full-disclosure - [FD] APPLE-SA-2018-1-23-5 Safari 11.0.3

Open Source and information security mailing list archives

Message-id: <8CDD0B6C-A281-44A3-A6F5-8FE4CB1C44BC@lists.apple.com>
Date: Tue, 23 Jan 2018 12:46:58 -0800
From: Apple Product Security <product-security-noreply@...ts.apple.com>
To: security-announce@...ts.apple.com
Subject: [FD] APPLE-SA-2018-1-23-5 Safari 11.0.3

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

APPLE-SA-2018-1-23-5 Safari 11.0.3

Safari 11.0.3 is now available and addresses the following:

WebKit
Available for: OS X El Capitan 10.11.6, macOS Sierra 10.12.6, and
macOS High Sierra 10.13.3
Impact: Processing maliciously crafted web content may lead to
arbitrary code execution
Description: Multiple memory corruption issues were addressed with
improved memory handling.
CVE-2018-4088: Jeonghoon Shin of Theori
CVE-2018-4089: Ivan Fratric of Google Project Zero
CVE-2018-4096: found by OSS-Fuzz

Installation note:

Safari 11.0.3 may be obtained from the Mac App Store.

Information will also be posted to the Apple Security Updates
web site: https://support.apple.com/kb/HT201222

This message is signed with Apple's Product Security PGP key,
and details are available at:
https://www.apple.com/support/security/pgp/
-----BEGIN PGP SIGNATURE-----

iQJdBAEBCgBHFiEEcuX4rtoRe4X62yWlg6PvjDRstEYFAlpng7kpHHByb2R1Y3Qt
c2VjdXJpdHktbm9yZXBseUBsaXN0cy5hcHBsZS5jb20ACgkQg6PvjDRstEa4ShAA
zWqMSo7gFJoVlaGXoqp03g2F9Rn7RtiZf4RN8hf4U83dsoaKoRDcOJRdifqExzg0
7xl+j6tmD9XB8PUr5F7FCKOMrOd8IEmxOa/lYQW/HBkc55TPfLw7oZlOFNsKeLYs
+r0HCPml8pGlRe9OS0otd6EsxsGaKv5KqJK0NASwGaiuw+p6cECeUIC4bqTnQg0z
6XDBS4m/wrVUKBiwjV3ypj9HmBJeP6ETGitMS51YyWkR40+ilPD9GwNUwiraxSlB
iScMpJ9+tvg1z0+eGmyg0DaDIrszk1ZqqNK3as7Zg0g2nMA7vBCAjlyUph7W+RTF
ChHTqbeVE4GrJnz6EJWBOmBeT8+WYZLadnJqvhKAqF+x9tjud1jvyfIK1HgXdsSk
/cAxwk6Qzs1qIXLEqqx3yDF9JITFP88RvaK0ARKoNhlb/d23gbLFZ1UI5wxy7yaa
gTh1Udd2cJ3WFgpBmesvz9QDJtC4jccLGA4Aye5qxdBAwH0mvQ6abxRUn1c2p9YO
tqxGv76/qiSUQO1KHCp9RrP/ky/Dz6NSo2zRRcWivjykO0Yy/D3XAIt67rY2y7hu
65jFUnb39ylAqr9WgyfpR0p3zh2Ou/l0ID3LmJ6aUXikgVKwFBd/EG9Q0wDT6CIj
1sOWr8KlWLbUolyfdjKZdfwZt2DcISO/0dJ5xgZVvV8=
=aOVD
-----END PGP SIGNATURE-----

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives