CVE-2018-4278 — MEDIUM (4.3)

Q: How severe is CVE-2018-4278?

CVE-2018-4278 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2018-4278?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Safari, Apple Iphone Os, Apple Tvos, Apple Icloud, Apple Itunes.

Vulnerability Description

In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking.

CVSS Score

4.3

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

LOW

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
Apple	Safari	< 11.1.2
Apple	Iphone Os	< 11.4.1
Apple	Tvos	< 11.4.1
Apple	Icloud	< 7.6
Apple	Itunes	< 12.8
Microsoft	Windows	All versions
Canonical	Ubuntu Linux	16.04

References

http://www.securitytracker.com/id/1041232Third Party AdvisoryVDB Entry
https://security.gentoo.org/glsa/201808-04Third Party Advisory
https://support.apple.com/HT208932Vendor Advisory
https://support.apple.com/HT208933%2C
https://support.apple.com/HT208934%2C
https://support.apple.com/HT208936%2C
https://support.apple.com/HT208938%2C
https://usn.ubuntu.com/3743-1/Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/146479Third Party Advisory
http://www.securitytracker.com/id/1041232Third Party AdvisoryVDB Entry
https://security.gentoo.org/glsa/201808-04Third Party Advisory
https://support.apple.com/HT208932Vendor Advisory
https://support.apple.com/HT208933%2C
https://support.apple.com/HT208934%2C
https://support.apple.com/HT208936%2C

FAQ

What is CVE-2018-4278?

CVE-2018-4278 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In Safari before 11.1.2, iTunes before 12.8 for Windows, iOS before 11.4.1, tvOS before 11.4.1, iCloud for Windows before 7.6, sound fetched through audio elements may be exfiltrated cross-origin. Thi...

How severe is CVE-2018-4278?

CVE-2018-4278 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-4278?

Check the references section above for vendor advisories and patch information. Affected products include: Apple Safari, Apple Iphone Os, Apple Tvos, Apple Icloud, Apple Itunes.