var-201904-1348
Vulnerability from variot
An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2. Safari Contains a spoofing vulnerability due to incomplete handling of state management.Information may be obtained. An attacker may exploit this vulnerability to spoof the originating URL of a trusted web site. This issue may allow a remote attacker to carry out phishing-style attacks. Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with MacOSX and iOS operating systems. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
APPLE-SA-2018-7-9-5 Safari 11.1.2
Safari 11.1.2 is now available and addresses the following:
Safari Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4279: Ruilin Yang, Xu Taoyu (xia0yu.win)
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4270: found by OSS-Fuzz
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: A malicious website may exfiltrate audio data cross-origin Description: Sound fetched through audio elements may be exfiltrated cross-origin. CVE-2018-4278: Jun Kokatsu (@shhnjk)
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4284: Found by OSS-Fuzz
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: A malicious website may be able to cause a denial of service Description: A race condition was addressed with additional validation. CVE-2018-4266: found by OSS-Fuzz
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day Initiative CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero Day Initiative CVE-2018-4272: found by OSS-Fuzz
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2018-4271: found by OSS-Fuzz CVE-2018-4273: found by OSS-Fuzz
WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: A spoofing issue existed in the handling of URLs. CVE-2018-4274: an anonymous researcher
WebKit Page Loading Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4260: xisigr of Tencent's Xuanwu Lab (tencent.com)
Installation note:
Safari 11.1.2 may be obtained from the Mac App Store.
Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDyFMpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCZJ7xAA o2HCi+IV2AXcKkZ7RQiNr25U77qMoPg6t4lOd9YlRo8dD7m+aVYtL0TJxLyum3KO NjXhl/toW6Y1Y++iKfDLKtVtdX9eXTh2n4qDylPkknHCGiuYGk7VX1xh10EDvWLN uIHEBj/WF9+d7uAv2XrKzfyQ8rTzL960UUywBchO2HfVPk74x27+AVXzcb2Yu98m DkwtODwQtTtINqdMerdCuIGWM3BN1iwzxxX16c+hPuuDP7HTE77TNZrzz09FC4M9 ikMG8JvZmkBWEZaGnb/IRrRJWhZ+k1s33YNFc8wKt8wMsgGvV+l5Bndb7D2d3qQC BHyvokfiWLdVeUAdLpli7RcRgRZDYkaC/Y76VIaZH5frp/bAUm2mb3C6uAaQVR8+ 4f6r9go/gnkQzoNPZuqvzGsi6Nr+gl2B91SqgUdTF5fRw9zXFk7mgkcOYmzsj2uq ZdsRx+i0kkmzZYyffSNU8Y8PCHwnPj9a9D3UThJgAz7HKThI5fH5tbyxKV2wjlPb KBAWkgqMGkwWmsMNLpNJbABbK7TZhOGASb9776n2ZFOWS2u9KNbqNpALZFvaCA/0 uu9Y4aUPPPpz+/c87IviLC2HTUOOKmvhuIGWJF5sKVc8y83b7Loi/P5K90EwiF3i /7DbcAOdfMAEdgDygzzQSzRV97EQWYpLDr97VLCPGI4= =bv9B -----END PGP SIGNATURE-----
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201904-1348", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "safari", "scope": "lt", "trust": 1.0, "vendor": "apple", "version": "11.1.2" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "11.1.2 (macos high sierra 10.13.6)" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "11.1.2 (macos sierra 10.12.6)" }, { "model": "safari", "scope": "lt", "trust": 0.8, "vendor": "apple", "version": "11.1.2 (os x el capitan 10.11.6)" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.8" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.8" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.8" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.10" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.6" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "2.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.3.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.3.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.2.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.2.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.2.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "1.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "9" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.7" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "8.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.7" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "7.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.7" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "6.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.34" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.33" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.31" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.7" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.5" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "5.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.31" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.30" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.28" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4.0" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "4" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.52" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.1.