Resource exhaustion in Apple iOS - CVE-2018-4409
Published: October 31, 2018
Vulnerability identifier: #VU15657
CSH Severity: Low
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-4409
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists due to resource exhaustion in Webkit component when handling malicious input. A remote attacker can trick the victim into visiting a specially crafted website, consume excessive resources and cause the service to crash.
Affected software
Apple iOS
tvOS
iCloud for Windows
Apple Safari
iTunes
tvOS
iCloud for Windows
Apple Safari
iTunes
How to mitigate CVE-2018-4409
Update to version 12.1.
Apple iOS - update to 12.1 16B92
iCloud for Windows - update to 7.8
tvOS - update to 12.1
Apple Safari - update to 12.0.1
iTunes - update to 12.9.1
iCloud for Windows - update to 7.8
tvOS - update to 12.1
Apple Safari - update to 12.0.1
iTunes - update to 12.9.1