Home / mailings APPLE-SA-2018-12-05-4 Safari 12.0.2
Posted on 05 December 2018
Apple Security-announce-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
APPLE-SA-2018-12-05-4 Safari 12.0.2
Safari 12.0.2 is now available and addresses the following:
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: Visiting a malicious website may lead to address bar spoofing
Description: A logic issue was addressed with improved state
management.
CVE-2018-4440: Wenxu Wu of Tencent Security Xuanwu Lab
(xlab.tencent.com)
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: Visiting a malicious website may lead to user interface
spoofing
Description: A logic issue was addressed with improved validation.
CVE-2018-4439: xisigr of Tencent's Xuanwu Lab (tencent.com)
Safari
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: A user may be unable to fully delete browsing history
Description: "Clear History and Website Data" did not clear the
history. The issue was addressed with improved data deletion.
CVE-2018-4445: William Breuer
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4437: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of
KAIST Softsec Lab, Korea
CVE-2018-4464: HyungSeok Han, DongHyeon Oh, and Sang Kil Cha of
KAIST Softsec Lab, Korea
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A memory corruption issue was addressed with improved
memory handling.
CVE-2018-4441: lokihardt of Google Project Zero
CVE-2018-4442: lokihardt of Google Project Zero
CVE-2018-4443: lokihardt of Google Project Zero
WebKit
Available for: macOS Sierra 10.12.6, macOS High Sierra 10.13.6, and
macOS Mojave 10.14.1
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: A logic issue existed resulting in memory corruption.
This was addressed with improved state management.
CVE-2018-4438: lokihardt of Google Project Zero
Installation note:
Safari 12.0.2 may be obtained from the Mac App Store.
Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222
This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
