var-201904-1330
Vulnerability from variot
A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Mojave Contains a memory corruption vulnerability due to a flaw in memory handling.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra
macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra are now available and addresses the following:
Airport Available for: macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4303: Mohamed Ghannam (@_simo36)
AMD Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to read restricted memory Description: A validation issue was addressed with improved input sanitization. CVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security Research Team
Carbon Core Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com)
Disk Images Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4465: Pangu Team
Intel Graphics Driver Available for: macOS Mojave 10.14.1 Impact: A local user may be able to cause unexpected system termination or read kernel memory Description: An out-of-bounds read was addressed with improved input validation. CVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team
IOHIDFamily Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4427: Pangu Team
Kernel Available for: macOS Mojave 10.14.1 Impact: An attacker in a privileged position may be able to perform a denial of service attack Description: A denial of service issue was addressed by removing the vulnerable code. CVE-2018-4460: Kevin Backhouse of Semmle Security Research Team
Kernel Available for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A local user may be able to read kernel memory Description: A memory initialization issue was addressed with improved memory handling. CVE-2018-4431: An independent security researcher has reported this vulnerability to Beyond Security's SecuriTeam Secure Disclosure program
Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved state management. CVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro Mobile Security Team
Kernel Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: A malicious application may be able to elevate privileges Description: A logic issue was addressed with improved restrictions. CVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII) and Junzhi Lu of TrendMicro Mobile Security Team
Kernel Available for: macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with kernel privileges Description: A memory corruption issue was addressed with improved input validation. CVE-2018-4461: Ian Beer of Google Project Zero
WindowServer Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS Mojave 10.14.1 Impact: An application may be able to execute arbitrary code with system privileges Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab CVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin Security Research Lab
Additional recognition
LibreSSL We would like to acknowledge Keegan Ryan of NCC Group for their assistance.
NetAuth We would like to acknowledge Vladimir Ivanov of Digital Security for their assistance.
Simple certificate enrollment protocol (SCEP) We would like to acknowledge Tim Cappalli of Aruba and a Hewlett Packard Enterprise company for their assistance.
Installation note:
macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra may be obtained from the Mac App Store or Apple's Software Downloads web site: https://support.apple.com/downloads/
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw// fUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p 5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ jr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH IzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG cqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf LBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY 1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp 6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk WRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj ar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU +61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201904-1330",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mac os x",
"scope": "lt",
"trust": 1.0,
"vendor": "apple",
"version": "10.14.2"
},
{
"model": "icloud",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "for windows 7.9 earlier"
},
{
"model": "ios",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.1.1 earlier"
},
{
"model": "itunes",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.9.2 for windows earlier"
},
{
"model": "macos high sierra",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "(security update 2018-003 not applied )"
},
{
"model": "macos mojave",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "10.14.2 earlier"
},
{
"model": "macos sierra",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "(security update 2018-006 not applied )"
},
{
"model": "safari",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.0.2 earlier"
},
{
"model": "tvos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "12.1.1 earlier"
},
{
"model": "watchos",
"scope": "lt",
"trust": 0.8,
"vendor": "apple",
"version": "5.1.2 earlier"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.12.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.13.6"
},
{
"model": "mac os x",
"scope": "eq",
"trust": 0.8,
"vendor": "apple",
