Vulnerabilities > CVE-2018-4222 - Out-of-bounds Read vulnerability in multiple products
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.
Vulnerable Configurations
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Exploit-Db
description | WebKit - WebAssembly Compilation Info Leak. CVE-2018-4222. Dos exploit for Multiple platform |
file | exploits/multiple/dos/44859.html |
id | EDB-ID:44859 |
last seen | 2018-06-08 |
modified | 2018-06-08 |
platform | multiple |
port | |
published | 2018-06-08 |
reporter | Exploit-DB |
source | https://www.exploit-db.com/download/44859/ |
title | WebKit - WebAssembly Compilation Info Leak |
type | dos |
Nessus
NASL family Windows NASL id ITUNES_12_7_5.NASL description The version of Apple iTunes installed on the remote Windows host is prior to 12.7.5. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208852 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 110384 published 2018-06-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110384 title Apple iTunes < 12.7.5 Multiple Vulnerabilities (credentialed check) code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(110384); script_version("1.5"); script_cvs_date("Date: 2019/11/04"); script_cve_id( "CVE-2018-4188", "CVE-2018-4190", "CVE-2018-4192", "CVE-2018-4199", "CVE-2018-4200", "CVE-2018-4201", "CVE-2018-4204", "CVE-2018-4214", "CVE-2018-4218", "CVE-2018-4222", "CVE-2018-4224", "CVE-2018-4225", "CVE-2018-4226", "CVE-2018-4232", "CVE-2018-4233", "CVE-2018-4246" ); script_bugtraq_id(103961, 104378); script_xref(name:"APPLE-SA", value:"APPLE-SA-2018-06-01-7"); script_name(english:"Apple iTunes < 12.7.5 Multiple Vulnerabilities (credentialed check)"); script_summary(english:"Checks the version of iTunes on Windows."); script_set_attribute(attribute:"synopsis", value: "An application installed on the remote host is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The version of Apple iTunes installed on the remote Windows host is prior to 12.7.5. It is, therefore, affected by multiple vulnerabilities as referenced in the HT208852 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number."); script_set_attribute(attribute:"see_also", value:"https://support.apple.com/en-us/HT208852"); # https://lists.apple.com/archives/security-announce/2018/Jun/msg00006.html script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?375c8685"); script_set_attribute(attribute:"solution", value: "Upgrade to Apple iTunes version 12.7.5 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"); script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C"); script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-4246"); script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available"); script_set_attribute(attribute:"exploit_available", value:"true"); script_set_attribute(attribute:"metasploit_name", value:'Safari Proxy Object Type Confusion'); script_set_attribute(attribute:"exploit_framework_metasploit", value:"true"); script_set_attribute(attribute:"vuln_publication_date", value:"2018/06/01"); script_set_attribute(attribute:"patch_publication_date", value:"2018/06/01"); script_set_attribute(attribute:"plugin_publication_date", value:"2018/06/06"); script_set_attribute(attribute:"plugin_type", value:"local"); script_set_attribute(attribute:"cpe", value:"cpe:/a:apple:itunes"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Windows"); script_copyright(english:"This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("itunes_detect.nasl"); script_require_keys("installed_sw/iTunes Version", "SMB/Registry/Enumerated"); exit(0); } include("vcf.inc"); # Ensure this is Windows get_kb_item_or_exit("SMB/Registry/Enumerated"); app_info = vcf::get_app_info(app:"iTunes Version", win_local:TRUE); constraints = [{"fixed_version" : "12.7.5"}]; vcf::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);
NASL family Gentoo Local Security Checks NASL id GENTOO_GLSA-201808-04.NASL description The remote host is affected by the vulnerability described in GLSA-201808-04 (WebkitGTK+: Multiple vulnerabilities) Multiple vulnerabilities have been discovered in WebKitGTK+. Please review the referenced CVE identifiers for details. Impact : A remote attacker could execute arbitrary commands or cause a denial of service condition via a maliciously crafted web content. Workaround : There is no known workaround at this time. last seen 2020-06-01 modified 2020-06-02 plugin id 112078 published 2018-08-23 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/112078 title GLSA-201808-04 : WebkitGTK+: Multiple vulnerabilities NASL family Peer-To-Peer File Sharing NASL id ITUNES_12_7_5_BANNER.NASL description The version of Apple iTunes installed on the remote Windows host is prior to 12.7.5. It is, therefore, affected by multiple vulnerabilities in WebKit as referenced in the HT208852 