
• Gentoo update for WebkitGTK+
• OpenSUSE Linux update for webkit2gtk3
• Fedora 27 update for webkitgtk4
• Fedora 28 update for webkit2gtk3
• Fedora 26 update for webkitgtk4