CVE-2018-4128: Buffer Overflow

Q: What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-4128.

Q: What is the severity of CVE-2018-4128?

The severity of CVE-2018-4128 is high.

Q: Which Apple products are affected by CVE-2018-4128?

iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, and tvOS before 11.3 are affected by CVE-2018-4128.

Q: What is the component involved in CVE-2018-4128?

The component involved in CVE-2018-4128 is WebKit.

Q: Are Microsoft Windows systems vulnerable to CVE-2018-4128?

No, Microsoft Windows systems are not vulnerable to CVE-2018-4128.

Published Mar 29, 2018

Updated

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Yuan Deng(Ant), found by OSS-Fuzz, Jun Kokatsu@@shhnjk, an anonymous researcher(Trend Micro), Hanming Zhang@@4shitak4(Qihoo 360 Vulcan Team), natashenka(Google Project Zero), WanderingGlitch(Trend Micro), Zach Markley, likemeng(Baidu Security Lab working with Trend Micro), Omair(Trend Micro), Natalie Silvanovich(Google Project Zero)

Affected Software

18 affected componentsFixes available

Apple tvOS<11.3

11.3

Apple iCloud for Windows<7.4

7.4

Apple Safari<11.1

11.1

Apple iOS<11.3

11.3

Apple Safari<11.1

Apple iPhone OS<11.3

Apple tvOS<11.3

Apple iCloud<7.4

Microsoft Windows

Apple iTunes<12.7.4

WebKitGTK Webkitgtk\+<2.20.4

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

All of the following

Apple iCloud<7.4

Microsoft Windows

All of the following

Apple iTunes<12.7.4

Microsoft Windows

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-12.50.6-1

Event History

Apr 3, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Data Sourced

via NVD·06:29 AM

DescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:04 PM

Description

Feb 20, 2026

Data Sourced

via Ubuntu·07:58 PM

RemedyDescriptionSeverityAffected Software

Mar 13, 2026

Data Sourced

via Debian·08:17 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2018-4128.

What is the severity of CVE-2018-4128?

The severity of CVE-2018-4128 is high.

Which Apple products are affected by CVE-2018-4128?

iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, and tvOS before 11.3 are affected by CVE-2018-4128.

What is the component involved in CVE-2018-4128?

The component involved in CVE-2018-4128 is WebKit.

Are Microsoft Windows systems vulnerable to CVE-2018-4128?

No, Microsoft Windows systems are not vulnerable to CVE-2018-4128.

CVE-2018-4128: Buffer Overflow

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID for this issue?

What is the severity of CVE-2018-4128?

Which Apple products are affected by CVE-2018-4128?

What is the component involved in CVE-2018-4128?

Are Microsoft Windows systems vulnerable to CVE-2018-4128?

Company

Resources

Contact