"version": "10.14.1"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/a:apple:icloud",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:iphone_os",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:itunes",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_high_sierra",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_mojave",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:mac_os_sierra",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/a:apple:safari",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:apple_tv",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/o:apple:watchos",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Apple",
"sources": [
{
"db": "PACKETSTORM",
"id": "150669"
}
],
"trust": 0.1
},
"cve": "CVE-2018-4450",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "CVE-2018-4450",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 1.8,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 8.6,
"id": "VHN-134481",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 1.8,
"id": "CVE-2018-4450",
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2018-4450",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "NVD",
"id": "CVE-2018-4450",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201812-222",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-134481",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "A memory corruption issue was addressed with improved memory handling. This issue affected versions prior to macOS Mojave 10.14.2. Apple Has released an update for each product.The expected impact depends on each vulnerability, but can be affected as follows: * Privilege escalation * Access restriction avoidance * Arbitrary code execution * Service operation interruption (DoS) * information leak * Incorrect configuration profile usage * UI Spoofing * Address bar impersonation. macOS Mojave Contains a memory corruption vulnerability due to a flaw in memory handling.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2018-12-05-2 macOS Mojave 10.14.2, Security Update\n2018-003 High Sierra, Security Update 2018-006 Sierra\n\nmacOS Mojave 10.14.2, Security Update 2018-003 High Sierra,\nSecurity Update 2018-006 Sierra are now available\nand addresses the following:\n\nAirport\nAvailable for: macOS Mojave 10.14.1\nImpact: A malicious application may be able to elevate privileges\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2018-4303: Mohamed Ghannam (@_simo36)\n\nAMD\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.1\nImpact: An application may be able to read restricted memory\nDescription: A validation issue was addressed with improved input\nsanitization. \nCVE-2018-4462: Lilang Wu and Moony Li of TrendMicro Mobile Security\nResearch Team\n\nCarbon Core\nAvailable for: macOS Mojave 10.14.1\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4463: Maksymilian Arciemowicz (cxsecurity.com)\n\nDisk Images\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.1\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4465: Pangu Team\n\nIntel Graphics Driver\nAvailable for: macOS Mojave 10.14.1\nImpact: A local user may be able to cause unexpected system\ntermination or read kernel memory\nDescription: An out-of-bounds read was addressed with improved input\nvalidation. \nCVE-2018-4434: Zhuo Liang of Qihoo 360 Nirvan Team\n\nIOHIDFamily\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4427: Pangu Team\n\nKernel\nAvailable for: macOS Mojave 10.14.1\nImpact: An attacker in a privileged position may be able to perform a\ndenial of service attack\nDescription: A denial of service issue was addressed by removing the\nvulnerable code. \nCVE-2018-4460: Kevin Backhouse of Semmle Security Research Team\n\nKernel\nAvailable for: macOS High Sierra 10.13.6, macOS Mojave 10.14.1\nImpact: A local user may be able to read kernel memory\nDescription: A memory initialization issue was addressed with\nimproved memory handling. \nCVE-2018-4431: An independent security researcher has reported this\nvulnerability to Beyond Security\u0027s SecuriTeam Secure Disclosure\nprogram\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.1\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\nstate management. \nCVE-2018-4447: Juwei Lin(@panicaII) and Zhengyu Dong of TrendMicro\nMobile Security Team\n\nKernel\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.1\nImpact: A malicious application may be able to elevate privileges\nDescription: A logic issue was addressed with improved restrictions. \nCVE-2018-4435: Jann Horn of Google Project Zero, Juwei Lin(@panicaII)\nand Junzhi Lu of TrendMicro Mobile Security Team\n\nKernel\nAvailable for: macOS Mojave 10.14.1\nImpact: An application may be able to execute arbitrary code with\nkernel privileges\nDescription: A memory corruption issue was addressed with improved\ninput validation. \nCVE-2018-4461: Ian Beer of Google Project Zero\n\nWindowServer\nAvailable for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS\nMojave 10.14.1\nImpact: An application may be able to execute arbitrary code with\nsystem privileges\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4449: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin\nSecurity Research Lab\nCVE-2018-4450: Hanqing Zhao, Yufeng Ruan and Kun Yang of Chaitin\nSecurity Research Lab\n\nAdditional recognition\n\nLibreSSL\nWe would like to acknowledge Keegan Ryan of NCC Group for their\nassistance. \n\nNetAuth\nWe would like to acknowledge Vladimir Ivanov of Digital Security for\ntheir assistance. \n\nSimple certificate enrollment protocol (SCEP)\nWe would like to acknowledge Tim Cappalli of Aruba and a Hewlett\nPackard Enterprise company for their assistance. \n\nInstallation note:\n\nmacOS Mojave 10.14.2, Security Update 2018-003 High Sierra,\nSecurity Update 2018-006 Sierra may be\nobtained from the Mac App