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.1" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.0.3" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.0.2" }, { "model": "safari", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10" }, { "model": "macos", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.13.6" }, { "model": "macos", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "10.12.6" }, { "model": "mac os", "scope": "eq", "trust": 0.3, "vendor": "apple", "version": "x10.11.6" }, { "model": "safari", "scope": "ne", "trust": 0.3, "vendor": "apple", "version": "11.1.2" } ], "sources": [ { "db": "BID", "id": "104749" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "cpe_match": [ { "cpe22Uri": "cpe:/a:apple:safari", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-014834" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Ruilin Yang, Xu Taoyu (xia0yu.win)", "sources": [ { "db": "BID", "id": "104749" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" } ], "trust": 0.9 }, "cve": "CVE-2018-4279", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "CVE-2018-4279", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 1.8, "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 10.0, "id": "VHN-134310", "impactScore": 2.9, "integrityImpact": "NONE", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "nvd@nist.gov", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "exploitabilityScore": 3.9, "id": "CVE-2018-4279", "impactScore": 1.4, "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.8, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.0" } ], "severity": [ { "author": "nvd@nist.gov", "id": "CVE-2018-4279", "trust": 1.0, "value": "MEDIUM" }, { "author": "NVD", "id": "CVE-2018-4279", "trust": 0.8, "value": "Medium" }, { "author": "CNNVD", "id": "CNNVD-201807-2000", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-134310", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-134310" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "An inconsistent user interface issue was addressed with improved state management. This issue affected versions prior to Safari 11.1.2. Safari Contains a spoofing vulnerability due to incomplete handling of state management.Information may be obtained. \nAn attacker may exploit this vulnerability to spoof the originating URL of a trusted web site. This issue may allow a remote attacker to carry out phishing-style attacks. Apple Safari is a web browser developed by Apple (Apple), and is the default browser included with MacOSX and iOS operating systems. Currently there is no information about this vulnerability, please keep an eye on CNNVD or vendor announcements. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\nAPPLE-SA-2018-7-9-5 Safari 11.1.2\n\nSafari 11.1.2 is now available and addresses the following:\n\nSafari\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2018-4279: Ruilin Yang, Xu Taoyu (xia0yu.win)\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: A memory corruption issue was addressed with improved\nmemory handling. \nCVE-2018-4270: found by OSS-Fuzz\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: A malicious website may exfiltrate audio data cross-origin\nDescription: Sound fetched through audio elements may be exfiltrated\ncross-origin. \nCVE-2018-4278: Jun Kokatsu (@shhnjk)\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: A type confusion issue was addressed with improved\nmemory handling. \nCVE-2018-4284: Found by OSS-Fuzz\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: A malicious website may be able to cause a denial of service\nDescription: A race condition was addressed with additional\nvalidation. \nCVE-2018-4266: found by OSS-Fuzz\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Processing maliciously crafted web content may lead to\narbitrary code execution\nDescription: Multiple memory corruption issues were addressed with\nimproved memory handling. \nCVE-2018-4261: Omair working with Trend Micro\u0027s Zero Day Initiative\nCVE-2018-4262: Mateusz Krzywicki working with Trend Micro\u0027s Zero Day\nInitiative\nCVE-2018-4263: Arayz working with Trend Micro\u0027s Zero Day Initiative\nCVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of\nAnt-financial Light-Year Security Lab\nCVE-2018-4265: cc working with Trend Micro\u0027s Zero Day Initiative\nCVE-2018-4267: Arayz of Pangu team working with Trend Micro\u0027s Zero\nDay Initiative\nCVE-2018-4272: found by OSS-Fuzz\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Processing maliciously crafted web content may lead to an\nunexpected Safari crash\nDescription: Multiple memory corruption issues were addressed with\nimproved input validation. \nCVE-2018-4271: found by OSS-Fuzz\nCVE-2018-4273: found by OSS-Fuzz\n\nWebKit\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: A spoofing issue existed in the handling of URLs. \nCVE-2018-4274: an anonymous researcher\n\nWebKit Page Loading\nAvailable for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and\nmacOS High Sierra 10.13.6\nImpact: Visiting a malicious website may lead to address bar spoofing\nDescription: An inconsistent user interface issue was addressed with\nimproved state management. \nCVE-2018-4260: xisigr of Tencent\u0027s Xuanwu Lab (tencent.com)\n\nInstallation note:\n\nSafari 11.1.2 may be obtained from the Mac App Store. \n\nInformation will also be posted to the Apple Security Updates\nweb site: https://support.apple.com/kb/HT201222\n\nThis message is signed with Apple\u0027s Product Security PGP key,\nand details are available at:\nhttps://www.apple.com/support/security/pgp/\n-----BEGIN PGP