CVE-2018-4117
Summary
| CVE | CVE-2018-4117 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2018-04-03 06:29:00 UTC |
|---|
| Updated | 2018-11-09 17:58:00 UTC |
|---|
| Description | An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| About the security content of iTunes 12.7.4 for Windows - Apple Support |
CONFIRM |
support.apple.com |
Vendor Advisory |
| Chromium, Google Chrome: Multiple vulnerabilities (GLSA 201808-01) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| About the security content of iCloud for Windows 7.4 - Apple Support |
CONFIRM |
support.apple.com |
Vendor Advisory |
| Red Hat Customer Portal |
REDHAT |
access.redhat.com |
Third Party Advisory |
| About the security content of iOS 11.3 - Apple Support |
CONFIRM |
support.apple.com |
Vendor Advisory |
| Google Chrome Prior to 68.0.3440.75 Multiple Security Vulnerabilities |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| About the security content of Safari 11.1 - Apple Support |
CONFIRM |
support.apple.com |
Vendor Advisory |
| Debian -- Security Information -- DSA-4256-1 chromium-browser |
DEBIAN |
www.debian.org |
Third Party Advisory |
| WebkitGTK+: Multiple vulnerabilities (GLSA 201808-04) — Gentoo security |
GENTOO |
security.gentoo.org |
Third Party Advisory |
| USN-3635-1: WebKitGTK+ vulnerabilities | Ubuntu security notices |
UBUNTU |
usn.ubuntu.com |
Third Party Advisory |
| Apple iOS Multiple Flaws Let Remote Users Execute Arbitrary Code, Deny Service, and Spoof the User Interface, Remote and Local Users Bypass Security Restrictions and Obtain Potentially Sensitive Information, and Let Applications Gain Elevated Privileges - SecurityTracker |
SECTRACK |
www.securitytracker.com |
Third Party Advisory, VDB Entry |
| About the security content of watchOS 4.3 - Apple Support |
CONFIRM |
support.apple.com |
Vendor Advisory |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710228 Gentoo Linux WebkitGTK+ Multiple Vulnerabilities (GLSA 201808-04)
- 710239 Gentoo Linux Chromium, Google Chrome Multiple Vulnerabilities (GLSA 201808-01)
