CVE-2018-4190

iTunes: An issue was discovered in certain Apple products.

CVE-2018-4190 is fixed in 8 products on 2 platforms, first by gir1.2-javascriptcoregtk-4.0 2.20.3-0ubuntu0.18.04.1, released April 3, 2019. It is not reported as exploited. Patch Radar priority: High.

HighFixed on 2 platforms
CVSS
8.8
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0342
88th percentile

An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch.

Where it's fixed

ProductFixed inFixReleased
Windows apps
iTunes 12.11.4.15 iTunes 12.11.4.15 Aug 4, 2021
Linux
gir1.2-javascriptcoregtk-4.0 · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 gir1.2-javascriptcoregtk-4.0 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
gir1.2-webkit2-4.0 · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 gir1.2-webkit2-4.0 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
libjavascriptcoregtk-4.0-18 · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 libjavascriptcoregtk-4.0-18 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
libjavascriptcoregtk-4.0-bin · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 libjavascriptcoregtk-4.0-bin 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
libwebkit2gtk-4.0-37 · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 libwebkit2gtk-4.0-37 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
libwebkit2gtk-4.0-37-gtk2 · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 libwebkit2gtk-4.0-37-gtk2 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019
webkit2gtk-driver · Ubuntu 18.04.6 LTS (bionic) 2.20.3-0ubuntu0.18.04.1 webkit2gtk-driver 2.20.3-0ubuntu0.18.04.1 Apr 3, 2019