exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Apple Security Advisory 2018-10-30-13

Apple Security Advisory 2018-10-30-13
Posted Oct 31, 2018
Authored by Apple | Site apple.com

Apple Security Advisory 2018-10-30-13 - iTunes 12.9 for Windows addresses code execution vulnerabilities.

tags | advisory, vulnerability, code execution
systems | windows, apple
advisories | CVE-2018-4126, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4311, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4345, CVE-2018-4347, CVE-2018-4358, CVE-2018-4359, CVE-2018-4360, CVE-2018-4361, CVE-2018-4412, CVE-2018-4414
SHA-256 | 0a92eb743adfd24ed7c05c8610b942e8390be3a0f595fb120ae8d5c8ee5f9668

Apple Security Advisory 2018-10-30-13

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2018-10-30-13 Additional information for
APPLE-SA-2018-9-24-2 iTunes 12.9 for Windows

iTunes 12.9 for Windows addresses the following:

CFNetwork
Available for: Windows 7 and later
Impact: An application may be able to execute arbitrary code with
system privileges
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4126: Bruno Keith (@bkth_) working with Trend Micro's Zero
Day Initiative
Entry added October 30, 2018

CoreFoundation
Available for: Windows 7 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4412: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018

CoreFoundation
Available for: Windows 7 and later
Impact: An application may be able to gain elevated privileges
Description: A memory corruption issue was addressed with improved
input validation.
CVE-2018-4414: The UK's National Cyber Security Centre (NCSC)
Entry added October 30, 2018

CoreText
Available for: Windows 7 and later
Impact: Processing a maliciously crafted text file may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4347: an anonymous researcher
Entry added October 30, 2018

WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A use after free issue was addressed with improved
memory management.
CVE-2018-4197: Ivan Fratric of Google Project Zero
CVE-2018-4306: Ivan Fratric of Google Project Zero
CVE-2018-4312: Ivan Fratric of Google Project Zero
CVE-2018-4314: Ivan Fratric of Google Project Zero
CVE-2018-4315: Ivan Fratric of Google Project Zero
CVE-2018-4317: Ivan Fratric of Google Project Zero
CVE-2018-4318: Ivan Fratric of Google Project Zero

WebKit
Available for: Windows 7 and later
Impact: A malicious website may exfiltrate image data cross-origin
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4345: an anonymous researcher

WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4191: found by OSS-Fuzz

WebKit
Available for: Windows 7 and later
Impact: Cross-origin SecurityErrors includes the accessed frame's
origin
Description: The issue was addressed by removing origin information.
CVE-2018-4311: Erling Alf Ellingsen (@steike)

WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
state management.
CVE-2018-4316: crixer, Hanming Zhang (@4shitak4) of Qihoo 360 Vulcan
Team

WebKit
Available for: Windows 7 and later
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4299: Samuel GroI2 (saelo) working with Trend Micro's Zero
Day Initiative
CVE-2018-4323: Ivan Fratric of Google Project Zero
CVE-2018-4328: Ivan Fratric of Google Project Zero
CVE-2018-4358: @phoenhex team (@bkth_ @5aelo @_niklasb) working with
Trend Micro's Zero Day Initiative
CVE-2018-4359: Samuel GroA (@5aelo)
CVE-2018-4360: William Bowling (@wcbowling)
Entry added October 30, 2018

WebKit
Available for: Windows 7 and later
Impact: A malicious website may cause unexepected cross-origin
behavior
Description: A cross-origin issue existed with "iframe" elements.
This was addressed with improved tracking of security origins.
CVE-2018-4319: John Pettitt of Google

WebKit
Available for: Windows 7 and later
Impact: A malicious website may be able to execute scripts in the
context of another website
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4309: an anonymous researcher working with Trend Micro's
Zero Day Initiative

WebKit
Available for: Windows 7 and later
Impact: Unexpected interaction causes an ASSERT failure
Description: A memory consumption issue was addressed with improved
memory handling.
CVE-2018-4361: found by OSS-Fuzz

Additional recognition

SQLite
We would like to acknowledge Andreas Kurtz (@aykay) of NESO Security
Labs GmbH for their assistance.

WebKit
We would like to acknowledge Cary Hartline, Hanming Zhang from 360
Vuclan team, Tencent Keen Security Lab working with Trend Micro's
Zero Day Initiative, and Zach Malone of CA Technologies for their
assistance.

Installation note:

iTunes 12.9 for Windows may be obtained from:
https://www.apple.com/itunes/download/

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgUpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3H36BAA
kOdio5aQDT6TT5y302gTD8IRudSct/JHVCjMbaEU4Q28RKb5yumU3j+x3QylMwx8
n60VkwST8bzxjffZa+ER8F+8+NdPdcWtyYPHauEOt/ICKWLmxXZr3JIXk1XIxwz2
I9Ca9kkO+q6lWSjYVk44ZnEplEj4UctE8FoDTCXOsaATcPOeNGZttxjHBZLEnMHg
7vcFaJ7fQQf3ECuZG7HLXWvelQCzOSR1dNXUeAXTPoVrKAEBRk7Z8/UlB/mRYntv
0GSaJZCIMO8r/TwS/+KWzHgtRREusR9Sk827yDVZoqL8q3mMprIoospOiHsezEnq
RReMU2sNCc6mm2x28gnZrjQgxPL4abwV+z/P8oloOjnN3gydUnQXFM606z2ZCp2y
GgjrnIjLtlri1rx1wLccqMPi2GZFmOcNvgPBBuHfWj5GpPjE6ILWXcy6cg+hfgD9
CCUMqJFTW3gclGjno5nfqq7yaxJaD+CniGNhFxZxhOVbTXzMQ7T24biUz+ulr0Ip
Yi11Xlb+xUk9SGP0ioci9nsfV8MAKy4eb/JpDIXBkQL9LWzp4z+gYeoNUZOyK9pB
Mr3Kn15K76ApsoBFkFNI2AXwvXFtda5no5jy7EarbefmyD1BA0W9Tfg1kJEmh1J5
cdFwOCALT9HHUn7bccDIPvQlVH/sgEjVkMRapHl72SE=
=5IB1
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    0 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close