cbcvebase.
CVE-2018-4306
published 2019-04-03

CVE-2018-4306: A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for…

PriorityP261high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
9.35%
94.8th percentile
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Affected

11 ranges
VendorProductVersion rangeFixed in
appleicloud< 7.77.7
appleicloud_for_windows
appleios
appleiphone_os< 12.012.0
appleitunes< 12.912.9
appleitunes_12.9_for_windows
applesafari< 1212
applesafari
appletvos< 1212
appletvos
debianwebkit2gtk< webkit2gtk 2.22.0-2 (bookworm)webkit2gtk 2.22.0-2 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

other.class1 { -webkit-mask-box-image-source: url(#foo); }
  • The UAF is triggered via WebCore::Node::ensureRareData during DOM manipulation — specifically when a node is removed/replaced via replaceWith() while a DOMSubtreeModified or DOMNodeRemoved event listener modifies document.title, causing the freed node's rare data to be accessed. Monitor for WebKit crashes or heap corruption originating from WebCore::Node::ensureRareData.
  • The exploit uses a CSS -webkit-mask-box-image-source property referencing an SVG fragment (#foo) as a trigger mechanism alongside JavaScript DOM manipulation to free memory and cause the UAF condition.
  • ·The exploit PoC was developed and tested against a local debug build of WebKit on macOS (x86_64); offsets in the stack trace are specific to that build and not directly applicable to production binaries.
  • ·Affected versions are iOS prior to 12, tvOS prior to 12, Safari prior to 12, iTunes prior to 12.9 for Windows, and iCloud for Windows prior to 7.7. On Debian, the issue is fixed in webkit2gtk 2.22.0-2.

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8LOW
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.