CVE-2018-4246
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11...
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
CVE-2018-4246- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-704
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
CVE-2018-4246- Updated
- 2026-11-02
EUVDEUVD-2018-16032 No score
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
EUVD-2018-16032- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f78v-r3x6-9c84
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11...
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
GHSA-f78v-r3x6-9c84- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-704
- Updated
- 2026-11-02
OSVALPINE-CVE-2018-4246
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
ALPINE-CVE-2018-4246- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
CVE-2018-4246- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVDEBIAN-CVE-2018-4246
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
DEBIAN-CVE-2018-4246- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-4246
An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.
- Record
UBUNTU-CVE-2018-4246- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2018-0302 No score
Updated webkit2 packages fix security vulnerability
The webkit2 package has been updated to version 2.20.3, fixing several security issues and other bugs.
- Record
MGASA-2018-0302- Updated
- 2026-11-02
OSVSUSE-SU-2018:3387-1 No score
Security update for webkit2gtk3
This update for webkit2gtk3 to version 2.20.3 fixes the issues:
The following security vulnerabilities were addressed:
- CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs (boo#1101999)
- CVE-2017-13884: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2017-13885: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2017-7153: An unspecified issue allowed remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted web site that sends a 401 Unauthorized redirect (bsc#1077535).
- CVE-2017-7160: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2017-7161: An unspecified issue allowed remote attackers to execute arbitrary code via special characters that trigger command injection (bsc#1075775, bsc#1077535).
- CVE-2017-7165: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2018-4088: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2018-4096: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1075775).
- CVE-2018-4200: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280).
- CVE-2018-4204: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1092279).
- CVE-2018-4101: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182).
- CVE-2018-4113: An issue in the JavaScriptCore function in the 'WebKit' component allowed attackers to trigger an assertion failure by leveraging improper array indexing (bsc#1088182)
- CVE-2018-4114: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182)
- CVE-2018-4117: An unspecified issue allowed remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site (bsc#1088182, bsc#1102530).
- CVE-2018-4118: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182)
- CVE-2018-4119: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182)
- CVE-2018-4120: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1088182).
- CVE-2018-4121: An unspecified issue allowed remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site (bsc#1092278).
- CVE-2018-4122: An unspecified issue allowed remote attackers to execute arbitrary…
- Record
SUSE-SU-2018:3387-1- Updated
- 2026-11-02
OSVUSN-3743-1 No score
webkit2gtk vulnerabilities
A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.
- Record
USN-3743-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkAlpine:v3.8 |
before 2.20.4-r0 | 2.20.4-r0 |
webkit2gtkDebian:12 |
before 2.20.4-1 | 2.20.4-1 |
webkit2gtkDebian:13 |
before 2.20.4-1 | 2.20.4-1 |
webkit2gtkDebian:14 |
before 2.20.4-1 | 2.20.4-1 |
webkit2Mageia:6 From an advisory covering 8 CVEs |
before 2.20.3-1.mga6 | 2.20.3-1.mga6 |
webkit2gtk3SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 40 CVEs |
before 2.20.3-2.23.8 | 2.20.3-2.23.8 |
webkit2gtk3SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 40 CVEs |
before 2.20.3-2.23.8 | 2.20.3-2.23.8 |
webkit2gtk3SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 40 CVEs |
before 2.20.3-2.23.8 | 2.20.3-2.23.8 |
webkit2gtk3SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 40 CVEs |
before 2.20.3-2.23.8 | 2.20.3-2.23.8 |
webkit2gtk3SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 40 CVEs |
before 2.20.3-2.23.8 | 2.20.3-2.23.8 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
webkit2gtkUbuntu:16.04:LTS |
before 2.20.5-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 20 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.1 |
2.20.5-0ubuntu0.16.04.1 |
qtwebkit-opensource-srcUbuntu:16.04:LTS |
All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1 |
None known |
qtwebkit-sourceUbuntu:16.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11 |
None known |
webkitgtkUbuntu:16.04:LTS |
All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1 |
None known |
webkit2gtkUbuntu:18.04:LTS |
before 2.20.5-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 9 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.1 |
2.20.5-0ubuntu0.18.04.1 |
qtwebkit-opensource-srcUbuntu:18.04:LTS |
All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1 |
None known |
qtwebkit-sourceUbuntu:18.04:LTS |
All versions, plus listed versions 2.3.2-0ubuntu13 |
None known |
webkitgtkUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3 |
None known |
qtwebkit-opensource-srcUbuntu:20.04:LTS |
All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1 |
None known |
qtwebkit-opensource-srcUbuntu:22.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1 |
None known |
qtwebkit-opensource-srcUbuntu:24.04:LTS |
All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36 |
None known |
webkit2gtkUbuntu:16.04:LTS From an advisory covering 14 CVEs |
before 2.20.5-0ubuntu0.16.04.1, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 20 moreShow less2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.1 |
2.20.5-0ubuntu0.16.04.1 |
webkit2gtkUbuntu:18.04:LTS From an advisory covering 14 CVEs |
before 2.20.5-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 9 moreShow less2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.1 |
2.20.5-0ubuntu0.18.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-4246 is a high vulnerability (CVSS 8.8) in Apple Icloud, published June 8, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.97%, the 87th percentile. Fixed in webkit2gtk 2.20.4-r0.
References
support.apple.com/HT208850
usn.ubuntu.com/3743-1
securitytracker.com/id/1041029
Show 83 moreShow less
nvd.nist.gov/vuln/detail/CVE-2018-4246
github.com/advisories/GHSA-f78v-r3x6-9c84
security.alpinelinux.org/vuln/CVE-2018-4246
security-tracker.debian.org/tracker/CVE-2018-4246
advisories.mageia.org/MGASA-2018-0302.html
bugs.mageia.org/show_bug.cgi?id=23189
webkitgtk.org/security/WSA-2018-0005.html
suse.com/support/update/announcement/2018/suse-su-20183387-1
bugzilla.suse.com/1075775
ubuntu.com/security/CVE-2018-4246
cve.org/CVERecord?id=CVE-2018-4246
Left out here: the rest of 1 source description. The JSON record has them.