PT-2018-16479 · Apple+2 · Itunes For Windows+8

Published 2018-09-28 · Updated 2019-03-23 · CVE-2018-4209

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apple iOS versions prior to 11.3 Apple Safari versions prior to 11.1 Apple iCloud for Windows versions prior to 7.4 Apple tvOS versions prior to 11.3 Apple watchOS versions prior to 4.3 Apple iTunes for Windows versions prior to 12.7.4

Description The issue is caused by an unexpected interaction that results in an ASSERT failure. This was addressed with improved checks.

Recommendations For Apple iOS versions prior to 11.3, update to version 11.3 or later. For Apple Safari versions prior to 11.1, update to version 11.1 or later. For Apple iCloud for Windows versions prior to 7.4, update to version 7.4 or later. For Apple tvOS versions prior to 11.3, update to version 11.3 or later. For Apple watchOS versions prior to 4.3, update to version 4.3 or later. For Apple iTunes for Windows versions prior to 12.7.4, update to version 12.7.4 or later.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2018-4209

OPENSUSE-SU-2019:0081-1

OPENSUSE-SU-2019_0068-1

OPENSUSE-SU-2019_0081-1

SUSE-SU-2019:0059-1

SUSE-SU-2019:0092-1

USN-3781-1

USN-3781-2

Affected Products

Safari

Suse

Ubuntu

Icloud For Windows

Ios

Itunes

Itunes For Windows

Tvos

Watchos

References · 114

• https://ubuntu.com/security/CVE-2018-4197 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-4209 · Security Note
• https://osv.dev/vulnerability/CVE-2018-4209 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4299 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4311 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4209 · Vendor Advisory
• https://usn.ubuntu.com/3781-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4317 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-4209 · Security Note
• https://osv.dev/vulnerability/USN-3781-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4318 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4213 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4191 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-4315 · Vendor Advisory