Store or Apple\u0027s Software Downloads\nweb site: https://support.apple.com/downloads/\n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlwINzopHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FxTw//\nfUx30FH3eQXRRc/dlM5LgBdDqx/TOHtSwjiTLkVRHC1czz9ledAmHmGkg00z6b+p\n5LsZNaZRUF3FVxuWUcm0rQQ+MpSj+BpCDZX0X+pXHX+QvNjad8ZcQsIqjtnJ1omZ\njr2eUQtnkmbnaFX+TiesIN8tGBQ2Gve1/fqzrXdpqlF6j9U76gw4djI4JbAnLGxH\nIzjIp1FukQy1phfZZcHd++aEHvsQeJ0bT0INajqtNOkDQSZ0H7/NIW1BoUQlcpLG\ncqz+dwTYFwfqvNUmQ5PUTFXQJHxiVBRgMDdyesrVSKSuvEqTNAQKCOXMxayVbotf\nLBlghqpPr2XTS7enRkY87BU+aSdTTzjTX7fvQBOQgAJPb7L3FXhA/dCTHWV3RyWY\n1qrTFOIvbfAtCjsBIqHC0nD5GWXB7vuxPvcYQXlNYl/MxMv3vAANHi8aI+YJ8Usp\n6qLLD02Z4H4E8ZpmakqqFJT6ORGUIBpvqG9rYxhACTe/z2uqZ7scD4I4crpfPIIk\nWRyh17q87z+dTCIS4P9PbYdrx7Y8SHN8K9uaBmZVq9WqaAVtCet9S0zNBrLai2Sj\nar3y5Sgso7RMI5KhB0IGNyS2LZL0a3ypQVfVEWpxoRjIHyI2sJSPAuXOLrwV6pRU\n+61jWoLyn0cbMWMEhfrw/ulTOcMBjIXV7EHZNge8H5Ex+L\n-----END PGP SIGNATURE-----\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-4450"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "PACKETSTORM",
"id": "150669"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-4450",
"trust": 2.6
},
{
"db": "JVN",
"id": "JVNVU92431031",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010217",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-134481",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "150669",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "PACKETSTORM",
"id": "150669"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"id": "VAR-201904-1330",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-134481"
}
],
"trust": 0.01
},
"last_update_date": "2024-11-23T20:05:32.496000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "About the security content of macOS Mojave 10.14.2, Security Update 2018-003 High Sierra, Security Update 2018-006 Sierra",
"trust": 1.6,
"url": "https://support.apple.com/en-us/HT209341"
},
{
"title": "About the security content of tvOS 12.1.1",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT209342"
},
{
"title": "About the security content of watchOS 5.1.2",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT209343"
},
{
"title": "About the security content of Safari 12.0.2",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT209344"
},
{
"title": "About the security content of iCloud for Windows 7.9",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT209346"
},
{
"title": "About the security content of iOS 12.1.1",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT209340"
},
{
"title": "About the security content of iTunes 12.9.2 for Windows",
"trust": 0.8,
"url": "https://support.apple.com/en-us/HT209345"
},
{
"title": "HT209341",
"trust": 0.8,
"url": "https://support.apple.com/ja-jp/HT209341"
},
{
"title": "Apple macOS WindowServer Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=87511"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-119",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "https://support.apple.com/kb/ht209341"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4450"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu92431031/"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4450"
},
{
"trust": 0.8,
"url": "https://jvn.jp/vu/jvnvu92431031/index.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4447"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4303"
},
{
"trust": 0.1,
"url": "https://support.apple.com/kb/ht201222"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4431"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4465"
},
{
"trust": 0.1,
"url": "https://www.apple.com/support/security/pgp/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4427"
},
{
"trust": 0.1,
"url": "https://support.apple.com/downloads/"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4460"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4463"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4449"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4434"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4435"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4462"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-4461"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "PACKETSTORM",
"id": "150669"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-134481"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"db": "PACKETSTORM",
"id": "150669"
},
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-04-03T00:00:00",
"db": "VULHUB",
"id": "VHN-134481"
},
{
"date": "2018-12-07T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"date": "2019-04-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"date": "2018-12-06T18:55:48",
"db": "PACKETSTORM",
"id": "150669"
},
{
"date": "2018-12-06T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"date": "2019-04-03T18:29:16.907000",
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-04-05T00:00:00",
"db": "VULHUB",
"id": "VHN-134481"
},
{
"date": "2018-12-10T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-010217"
},
{
"date": "2019-04-17T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-014857"
},
{
"date": "2019-04-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201812-222"
},
{
"date": "2024-11-21T04:07:25.987000",
"db": "NVD",
"id": "CVE-2018-4450"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Apple Updates to product vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-010217"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "buffer error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201812-222"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.