CVE-2018-4394 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Apple Itunes

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer8 documents4 sources

Severity

7.8HIGHNVD

EPSS

0.3%

top 45.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Apple Iphone OS Apple Itunes Apple MAC OS X +2 more

Timeline

PublishedApr 3

Latest updateMay 14

Description

A memory corruption issue was addressed with improved input validation. This issue affected versions prior to iOS 12.1, macOS Mojave 10.14.1, tvOS 12.1, watchOS 5.1, iTunes 12.9.1.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶NVDapple/tvos< 12.1

▶NVDapple/itunes< 12.9.1

▶NVDapple/watchos< 5.1

▶NVDapple/mac_os_x< 10.14.1

▶NVDapple/iphone_os< 12.1

🔴Vulnerability Details

GHSA

GHSA-crvj-53j9-v9xw: A memory corruption issue was addressed with improved input validation↗2022-05-14

▶

CVEList

CVE-2018-4394: A memory corruption issue was addressed with improved input validation↗2019-04-03

▶

📋Vendor Advisories

Apple

CVE-2018-4394: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra↗2018-10-30

▶

Apple

CVE-2018-4394: watchOS 5.1↗2018-10-30

▶

Apple

CVE-2018-4394: iOS 12.1↗2018-10-30

▶

Apple

CVE-2018-4394: tvOS 12.1↗2018-10-30

▶

Apple

CVE-2018-4394: iTunes 12.9.1 for Windows↗2018-10-30

▶