Vulnerability CVE-2018-4271

Vulnerability Name:

CVE-2018-4271 (CCN-146482)

Assigned:

2018-07-09

Published:

2018-07-09

Updated:

2019-10-03

Summary:

Multiple memory corruption issues were addressed with improved input validation. This issue affected versions prior to iOS 11.4.1, tvOS 11.4.1, watchOS 4.3.2, Safari 11.1.2, iTunes 12.8 for Windows, iCloud for Windows 7.6.

CVSS v3 Severity:

6.5 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
5.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): High

4.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Denial of Service

References:

Source: MITRE
Type: CNA
CVE-2018-4271

Source: XF
Type: UNKNOWN
apple-safari-cve20184271-dos(146482)

Source: CCN
Type: Apple security document HT208934
About the security content of Safari 11.1.2

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208932

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208933

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208934

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208935

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208936

Source: MISC
Type: Vendor Advisory
https://support.apple.com/kb/HT208938

Vulnerable Configuration:

Configuration 1:

cpe:/a:apple:safari:*:*:*:*:*:*:*:* (Version < 11.1.2)

OR cpe:/o:apple:iphone_os:*:*:*:*:*:*:*:* (Version < 11.4.1)

OR cpe:/o:apple:tvos:*:*:*:*:*:*:*:* (Version < 11.4.1)

OR cpe:/o:apple:watchos:*:*:*:*:*:*:*:* (Version < 4.3.2)

Configuration 2:

cpe:/a:apple:icloud:*:*:*:*:*:*:*:* (Version < 7.6)

OR cpe:/a:apple:itunes:*:*:*:*:*:*:*:* (Version < 12.8)

AND

cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:apple:safari:11.1.1:*:*:*:*:*:*:*

AND

cpe:/o:apple:macos_sierra:10.12.6:*:*:*:*:*:*:*

OR cpe:/o:apple:macos_high_sierra:10.13.6:*:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:org.opensuse.security:def:20184271	V	CVE-2018-4271	2022-09-01
oval:org.opensuse.security:def:1229	P	Security update for the Linux Kernel (Important)	2022-03-30
oval:org.opensuse.security:def:49187	P	Security update for compat-openssl098 (Important)	2021-08-27
oval:org.opensuse.security:def:48207	P	libtiff5-32bit-4.0.9-44.30.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47746	P	libmysqlclient18-10.0.35-1.7 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48075	P	libXext6-1.3.2-4.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47882	P	ruby-2.1-1.4 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47761	P	libpcre1-32bit-8.39-8.3.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:47747	P	libncurses5-32bit-5.9-58.1 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:48299	P	rtkit-0.11_git201205151338-8.14 on GA media (Moderate)	2021-08-16
oval:org.opensuse.security:def:1969	P	libnss_slurm2-20.11.5-2.1 on GA media (Moderate)	2021-08-10
oval:org.opensuse.security:def:1952	P	python3-tools-3.6.13-3.78.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1947	P	perl-PerlMagick-7.0.7.34-10.15.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1943	P	perl-Config-IniFiles-2.94-1.23 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:1941	P	pam-devel-32bit-1.3.0-6.29.1 on GA media (Moderate)	2021-08-09
oval:org.opensuse.security:def:48459	P	libMagickCore-6_Q16-1-6.8.8.1-33.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48807	P	libvirt-client-32bit-2.0.0-26.2 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48939	P	libpcsclite1-32bit-1.8.10-7.3.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48458	P	libIlmImf-Imf_2_1-21-2.1.0-4.3 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48903	P	gd-32bit-2.1.0-24.9.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48745	P	libsilc-1_1-2-1.1.10-24.128 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48798	P	libproxy1-networkmanager-32bit-0.4.13-16.6 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48661	P	ImageMagick-6.8.8.1-5.21 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48600	P	perl-YAML-LibYAML-0.38-10.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48447	P	iputils-s20121221-2.17 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48475	P	libXv1-1.0.10-3.56 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:48872	P	libssh4-0.6.3-11.1 on GA media (Moderate)	2021-06-08
oval:org.opensuse.security:def:1986	P	ntp-4.2.8p13-4.6.1 on GA media (Moderate)	2021-04-29
oval:org.opensuse.security:def:1998	P	pam-modules-12.1-3.17 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1996	P	ntp-4.2.8p13-4.6.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1991	P	java-1_8_0-ibm-1.8.0_sr6.5-3.33.2 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:49033	P	libraw9-0.15.4-30.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:48974	P	argyllcms-1.6.3-3.3 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:51081	P	Security update for gdm (Important)	2020-12-03
oval:org.opensuse.security:def:1963	P	python2-numpy-gnu-hpc-1.14.0-4.5.1 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1961	P	python2-numpy-gnu-hpc-1.14.0-2.105 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:1867	P	jackson-databind-2.10.2-1.74 on GA media (Moderate)	2020-12-03
oval:org.opensuse.security:def:2646	P	Security update for webkit2gtk3 (Moderate)	2020-12-02
oval:org.opensuse.security:def:2636	P	Security update for wireshark (Moderate)	2020-12-02
oval:org.opensuse.security:def:49639	P	gvim on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:50304	P	Security update for webkit2gtk3 (Moderate)	2020-12-01
oval:org.opensuse.security:def:50250	P	libwpd-0_10-10 on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49743	P	libpcp-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49574	P	libraptor-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:51019	P	Security update for ceph (Moderate)	2020-12-01
oval:org.opensuse.security:def:49670	P	libimobiledevice-devel on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49507	P	cups-pk-helper on GA media (Moderate)	2020-12-01
oval:org.opensuse.security:def:49418	P	libIlmImf-2_2-23 on GA media (Moderate)	2020-12-01
oval:com.ubuntu.xenial:def:201842710000000	V	CVE-2018-4271 on Ubuntu 16.04 LTS (xenial) - medium.	2019-04-03
oval:com.ubuntu.bionic:def:20184271000	V	CVE-2018-4271 on Ubuntu 18.04 LTS (bionic) - medium.	2019-04-03
oval:com.ubuntu.disco:def:201842710000000	V	CVE-2018-4271 on Ubuntu 19.04 (disco) - medium.	2019-04-03
oval:com.ubuntu.cosmic:def:20184271000	V	CVE-2018-4271 on Ubuntu 18.10 (cosmic) - medium.	2019-04-03
oval:com.ubuntu.cosmic:def:201842710000000	V	CVE-2018-4271 on Ubuntu 18.10 (cosmic) - medium.	2019-04-03
oval:com.ubuntu.trusty:def:20184271000	V	CVE-2018-4271 on Ubuntu 14.04 LTS (trusty) - medium.	2019-04-03
oval:com.ubuntu.bionic:def:201842710000000	V	CVE-2018-4271 on Ubuntu 18.04 LTS (bionic) - medium.	2019-04-03
oval:com.ubuntu.xenial:def:20184271000	V	CVE-2018-4271 on Ubuntu 16.04 LTS (xenial) - medium.	2019-04-03

BACK