cbcvebase.
CVE-2018-4315
published 2019-04-03

CVE-2018-4315: A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for…

PriorityP261high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EXPLOIT
EPSS
9.39%
94.9th percentile
A use after free issue was addressed with improved memory management. This issue affected versions prior to iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, iCloud for Windows 7.7.

Affected

11 ranges
VendorProductVersion rangeFixed in
appleicloud< 7.77.7
appleicloud_for_windows
appleios
appleiphone_os< 12.012.0
appleitunes< 12.912.9
appleitunes_12.9_for_windows
applesafari< 1212
applesafari
appletvos< 1212
appletvos
debianwebkit2gtk< webkit2gtk 2.22.0-2 (bookworm)webkit2gtk 2.22.0-2 (bookworm)

Detection & IOCsextracted from sources · hover to see the quote

processWebCore::SVGTRefElement::updateReferencedText
  • The UAF is triggered via SVGTRefElement::updateReferencedText in WebKit's WebCore; monitor for SVG documents containing <tref> elements combined with execCommand calls and event listener manipulation that may trigger the use-after-free code path.
  • The exploit uses a freememory() JavaScript function to spray/free memory before triggering the UAF; look for JavaScript heap-spray patterns combined with SVG <tref> element manipulation in web content.
  • Processing maliciously crafted web content triggers arbitrary code execution via this WebKit UAF; flag web content delivery to WebKit-based browsers (Safari, embedded WKWebView in iTunes/iCloud on Windows, tvOS) containing SVG with <tref>/<use> elements and inline event handlers.
  • ·The vulnerability is fixed in iOS 12, tvOS 12, Safari 12, iTunes 12.9 for Windows, and iCloud for Windows 7.7; detections should focus on unpatched versions prior to these releases.
  • ·On Debian-based Linux systems (bookworm, bullseye, trixie, sid, forky), the issue is resolved in webkit2gtk version 2.22.0-2; ensure the package is at or above this version.

CVSS provenance

nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.8HIGH
vendor_debian8.8LOW
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.