CVE-2018-4437

Multiple memory corruption issues were addressed with improved memory handling. This issue...

8.8 HighFix available

Multiple memory corruption issues were addressed with improved memory handling. This issue affected versions prior to iOS 12.1.1, tvOS 12.1.1, watchOS 5.1.2, Safari 12.0.2, iTunes 12.9.2 for Windows, iCloud for Windows 7.9.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

1.48%Down 0.5 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2018-4437
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-119
Updated: 2026-11-02

CVE List No score

Record: CVE-2018-4437
Updated: 2026-11-02

EUVDEUVD-2018-16223 No score

Record: EUVD-2018-16223
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5xgq-j96p-9ccv 8.8

Multiple memory corruption issues were addressed with improved memory handling. This issue...

Record: GHSA-5xgq-j96p-9ccv
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-119
Updated: 2026-11-02

OSVALPINE-CVE-2018-4437 8.8

Record: ALPINE-CVE-2018-4437
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

Record: CVE-2018-4437
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 9 moreShow less

OSVDEBIAN-CVE-2018-4437 8.8

Record: DEBIAN-CVE-2018-4437
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-4437 8.8

Record: UBUNTU-CVE-2018-4437
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0081-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.5 fixes the following issues:

Security issues fixed:

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0081-1
Updated: 2026-11-02

OSVopenSUSE-SU-2019:0308-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:0308-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:11506-1 No score

libjavascriptcoregtk-4_0-18-2.32.4-1.1 on GA media

These are all security issues fixed in the libjavascriptcoregtk-4_0-18-2.32.4-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:11506-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0092-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.5 fixes the following issues:

Security issues fixed:

CVE-2018-4372, CVE-2018-4345, CVE-2018-4386, CVE-2018-4375, CVE-2018-4376, CVE-2018-4378, CVE-2018-4382, CVE-2018-4392, CVE-2018-4416, CVE-2018-4191, CVE-2018-4197, CVE-2018-4299, CVE-2018-4306, CVE-2018-4309, CVE-2018-4312, CVE-2018-4314, CVE-2018-4315, CVE-2018-4316, CVE-2018-4317, CVE-2018-4318, CVE-2018-4319, CVE-2018-4323, CVE-2018-4328, CVE-2018-4358, CVE-2018-4359, CVE-2018-4361, CVE-2018-4373, CVE-2018-4162, CVE-2018-4163, CVE-2018-4165, CVE-2018-11713, CVE-2018-4207, CVE-2018-4208, CVE-2018-4209, CVE-2018-4210, CVE-2018-4212, CVE-2018-4213, CVE-2018-4437, CVE-2018-4438, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464 (bsc#1119558, bsc#1116998, bsc#1110279)

Record: SUSE-SU-2019:0092-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0146-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.5 fixes the following issues:

Security issues fixed:

CVE-2018-4438: Fixed a logic issue which lead to memory corruption (bsc#1119554)
CVE-2018-4437, CVE-2018-4441, CVE-2018-4442, CVE-2018-4443, CVE-2018-4464: Fixed multiple memory corruption issues with improved memory handling (bsc#1119553, bsc#1119555, bsc#1119556, bsc#1119557, bsc#1119558)

Record: SUSE-SU-2019:0146-1
Updated: 2026-11-02

OSVSUSE-SU-2019:0497-1 No score

Security update for webkit2gtk3

This update for webkit2gtk3 to version 2.22.6 fixes the following issues (boo#1124937 boo#1119558):

Security vulnerabilities fixed:

CVE-2018-4437: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119553)
CVE-2018-4438: Processing maliciously crafted web content may lead to arbitrary code execution. A logic issue existed resulting in memory corruption. This was addressed with improved state management. (boo#1119554)
CVE-2018-4441: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119555)
CVE-2018-4442: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119556)
CVE-2018-4443: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling. (boo#1119557)
CVE-2018-4464: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling. (boo#1119558)
CVE-2019-6212: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6215: Processing maliciously crafted web content may lead to arbitrary code execution. A type confusion issue was addressed with improved memory handling.
CVE-2019-6216: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6217: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6226: Processing maliciously crafted web content may lead to arbitrary code execution. Multiple memory corruption issues were addressed with improved memory handling.
CVE-2019-6227: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6229: Processing maliciously crafted web content may lead to universal cross site scripting. A logic issue was addressed with improved validation.
CVE-2019-6233: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.
CVE-2019-6234: Processing maliciously crafted web content may lead to arbitrary code execution. A memory corruption issue was addressed with improved memory handling.

Other bug fixes and changes:

Make kinetic scrolling slow down smoothly when reaching the ends of pages, instead of abruptly, to better match the GTK+ behaviour.
Fix Web inspector magnifier under Wayland.
Fix garbled rendering of some websites (e.g. YouTube) while scrolling under X11.
Fix several crashes, race conditions, and rendering issues.

For a detailed list of changes, please refer to:

Record: SUSE-SU-2019:0497-1
Updated: 2026-11-02

OSVUSN-3854-1 No score

webkit2gtk vulnerabilities

A large number of security issues were discovered in the WebKitGTK+ Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and arbitrary code execution.

