-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2018-7-9-5 Safari 11.1.2 Safari 11.1.2 is now available and addresses the following: Safari Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4279: Ruilin Yang, Xu Taoyu (xia0yu.win) WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: A memory corruption issue was addressed with improved memory handling. CVE-2018-4270: found by OSS-Fuzz WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: A malicious website may exfiltrate audio data cross-origin Description: Sound fetched through audio elements may be exfiltrated cross-origin. This issue was addressed with improved audio taint tracking. CVE-2018-4278: Jun Kokatsu (@shhnjk) WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: A type confusion issue was addressed with improved memory handling. CVE-2018-4284: Found by OSS-Fuzz WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: A malicious website may be able to cause a denial of service Description: A race condition was addressed with additional validation. CVE-2018-4266: found by OSS-Fuzz WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to arbitrary code execution Description: Multiple memory corruption issues were addressed with improved memory handling. CVE-2018-4261: Omair working with Trend Micro's Zero Day Initiative CVE-2018-4262: Mateusz Krzywicki working with Trend Micro's Zero Day Initiative CVE-2018-4263: Arayz working with Trend Micro's Zero Day Initiative CVE-2018-4264: found by OSS-Fuzz, Yu Zhou and Jundong Xie of Ant-financial Light-Year Security Lab CVE-2018-4265: cc working with Trend Micro's Zero Day Initiative CVE-2018-4267: Arayz of Pangu team working with Trend Micro's Zero Day Initiative CVE-2018-4272: found by OSS-Fuzz WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Processing maliciously crafted web content may lead to an unexpected Safari crash Description: Multiple memory corruption issues were addressed with improved input validation. CVE-2018-4271: found by OSS-Fuzz CVE-2018-4273: found by OSS-Fuzz WebKit Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. CVE-2018-4274: an anonymous researcher WebKit Page Loading Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and macOS High Sierra 10.13.6 Impact: Visiting a malicious website may lead to address bar spoofing Description: An inconsistent user interface issue was addressed with improved state management. CVE-2018-4260: xisigr of Tencent's Xuanwu Lab (tencent.com) Installation note: Safari 11.1.2 may be obtained from the Mac App Store. Information will also be posted to the Apple Security Updates web site: https://support.apple.com/kb/HT201222 This message is signed with Apple's Product Security PGP key, and details are available at: https://www.apple.com/support/security/pgp/ -----BEGIN PGP SIGNATURE----- iQJdBAEBCABHFiEEfcwwPWJ3e0Ig26mf8ecVjteJiCYFAltDyFMpHHByb2R1Y3Qt c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQ8ecVjteJiCZJ7xAA o2HCi+IV2AXcKkZ7RQiNr25U77qMoPg6t4lOd9YlRo8dD7m+aVYtL0TJxLyum3KO NjXhl/toW6Y1Y++iKfDLKtVtdX9eXTh2n4qDylPkknHCGiuYGk7VX1xh10EDvWLN uIHEBj/WF9+d7uAv2XrKzfyQ8rTzL960UUywBchO2HfVPk74x27+AVXzcb2Yu98m DkwtODwQtTtINqdMerdCuIGWM3BN1iwzxxX16c+hPuuDP7HTE77TNZrzz09FC4M9 ikMG8JvZmkBWEZaGnb/IRrRJWhZ+k1s33YNFc8wKt8wMsgGvV+l5Bndb7D2d3qQC BHyvokfiWLdVeUAdLpli7RcRgRZDYkaC/Y76VIaZH5frp/bAUm2mb3C6uAaQVR8+ 4f6r9go/gnkQzoNPZuqvzGsi6Nr+gl2B91SqgUdTF5fRw9zXFk7mgkcOYmzsj2uq ZdsRx+i0kkmzZYyffSNU8Y8PCHwnPj9a9D3UThJgAz7HKThI5fH5tbyxKV2wjlPb KBAWkgqMGkwWmsMNLpNJbABbK7TZhOGASb9776n2ZFOWS2u9KNbqNpALZFvaCA/0 uu9Y4aUPPPpz+/c87IviLC2HTUOOKmvhuIGWJF5sKVc8y83b7Loi/P5K90EwiF3i /7DbcAOdfMAEdgDygzzQSzRV97EQWYpLDr97VLCPGI4= =bv9B -----END PGP SIGNATURE-----