SIGNATURE-----\n\niQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDyFMpHHByb2R1Y3Qt\nc2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCZJ7xAA\no2HCi+IV2AXcKkZ7RQiNr25U77qMoPg6t4lOd9YlRo8dD7m+aVYtL0TJxLyum3KO\nNjXhl/toW6Y1Y++iKfDLKtVtdX9eXTh2n4qDylPkknHCGiuYGk7VX1xh10EDvWLN\nuIHEBj/WF9+d7uAv2XrKzfyQ8rTzL960UUywBchO2HfVPk74x27+AVXzcb2Yu98m\nDkwtODwQtTtINqdMerdCuIGWM3BN1iwzxxX16c+hPuuDP7HTE77TNZrzz09FC4M9\nikMG8JvZmkBWEZaGnb/IRrRJWhZ+k1s33YNFc8wKt8wMsgGvV+l5Bndb7D2d3qQC\nBHyvokfiWLdVeUAdLpli7RcRgRZDYkaC/Y76VIaZH5frp/bAUm2mb3C6uAaQVR8+\n4f6r9go/gnkQzoNPZuqvzGsi6Nr+gl2B91SqgUdTF5fRw9zXFk7mgkcOYmzsj2uq\nZdsRx+i0kkmzZYyffSNU8Y8PCHwnPj9a9D3UThJgAz7HKThI5fH5tbyxKV2wjlPb\nKBAWkgqMGkwWmsMNLpNJbABbK7TZhOGASb9776n2ZFOWS2u9KNbqNpALZFvaCA/0\nuu9Y4aUPPPpz+/c87IviLC2HTUOOKmvhuIGWJF5sKVc8y83b7Loi/P5K90EwiF3i\n/7DbcAOdfMAEdgDygzzQSzRV97EQWYpLDr97VLCPGI4=\n=bv9B\n-----END PGP SIGNATURE-----\n", "sources": [ { "db": "NVD", "id": "CVE-2018-4279" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "BID", "id": "104749" }, { "db": "VULHUB", "id": "VHN-134310" }, { "db": "PACKETSTORM", "id": "148469" } ], "trust": 2.07 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2018-4279", "trust": 2.9 }, { "db": "JVN", "id": "JVNVU93082496", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2018-014834", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201807-2000", "trust": 0.7 }, { "db": "BID", "id": "104749", "trust": 0.4 }, { "db": "VULHUB", "id": "VHN-134310", "trust": 0.1 }, { "db": "PACKETSTORM", "id": "148469", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-134310" }, { "db": "BID", "id": "104749" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "PACKETSTORM", "id": "148469" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "id": "VAR-201904-1348", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-134310" } ], "trust": 0.01 }, "last_update_date": "2024-11-23T21:08:33.512000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "HT208934", "trust": 0.8, "url": "https://support.apple.com/en-us/HT208934" }, { "title": "HT208934", "trust": 0.8, "url": "https://support.apple.com/ja-jp/HT208934" }, { "title": "Apple Safari Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=82728" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-20", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-134310" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 1.7, "url": "https://support.apple.com/kb/ht208934" }, { "trust": 1.5, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4279" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-4279" }, { "trust": 0.8, "url": "https://jvn.jp/vu/jvnvu93082496/index.html" }, { "trust": 0.3, "url": "http://www.apple.com/safari/" }, { "trust": 0.3, "url": "https://support.apple.com/en-us/ht201222" }, { "trust": 0.3, "url": "https://lists.apple.com/archives/security-announce/2018/jul/msg00004.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4265" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4260" }, { "trust": 0.1, "url": "https://support.apple.com/kb/ht201222" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4267" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4264" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4271" }, { "trust": 0.1, "url": "https://www.apple.com/support/security/pgp/" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4272" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4274" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4278" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4262" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4261" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4266" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4273" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4263" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4284" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2018-4270" } ], "sources": [ { "db": "VULHUB", "id": "VHN-134310" }, { "db": "BID", "id": "104749" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "PACKETSTORM", "id": "148469" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-134310" }, { "db": "BID", "id": "104749" }, { "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "db": "PACKETSTORM", "id": "148469" }, { "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "db": "NVD", "id": "CVE-2018-4279" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-03T00:00:00", "db": "VULHUB", "id": "VHN-134310" }, { "date": "2018-07-09T00:00:00", "db": "BID", "id": "104749" }, { "date": "2019-04-16T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "date": "2018-07-09T21:11:11", "db": "PACKETSTORM", "id": "148469" }, { "date": "2018-07-31T00:00:00", "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "date": "2019-04-03T18:29:05.033000", "db": "NVD", "id": "CVE-2018-4279" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-04-04T00:00:00", "db": "VULHUB", "id": "VHN-134310" }, { "date": "2018-07-09T00:00:00", "db": "BID", "id": "104749" }, { "date": "2019-04-16T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-014834" }, { "date": "2019-04-08T00:00:00", "db": "CNNVD", "id": "CNNVD-201807-2000" }, { "date": "2024-11-21T04:07:06.857000", "db": "NVD", "id": "CVE-2018-4279" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201807-2000" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Safari Spoofing vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-014834" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "input validation error", "sources": [ { "db": "CNNVD", "id": "CNNVD-201807-2000" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.