CVE-2018-4278

published 2019-01-11

CVE-2018-4278: In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio…

medium 4.3 CVSS 3.0

AV N AC L PR N UI R S U C L I N A N

In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.

Affected

13 ranges

Vendor	Product	Version range	Fixed in
apple	icloud	< 7.6	7.6
apple	icloud_for_windows	—	—
apple	ios	—	—
apple	iphone_os	< 11.4.1	11.4.1
apple	itunes	< 12.8	12.8
apple	itunes_12.8_for_windows	—	—
apple	safari	< 11.1.2	11.1.2
apple	safari	—	—
apple	tvos	< 11.4.1	11.4.1
apple	tvos	—	—
canonical	ubuntu_linux	—	—
canonical	ubuntu_linux	—	—
debian	webkit2gtk	< webkit2gtk 2.20.4-1 (bookworm)	webkit2gtk 2.20.4-1 (bookworm)

CVSS provenance

nvd v3.0 4.3 MEDIUM CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

osv 4.3 MEDIUM