Record: USN-3854-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.10	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.11	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.12	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.13	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.14	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.15	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.16	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.17	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.18	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.19	before 2.22.7-r0	2.22.7-r0

Show 38 moreShow less

Affected packages
Package	Affected	Fixed
`webkit2gtk` Alpine:v3.20	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Alpine:v3.9	before 2.22.7-r0	2.22.7-r0
`webkit2gtk` Debian:12	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:13	before 2.22.5-1	2.22.5-1
`webkit2gtk` Debian:14	before 2.22.5-1	2.22.5-1
`webkit2gtk3` SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 43 CVEs	before 2.22.5-3.13.1	2.22.5-3.13.1
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 43 CVEs	before 2.22.5-3.13.1	2.22.5-3.13.1
`webkit2gtk3` SUSE:OpenStack Cloud 7 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP3 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP2 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP3 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Software Development Kit 12 SP4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-LTSS From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP3 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP3 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server 12 SP4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP3 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Workstation Extension 12 SP4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Enterprise Storage 4 From an advisory covering 6 CVEs	before 2.22.5-2.32.2	2.22.5-2.32.2
`webkit2gtk3` SUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`webkit2gtk3` SUSE:Linux Enterprise Module for Desktop Applications 15 From an advisory covering 15 CVEs	before 2.22.6-3.18.2	2.22.6-3.18.2
`qtwebkit-opensource-src` Ubuntu:16.04:LTS	All versions, plus listed versions 5.4.2+dfsg-1ubuntu2.15.5.1+dfsg-2ubuntu1	None known
`webkit2gtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.8.5+dfsg1-32.10.3+dfsg1-12.10.4+dfsg1-12.10.5-12.10.6-1 Show 21 moreShow less 2.10.6-1ubuntu12.10.8-1ubuntu12.10.9-1ubuntu12.12.5-0ubuntu0.16.04.12.14.2-0ubuntu0.16.04.12.14.3-0ubuntu0.16.04.12.14.5-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.12.16.1-0ubuntu0.16.04.22.16.2-0ubuntu0.16.04.12.16.3-0ubuntu0.16.04.12.16.6-0ubuntu0.16.04.12.18.0-0ubuntu0.16.04.22.18.3-0ubuntu0.16.04.12.18.4-0ubuntu0.16.04.12.18.5-0ubuntu0.16.04.12.18.6-0ubuntu0.16.04.12.20.1-0ubuntu0.16.04.12.20.2-0ubuntu0.16.04.12.20.3-0ubuntu0.16.04.12.20.5-0ubuntu0.16.04.1	None known
`qtwebkit-source` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu102.3.2-0ubuntu11	None known
`webkitgtk` Ubuntu:16.04:LTS	All versions, plus listed versions 2.4.9-2ubuntu22.4.10-0ubuntu12.4.11-0ubuntu0.1	None known
`webkit2gtk` Ubuntu:18.04:LTS	before 2.22.5-0ubuntu0.18.04.1, plus listed versions 2.18.0-22.18.0-2build12.18.2-12.18.3-12.18.4-1 Show 13 moreShow less 2.18.6-12.19.91-1ubuntu12.19.92-12.20.0-12.20.0-22.20.0-2ubuntu12.20.1-12.20.2-0ubuntu0.18.04.12.20.3-0ubuntu0.18.04.12.20.5-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.12.22.2-0ubuntu0.18.04.22.22.4-0ubuntu0.18.04.1	2.22.5-0ubuntu0.18.04.1
`qtwebkit-opensource-src` Ubuntu:18.04:LTS	All versions, plus listed versions 5.9.1+dfsg-5ubuntu15.9.1+dfsg-5ubuntu35.212.0~alpha2-5build25.212.0~alpha2-5build45.212.0~alpha2-75.212.0~alpha2-7build25.212.0~alpha2-7ubuntu1	None known
`qtwebkit-source` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.2-0ubuntu13	None known
`webkitgtk` Ubuntu:18.04:LTS	All versions, plus listed versions 2.4.11-32.4.11-3ubuntu22.4.11-3ubuntu3	None known
`qtwebkit-opensource-src` Ubuntu:20.04:LTS	All versions, plus listed versions 5.212.0~alpha3-35.212.0~alpha3-55.212.0~alpha3-65.212.0~alpha3-75.212.0~alpha4-15.212.0~alpha4-1ubuntu15.212.0~alpha4-1ubuntu25.212.0~alpha4-1ubuntu2.1	None known
`qtwebkit-opensource-src` Ubuntu:22.04:LTS	All versions, plus listed versions 5.212.0~alpha4-125.212.0~alpha4-135.212.0~alpha4-145.212.0~alpha4-14build15.212.0~alpha4-14ubuntu25.212.0~alpha4-15ubuntu1	None known
`qtwebkit-opensource-src` Ubuntu:24.04:LTS	All versions, plus listed versions 5.212.0~alpha4-335.212.0~alpha4-33build15.212.0~alpha4-345.212.0~alpha4-34ubuntu35.212.0~alpha4-34ubuntu45.212.0~alpha4-36	None known
`webkit2gtk3` openSUSE:Leap 15.0 From an advisory covering 43 CVEs	before 2.22.5-lp150.2.9.1	2.22.5-lp150.2.9.1
`webkit2gtk3` openSUSE:Leap 15.0 From an advisory covering 15 CVEs	before 2.22.6-lp150.2.12.1	2.22.6-lp150.2.12.1
`gtk3` openSUSE:Tumbleweed From an advisory covering 126 CVEs	before 2.32.4-1.1	2.32.4-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-4437 is a high vulnerability (CVSS 8.8) in Apple Icloud, published December 17, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.48%, the 74th percentile. Fixed in webkit2gtk 2.22.7-r0.

References

Show 182 moreShow less