CVE-2018-4222

high · 8.8

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.

8.8

CVSS

10.4%

EPSS (exploit prob.)

96th

EPSS percentile

2018-06-08

Published

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-125

Affected products

Vendor	Product	Affected versions
apple	safari	< 11.1.1
apple	iphone_os	< 11.4
apple	tvos	< 11.4
apple	watchos	< 4.3.1
apple	icloud	< 7.5
microsoft	windows	all versions
apple	itunes	< 12.7.5
microsoft	windows	all versions
canonical	ubuntu_linux	16.04
canonical	ubuntu_linux	17.10
canonical	ubuntu_linux	18.04

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2018-4222