Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-4222 — Out-of-bounds Read in Apple Icloud

CWE-125 — Out-of-bounds Read14 documents9 sources
Severity
8.8HIGHNVD
EPSS
39.8%
top 2.67%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
7
Apple IcloudApple Iphone OSApple Itunes+4 more
Timeline
PublishedJun 8
Latest updateMay 14

Description

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶NVDapple/tvos< 11.4
▶NVDapple/icloud< 7.5
▶NVDapple/itunes< 12.7.5
▶NVDapple/safari< 11.1.1
▶NVDapple/watchos< 4.3.1

Also affects: Ubuntu Linux 16.04, 17.10, 18.04

🔴Vulnerability Details

4
GHSA
GHSA-8g33-v26p-4g88: An issue was discovered in certain Apple products↗2022-05-14
▶
Project0
The Problems and Promise of WebAssembly - Project Zero↗2018-08-01
▶
CVEList
CVE-2018-4222: An issue was discovered in certain Apple products↗2018-06-08
▶
OSV
CVE-2018-4222: An issue was discovered in certain Apple products↗2018-06-08
▶

💥Exploits & PoCs

1
Exploit-DB
WebKit - WebAssembly Compilation Info Leak↗2018-06-08
▶

📋Vendor Advisories

8
Ubuntu
WebKitGTK+ vulnerabilities↗2018-06-18
▶
Apple
CVE-2018-4222: Safari 11.1.1↗2018-06-01
▶
Apple
CVE-2018-4222: iCloud for Windows 7.5↗2018-06-01
▶
Apple
CVE-2018-4222: tvOS 11.4↗2018-05-29
▶
Apple
CVE-2018-4222: iTunes 12.7.5 for Windows↗2018-05-29
▶
CVE-2018-4222 — Out-of-bounds Read in Apple Icloud | cvebase