Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2018.3349
APPLE-SA-2018-10-30-3 Safari 12.0.1
31 October 2018
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Apple Safari
Publisher: Apple
Operating System: OS X
Impact/Access: Execute Arbitrary Code/Commands -- Remote with User Interaction
Cross-site Scripting -- Remote with User Interaction
Denial of Service -- Remote with User Interaction
Resolution: Patch/Upgrade
CVE Names: CVE-2018-4416 CVE-2018-4409 CVE-2018-4392
CVE-2018-4386 CVE-2018-4382 CVE-2018-4378
CVE-2018-4377 CVE-2018-4376 CVE-2018-4375
CVE-2018-4374 CVE-2018-4373 CVE-2018-4372
Reference: ESB-2018.3347
Original Bulletin:
https://support.apple.com/en-au/HT209196
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-10-30-3 Safari 12.0.1
Safari 12.0.1 is now available and addresses the following:
Safari Reader
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14
Impact: Enabling the Safari Reader feature on a maliciously crafted
webpage may lead to universal cross site scripting
Description: A logic issue was addressed with improved validation.
CVE-2018-4374: Ryan Pickren (ryanpickren.com)
Safari Reader
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14
Impact: Enabling the Safari Reader feature on a maliciously crafted
webpage may lead to universal cross site scripting
Description: A cross-site scripting issue existed in Safari. This
issue was addressed with improved URL validation.
CVE-2018-4377: Ryan Pickren (ryanpickren.com)
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4372: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of KAIST
Softsec Lab, Korea
CVE-2018-4373: ngg, alippai, DirtYiCE, KT of Tresorit working with
Trend Micro's Zero Day Initiative
CVE-2018-4375: Yu Haiwan and Wu Hongjun From Nanyang Technological
University working with Trend Micro's Zero Day Initiative
CVE-2018-4376: 010 working with Trend Micro's Zero Day Initiative
CVE-2018-4382: lokihardt of Google Project Zero
CVE-2018-4386: lokihardt of Google Project Zero
CVE-2018-4392: zhunki of 360 ESG Codesafe Team
CVE-2018-4416: lokihardt of Google Project Zero
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14
Impact: A malicious website may be able to cause a denial of service
Description: A resource exhaustion issue was addressed with improved
input validation.
CVE-2018-4409: Sabri Haddouche (@pwnsdx) of Wire Swiss GmbH
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14
Impact: Processing maliciously crafted web content may lead to code
execution
Description: A memory corruption issue was addressed with improved
validation.
CVE-2018-4378: an anonymous researcher, zhunki of 360 ESG Codesafe
Team
Installation note:
Safari 12.0.1 may be obtained from the Mac App Store.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
- -----BEGIN PGP SIGNATURE-----
iQJdBAEBCABHFiEEDNXJVNCJJEAVmJdZeC9tht7TK3EFAlvYkgYpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQeC9tht7TK3FPTg//
STcxE6luaSi4t7Jt9knpNxqjFFb4LiAz5dNKD/v9opE3Fq+hiAgOq89qMYEwU3Uf
LehaD3FZvp9dw8TlMNuhg/9SzORBmDBSbncuX6D9jerd8SSTF4Sk8sBrvpipTzU9
wrhqDYdp3wJcYKr1hPnohOYpxqBudeucBgLioaa4VLI9RhzUyUFoHB60BdE4GEot
1WoY5qh0lH4wM3MOQglNoBcJiiDGDQhcJb0BPzqksLI08PB8x+b5/TnWOKmGB/8S
Nv5WGjBEOoPlPUhx8zyhsLK5RViuV+TFcp8yunNDGMSc+3gS50NyXl75hJXESlQB
jlQjf3oGctawMxRiFbcSq/RCv2forYi5nfYkMJvSKMM6CYADzWbMilVeYQkm4yya
WtIakNjr9eXBG2V0sAvJS/Lw5o/9/FyfqjLTkBjkJ+oP+7Kh8RMd3h6Q3Qe+SesD
B2K8AuAeHO6IgxiZmQ9gSqx9B/lSgKQ8+X5FXcR3uL+lddsxrFlWqX874barsL8t
DyBbBM7OwrSCDDKAJx+xhN90t5jZsl2FdNt7u/uQA8Fu9dGFi3gsgCCIbZKjA8zY
DTZqtlEfiJTzJidjaPV5hQTQEOSoJAMGuP8J1VGvUlv67ZPYKa6lyBIfGzMmGPJQ
Jis9Ypyo0sQ0V9ukQsCvkRFnqUGHWZguQSWo59KCr7M=
=mE6M
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBW9j7TGaOgq3Tt24GAQjtZQ//caqm4v2wQ2tlCXU74afzyBibKjVlbKzO
0AqLGlzCWQpwtZELJh467GjdPTWKZYyRuoX57egR5YRxbrg03jJPCDmTIPUoT7qj
tKZUzQ4IFSvYbpCAiR+y5OZkPhZdXWkqoKDpxBgnCPw2k9q4CY5AYot1XFbVvOM8
o/hC3jE9/AAxU6PFhWkxw/kymxd7LPlPu2D/26Zz/h+KW/fSbIS6sKJQoyeCjmii
lPB/yW71Jcpu8rlwupuEM4beYx8o1z90hGA6/l0IJQbxy9BJzHbmbJ2W3v+0Ssw2
eE1CQZJa/gYQFrtNVg2Nd+wncnepF2rxErWDL4n4PuaBseJvbhfqKDxRoOKEEqG+
j+ptDe4E8fWSCxgsWUmVTyL4l6u75RVxa7ojzDMIFzY55g0JcHWuog13Wp+UnzD6
DWHsTJkr2B4bB4EIWWdPATG8KdZI96wLNCGJlM46lhKIw9zyl4oHshDKRWfJAsm8
X3rk6XEOv9jdfRfBJfV53oVuw4twHLOeVK7OXqfP8PCMIdiJjWzhH5FDYpSnQ8QN
fExzsd8sWWZZnUwvPjOD03OVH4M/4Esf4UfjhGrZlvT8iZzi8vvWukbPxriC168G
lKJpiJaAJIDvX303OJYDPFHwpIrfAEiDMWoPQlh5OmqYVdmzszsx8429IEeXMKHV
C0XAcdVar3s=
=5Pzz
-----END PGP SIGNATURE-----