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application last seen 2020-06-01 modified 2020-06-02 plugin id 110383 published 2018-06-06 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110383 title Apple iTunes < 12.7.5 Multiple Vulnerabilities (uncredentialed check) NASL family MacOS X Local Security Checks NASL id MACOSX_SAFARI11_1_1.NASL description The version of Apple Safari installed on the remote macOS or Mac OS X host is prior to 11.1.1 It is, therefore, affected by multiple vulnerabilities. - A remote code execution vulnerability exists in WebKit due to improper memory handling. An unauthenticated, remote attacker can exploit this, via a specifically crafted web page to to execute arbitrary code or cause a denial of service (CVE-2018-4199, CVE-2018-4201, CVE-2018-4218, CVE-2018-4233). - An information disclosure vulnerability exists in WebKit. An unauthenticated, remote attacker can exploit this, via a specifically crafted web page, to disclose potentially sensitive information (CVE-2018-4190). - An out-of-bounds read error exists in WebKit due to improper input validation. An unauthenticated, remote attacker can exploit this, via a specifically crafted web page that leverages a getWasmBufferFromValue during WebAssembly compilation to execute arbitrary code (CVE-2018-4222). last seen 2020-06-01 modified 2020-06-02 plugin id 126381 published 2019-07-02 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/126381 title macOS : Apple Safari < 11.1.1 Multiple Vulnerabilities NASL family Fedora Local Security Checks NASL id FEDORA_2018-AAC3CA8936.NASL description This update addresses the following vulnerabilities : - [CVE-2018-4190](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4190), [CVE-2018-4199](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4199), [CVE-2018-4218](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4218), [CVE-2018-4222](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4222), [CVE-2018-4232](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4232), [CVE-2018-4233](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4233), [CVE-2018-4246](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4246), [CVE-2018-11646](https://cve.mitre.org/cgi-bin/cvename.c gi?name=CVE-2018-11646). Additional fixes : - Fix installation directory of API documentation. - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2018-07-02 plugin id 110823 published 2018-07-02 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110823 title Fedora 27 : webkitgtk4 (2018-aac3ca8936) NASL family SuSE Local Security Checks NASL id OPENSUSE-2019-566.NASL description This update for webkit2gtk3 to version 2.20.3 fixes the following issues : These security issues were fixed : - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch (bsc#1097693). - CVE-2018-4199: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted website (bsc#1097693) - CVE-2018-4218: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website that triggers an @generatorState use-after-free (bsc#1097693) - CVE-2018-4222: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted website that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation (bsc#1097693) - CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite cookies via a crafted website (bsc#1097693) - CVE-2018-4233: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1097693) - CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL mishandle an unset pageURL, leading to an application crash (bsc#1095611). These non-security issues were fixed : - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-01 modified 2020-06-02 plugin id 123245 published 2019-03-27 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/123245 title openSUSE Security Update : webkit2gtk3 (openSUSE-2019-566) NASL family Fedora Local Security Checks NASL id FEDORA_2018-118B9ABF99.NASL description This update addresses the following vulnerabilities : - [CVE-2018-4190](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4190), [CVE-2018-4199](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4199), [CVE-2018-4218](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4218), [CVE-2018-4222](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4222), [CVE-2018-4232](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4232), [CVE-2018-4233](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4233), [CVE-2018-4246](https://cve.mitre.org/cgi-bin/cvename.cg i?name=CVE-2018-4246), [CVE-2018-11646](https://cve.mitre.org/cgi-bin/cvename.c gi?name=CVE-2018-11646). Additional fixes : - Fix installation directory of API documentation. - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Properly detect compiler flags, needed libs, and fallbacks for usage of 64-bit atomic operations. