-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2781
                             Safari 12 updates
                             19 September 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:          Safari
Publisher:        Apple
Operating System: Mac OS
Impact/Access:    Provide Misleading Information -- Remote with User Interaction
                  Access Confidential Data       -- Remote with User Interaction
                  Reduced Security               -- Existing Account            
Resolution:       Patch/Upgrade
CVE Names:        CVE-2018-4329 CVE-2018-4307 CVE-2018-4195

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

APPLE-SA-2018-9-17-4 Safari 12

Safari 12 is now available and addresses the following:

Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: A malicious website may be able to exfiltrate autofilled data
in Safari
Description: A logic issue was addressed with improved state
management.
CVE-2018-4307: Rafay Baloch of Pakistan Telecommunications Authority

Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: A user may be unable to delete browsing history items
Description: Clearing a history item may not clear visits with
redirect chains. The issue was addressed with improved data deletion.
CVE-2018-4329: Hugo S. Diaz (coldpointblue)

Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, macOS
Mojave 10.14
Impact: Visiting a malicious website by clicking a link may lead to
user interface spoofing
Description: An inconsistent user interface issue was addressed with
improved state management.
CVE-2018-4195: xisigr of Tencent's Xuanwu Lab (www.tencent.com)

Installation note:

Safari 12 may be obtained from the Mac App Store.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlud5zQACgkQeC9tht7T
K3Hd8A//dQTRkRdIEf2iYyfO6Sid5H1WSndQE5NmI9PlnBz/asdyJtHL+XDGeCE9
1qjl/lzub/QRIne0oxxz3b1k8yFWhTz8NgiyGMdL/FLKqyGkO4oxLYCN0k1la9RE
1tTfV48Pj7naVJePC6latzc3Ll/9oBqmkHDqckpEJcBDI0ziLk20mY9MK9/aQkhc
eFdHtbODaIKq1CKCCkoZL/ZiL3sKmxdSXoO658+eBt0Wj1KmNe1mcWZ5IpYpxXFU
bzC1QDWYV8b3763z/chb6YUljZzZ2w0IZvZr+GPRrC6nR0ozGlGzZsjvQZIXUcOb
tqrGkz34NLHi/M0ygvQ4ztKmycieQb6UqdhsrJtd5OKZlYqQc9aMq250Ft/Lkl+7
+u5nJfsAv8YWG8SJxcKmc8Kx1AgvRmkvgLmiMIh8pKox5NdzkuIYM7Lst3Eg9s5b
NG++c7VT7SKnFiYj524PuwJw1W2n6CknZgBqq2XylrUo8ceeC3oV8T4ltCXK2thS
eeV74ltadfPLnPfemxy5az4BC2hSqkpp7QhNOKik25O0fzd2bgt1Xt2SH8YjcZqv
08Mjtf6WXj6yrLu2Ym0J4DLg2cTKPjsxF6lNIUOrkPNYbclfQDYkSiT4oEnt16+H
J/XEr6lVa4BdvwSxZF76HSgvB6BaZefc31Sz3gdk96TkRfgIkRc=
=0eDn
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW6HKzmaOgq3Tt24GAQiKBQ//WJ50aBxploMTWAkVru1IBs5sK/2CTgSH
agty7lbQR/z5USYd0gFUxK+O1ntDIeK3p7c39Zypkqh9PZfLoADsE9namOZIPZwl
gO3AwlJDTAWvRAZPbMnqGeXzj16DC8ngHgR2mr0NNjaIztQajgUrtmXS9IKYhv3P
JA/Q6LCuQFv5G0kkYkWHzeZdfMSdV9VBlc3qVm5g61kZW4tQz9CkH7qCW/TIkJg8
UVyyihxNk2FhosEgA9+j2rQM258O/aRgxyn8tgq7Dc5RovuGdbFhc0GNK/9FhTVw
YZCpDS5tcARoxEF+1DtNkqiwQ3BnT+adumuYBdsmMp9+g7dF05RBA1gwcuitgkGv
6VlwyCvKzVegIy6JSXHZ+PgYcCl6gne+v1LGGQLQwCLd2qT+Ex7jGqTRvK6u+SKs
UdLCyxEpv3bkj6NlEoRNakvoOh1W0ivgKTHW3gyLEgES4zSgh1yWBZ9H0yeUQI2Z
eF2/HLJnJBiipWwKJNz+ujMQ45wccYmkc6uHLJsJICnBU0VRgmpp6P3x/lrn3Z/T
O5lY9HWzLtH41pPiCqynV7cRcwYViqjEFAsBgt2KqYJ5M04rk+afUt4kqf5mcu2t
1Z+6CkPnK1O7aOUClT3wAPS/SNZhi3FtY1DTW6ag2lEXO9Nk1b36/j51nT2VJtjz
+7UNhaxXJBA=
=jjtk
-----END PGP SIGNATURE-----