Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-4121 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Icloud

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer21 documents10 sources
Severity
8.8HIGHNVD
EPSS
38.6%
top 2.75%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
Apple IcloudApple Iphone OSApple Itunes+3 more
Timeline
PublishedApr 3
Latest updateMay 14

Description

An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDapple/tvos< 11.3
▶NVDapple/icloud< 7.4
▶NVDapple/itunes< 12.7.4
▶NVDapple/safari< 11.1
▶NVDapple/watchos< 4.3

🔴Vulnerability Details

4
GHSA
GHSA-pg93-h5rr-phmm: An issue was discovered in certain Apple products↗2022-05-14
▶
Project0
The Problems and Promise of WebAssembly - Project Zero↗2018-08-01
▶
CVEList
CVE-2018-4121: An issue was discovered in certain Apple products↗2018-04-03
▶
OSV
CVE-2018-4121: An issue was discovered in certain Apple products↗2018-04-03
▶

💥Exploits & PoCs

2
Exploit-DB
Ayukov NFTP FTP Client 2.0 - Buffer Overflow↗2019-01-02
▶
Exploit-DB
WebKit - WebAssembly Parsing Does not Correctly Check Section Order↗2018-04-09
▶

📋Vendor Advisories

8
Red Hat
webkitgtk: memory corruption processing maliciously crafted web content↗2018-05-07
▶
Apple
CVE-2018-4121: watchOS 4.3↗2018-03-29
▶
Apple
CVE-2018-4121: iCloud for Windows 7.4↗2018-03-29
▶
Apple
CVE-2018-4121: tvOS 11.3↗2018-03-29
▶
Apple
CVE-2018-4121: iOS 11.3↗2018-03-29
▶

💬Community

6
Bugzilla
CVE-2018-4121 CVE-2018-4200 CVE-2018-4204 mingw-webkitgtk3: various flaws [fedora-all]↗2018-05-11
▶
Bugzilla
CVE-2018-4121 CVE-2018-4200 CVE-2018-4204 webkitgtk: various flaws [fedora-all]↗2018-05-11
▶
Bugzilla
CVE-2018-4121 CVE-2018-4200 CVE-2018-4204 webkitgtk: various flaws [epel-all]↗2018-05-11
▶
Bugzilla
CVE-2018-4121 CVE-2018-4200 CVE-2018-4204 webkitgtk4: various flaws [fedora-all]↗2018-05-11
▶
Bugzilla
CVE-2018-4121 CVE-2018-4200 CVE-2018-4204 mingw-webkitgtk: various flaws [fedora-all]↗2018-05-11
▶
CVE-2018-4121 — Apple Icloud vulnerability | cvebase