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-05 modified 2019-01-03 plugin id 120240 published 2019-01-03 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120240 title Fedora 28 : webkit2gtk3 (2018-118b9abf99) NASL family Ubuntu Local Security Checks NASL id UBUNTU_USN-3687-1.NASL description A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution. Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 110611 published 2018-06-19 reporter Ubuntu Security Notice (C) 2018-2019 Canonical, Inc. / NASL script (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110611 title Ubuntu 16.04 LTS / 17.10 / 18.04 LTS : webkit2gtk vulnerabilities (USN-3687-1) NASL family SuSE Local Security Checks NASL id SUSE_SU-2018-3387-1.NASL description This update for webkit2gtk3 to version 2.20.3 fixes the issues : The following security vulnerabilities were addressed : CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs (boo#1101999) CVE-2017-13884: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2017-13885: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2017-7153: An unspecified issue allowed remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted website that sends a 401 Unauthorized redirect (bsc#1077535). CVE-2017-7160: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2017-7161: An unspecified issue allowed remote attackers to execute arbitrary code via special characters that trigger command injection (bsc#1075775, bsc#1077535). CVE-2017-7165: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2018-4088: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2018-4096: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). CVE-2018-4200: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website that triggers a WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280). CVE-2018-4204: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1092279). CVE-2018-4101: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1088182). CVE-2018-4113: An issue in the JavaScriptCore function in the last seen 2020-06-01 modified 2020-06-02 plugin id 118389 published 2018-10-25 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118389 title SUSE SLED12 / SLES12 Security Update : webkit2gtk3 (SUSE-SU-2018:3387-1) NASL family Misc. NASL id APPLETV_11_4.NASL description According to its banner, the version of Apple TV on the remote device is prior to 11.4. It is, therefore, affected by multiple vulnerabilities as described in the HT208850 security advisory. Note that only 4th and 5th generation models are affected by these vulnerabilities. last seen 2020-06-01 modified 2020-06-02 plugin id 110325 published 2018-06-05 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/110325 title Apple TV < 11.4 Multiple Vulnerabilities NASL family SuSE Local Security Checks NASL id SUSE_SU-2018-2075-1.NASL description This update for webkit2gtk3 to version 2.20.3 fixes the following issues: These security issues were fixed : - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch (bsc#1097693). - CVE-2018-4199: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted website (bsc#1097693) - CVE-2018-4218: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website that triggers an @generatorState use-after-free (bsc#1097693) - CVE-2018-4222: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted website that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation (bsc#1097693) - CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite cookies via a crafted website (bsc#1097693) - CVE-2018-4233: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1097693) - CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL mishandle an unset pageURL, leading to an application crash (bsc#1095611). The update package also includes non-security fixes. See advisory for details. Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues. last seen 2020-06-01 modified 2020-06-02 plugin id 120064 published 2019-01-02 reporter This script is Copyright (C) 2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/120064 title SUSE SLED15 / SLES15 Security Update : webkit2gtk3 (SUSE-SU-2018:2075-1) NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-1288.NASL description This update for webkit2gtk3 to version 2.20.3 fixes the issues : The following security vulnerabilities were addressed : - CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs (boo#1101999) - CVE-2017-13884: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2017-13885: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2017-7153: An unspecified issue allowed remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted website that sends a 401 Unauthorized redirect (bsc#1077535). - CVE-2017-7160: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2017-7161: An unspecified issue allowed remote attackers to execute arbitrary code via special characters that trigger command injection (bsc#1075775, bsc#1077535). - CVE-2017-7165: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2018-4088: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2018-4096: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1075775). - CVE-2018-4200: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website that triggers a WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280). - CVE-2018-4204: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1092279). - CVE-2018-4101: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1088182). - CVE-2018-4113: An issue in the JavaScriptCore function in the last seen 2020-06-05 modified 2018-10-26 plugin id 118453 published 2018-10-26 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118453 title openSUSE Security Update : webkit2gtk3 (openSUSE-2018-1288) NASL family SuSE Local Security Checks NASL id OPENSUSE-2018-845.NASL description This update for webkit2gtk3 to version 2.20.3 fixes the following issues : These security issues were fixed : - CVE-2018-4190: An unspecified issue allowed remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch (bsc#1097693). - CVE-2018-4199: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted website (bsc#1097693) - CVE-2018-4218: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website that triggers an @generatorState use-after-free (bsc#1097693) - CVE-2018-4222: An unspecified issue allowed remote attackers to execute arbitrary code via a crafted website that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation (bsc#1097693) - CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite cookies via a crafted website (bsc#1097693) - CVE-2018-4233: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted website (bsc#1097693) - CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL mishandle an unset pageURL, leading to an application crash (bsc#1095611). These non-security issues were fixed : - Disable Gigacage if mmap fails to allocate in Linux. - Add user agent quirk for paypal website. - Fix a network process crash when trying to get cookies of about:blank page. - Fix UI process crash when closing the window under Wayland. - Fix several crashes and rendering issues. This update was imported from the SUSE:SLE-15:Update update project. last seen 2020-06-05 modified 2018-08-10 plugin id 111626 published 2018-08-10 reporter This script is Copyright (C) 2018-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/111626 title openSUSE Security Update : webkit2gtk3 (openSUSE-2018-845)
Seebug
bulletinFamily | exploit |
description | There is an out-of-bounds read when compiling WebAssembly source buffers in WebKit. When a source buffer is compiled, it is first copied into a read-only buffer by the functuion getWasmBufferFromValue. This function returns the code buffer as follows: ``` return arrayBufferView ? static_cast<uint8_t*>(arrayBufferView->vector()) : static_cast<uint8_t*>(arrayBuffer->impl()->data()); ``` If the source buffer is a view (DataView or TypedArray), arrayBufferView->vector() is returned. The vector() method returns the start of the data in the buffer, including any offset. However, the function createSourceBufferFromValue copies the output of this function as follows: ``` memcpy(result.data(), data + byteOffset, byteSize); ``` This means that if the buffer is a view, the offset is added to the buffer twice before this is copied. This could allow memory off the heap to be read out of the source buffer, either though parsing exceptions or data sections when they are copied. A minimal PoC for the issue is: ``` var b2 = new ArrayBuffer(1000); var view = new Int8Array(b2, 700); var mod = new WebAssembly.Module(a); ``` An HTML file the consistently crashes Safari is attached. |
id | SSV:97335 |
last seen | 2018-06-10 |
modified | 2018-06-08 |
published | 2018-06-08 |
reporter | Knownsec |
source | https://www.seebug.org/vuldb/ssvid-97335 |
title | WebKit: Info leak in WebAssembly Compilation(CVE-2018-4222) |
References
- http://www.securitytracker.com/id/1041029
- http://www.securitytracker.com/id/1041029
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1545
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1545
- https://security.gentoo.org/glsa/201808-04
- https://security.gentoo.org/glsa/201808-04
- https://support.apple.com/HT208848
- https://support.apple.com/HT208848
- https://support.apple.com/HT208850
- https://support.apple.com/HT208850
- https://support.apple.com/HT208851
- https://support.apple.com/HT208851
- https://support.apple.com/HT208852
- https://support.apple.com/HT208852
- https://support.apple.com/HT208853
- https://support.apple.com/HT208853
- https://support.apple.com/HT208854
- https://support.apple.com/HT208854
- https://usn.ubuntu.com/3687-1/
- https://usn.ubuntu.com/3687-1/
- https://www.exploit-db.com/exploits/44859/
- https://www.exploit-db.com/exploits/44859/