CVSS: 8.8EPSS: 0%CPEs: 9EXPL: 0CVE-2018-4262 – Apple Safari RegExp Exec Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-4262
In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, multiple memory corruption issues were addressed with improved memory handling. En Safari en versiones anteriores a la 11.1.2, iTunes en versiones anteriores a la 12.8 para Windows, iOS en versiones anteriores a la 11.4.1, tvOS en versiones anteriores a la 11.4.1 e iCloud para Windows en versiones anteriores a la 7.6, se abordaron múltiples problemas de corrupción de memoria mediante la mejora de la gestión de memoria. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Apple Safari. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of RegExp's exec method in JIT. By performing actions in JavaScript, an attacker can trigger a type confusion condition. • http://www.securitytracker.com/id/1041232 https://security.gentoo.org/glsa/201808-04 https://support.apple.com/HT208934%2C https://support.apple.com/HT208935 https://support.apple.com/HT208938%2C https://usn.ubuntu.com/3743-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.5EPSS: 10%CPEs: 8EXPL: 1CVE-2018-4192 – JavaScript Core - Arbitrary Code Execution
https://notcve.org/view.php?id=CVE-2018-4192
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a race condition. Se ha descubierto un problema en algunos productos Apple. • https://www.exploit-db.com/exploits/45048 http://www.securitytracker.com/id/1041029 https://security.gentoo.org/glsa/201808-04 https://support.apple.com/HT208848 https://support.apple.com/HT208850 https://support.apple.com/HT208851 https://support.apple.com/HT208852 https://support.apple.com/HT208853 https://support.apple.com/HT208854 • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') •
CVSS: 4.3EPSS: 0%CPEs: 10EXPL: 0CVE-2018-4232
https://notcve.org/view.php?id=CVE-2018-4232
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to overwrite cookies via a crafted web site. Se ha descubierto un problema en algunos productos Apple. • http://www.securitytracker.com/id/1041029 https://security.gentoo.org/glsa/201808-04 https://support.apple.com/HT208848 https://support.apple.com/HT208850 https://support.apple.com/HT208852 https://support.apple.com/HT208853 https://support.apple.com/HT208854 https://usn.ubuntu.com/3687-1 •
CVSS: 8.8EPSS: 1%CPEs: 11EXPL: 1CVE-2018-4233 – Apple Safari CreateThis Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2018-4233
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site. Se ha descubierto un problema en algunos productos Apple. • https://www.exploit-db.com/exploits/45998 http://packetstormsecurity.com/files/153148/Safari-Webkit-Proxy-Object-Type-Confusion.html http://www.securitytracker.com/id/1041029 https://security.gentoo.org/glsa/201808-04 https://support.apple.com/HT208848 https://support.apple.com/HT208850 https://support.apple.com/HT208851 https://support.apple.com/HT208852 https://support.apple.com/HT208853 https://support.apple.com/HT208854 https://usn.ubuntu.com/3687-1 https://github.com/sa • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2018-4190
https://notcve.org/view.php?id=CVE-2018-4190
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch. Se ha descubierto un problema en algunos productos Apple. • http://www.securitytracker.com/id/1041029 https://security.gentoo.org/glsa/201808-04 https://support.apple.com/HT208848 https://support.apple.com/HT208850 https://support.apple.com/HT208852 https://support.apple.com/HT208853 https://support.apple.com/HT208854 https://usn.ubuntu.com/3687-1 • CWE-522: Insufficiently Protected Credentials •