CVE-2018-4161: Buffer Overflow

Q: What is the vulnerability ID of this issue?

The vulnerability ID for this issue is CVE-2018-4161.

Q: What is the severity of CVE-2018-4161?

The severity of CVE-2018-4161 is high.

Q: Which Apple products are affected by CVE-2018-4161?

iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, tvOS before 11.3, and watchOS before 4.3 are affected.

Q: Where can I find more information about CVE-2018-4161?

You can find more information about CVE-2018-4161 on the Apple support website.

Q: What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

The CWE ID for this vulnerability is CWE-119.

Published Mar 29, 2018

Updated

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

Other sources

WebKit. Multiple memory corruption issues were addressed with improved memory handling.

Credit

Yuan Deng(Ant), found by OSS-Fuzz, Jun Kokatsu@@shhnjk, an anonymous researcher(Trend Micro), Hanming Zhang@@4shitak4(Qihoo 360 Vulcan Team), natashenka(Google Project Zero), WanderingGlitch(Trend Micro), Zach Markley, likemeng(Baidu Security Lab working with Trend Micro), Omair(Trend Micro), Natalie Silvanovich(Google Project Zero)

Affected Software

19 affected componentsFixes available

Apple tvOS<11.3

11.3

Apple WatchOS<4.3

4.3

Apple iCloud for Windows<7.4

7.4

Apple Safari<11.1

11.1

Apple iOS<11.3

11.3

Apple Safari<11.1

Apple iPhone OS<11.3

Apple tvOS<11.3

Apple WatchOS<4.3

All of the following

Apple iCloud<7.4

Microsoft Windows

All of the following

Apple iTunes<12.7.4

Microsoft Windows

Canonical Ubuntu Linux=16.04

Canonical Ubuntu Linux=17.10

Apple iCloud<7.4

Microsoft Windows

Apple iTunes<12.7.4

debian/webkit2gtk

2.44.2-1~deb11u12.50.4-1~deb11u12.50.4-1~deb12u12.50.4-1~deb13u12.50.5-1

Event History

Apr 3, 2018

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Data Sourced

via NVD·06:29 AM

DescriptionSeverityWeaknessAffected Software

Jan 11, 2024

Data Sourced

via Launchpad·11:04 PM

Description

Feb 20, 2026

Data Sourced

via Ubuntu·07:58 PM

RemedyDescriptionSeverityAffected Software

Data Sourced

via Debian·07:58 PM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the vulnerability ID of this issue?

The vulnerability ID for this issue is CVE-2018-4161.

What is the severity of CVE-2018-4161?

The severity of CVE-2018-4161 is high.

Which Apple products are affected by CVE-2018-4161?

iOS before 11.3, Safari before 11.1, iCloud before 7.4 on Windows, iTunes before 12.7.4 on Windows, tvOS before 11.3, and watchOS before 4.3 are affected.

Where can I find more information about CVE-2018-4161?

You can find more information about CVE-2018-4161 on the Apple support website.

What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

The CWE ID for this vulnerability is CWE-119.

CVE-2018-4161: Buffer Overflow

Other sources

Credit

Affected Software

Event History

Parent advisories

Peer vulnerabilities

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the vulnerability ID of this issue?

What is the severity of CVE-2018-4161?

Which Apple products are affected by CVE-2018-4161?

Where can I find more information about CVE-2018-4161?

What is the Common Weakness Enumeration (CWE) ID for this vulnerability?

Company

Resources

Contact