Yuan Deng

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.3 Safari versions prior to 11.1 iCloud versions prior to 7.4 on Windows iTunes versions prior to 12.7.4 on Windows tvOS versions prior to 11.3 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11.3, update to version 11.3 or later. For Safari versions prior to 11.1, update to version 11.1 or later. For iCloud versions prior to 7.4 on Windows, update to version 7.4 or later. For iTunes versions prior to 12.7.4 on Windows, update to version 12.7.4 or later. For tvOS versions prior to 11.3, update to version 11.3 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.2 Safari versions prior to 11.0.2 iCloud versions prior to 7.2 on Windows iTunes versions prior to 12.7.2 on Windows tvOS versions prior to 11.2 watchOS versions prior to 4.2 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11.2, update to version 11.2 or later. For Safari versions prior to 11.0.2, update to version 11.0.2 or later. For iCloud versions prior to 7.2 on Windows, update to version 7.2 or later. For iTunes versions prior to 12.7.2 on Windows, update to version 12.7.2 or later. For tvOS versions prior to 11.2, update to version 11.2 or later. For watchOS versions prior to 4.2, update to version 4.2 or later.

**Name of the Vulnerable Software and Affected Versions** iOS versions prior to 11.2 Safari versions prior to 11.0.2 iCloud versions prior to 7.2 on Windows iTunes versions prior to 12.7.2 on Windows tvOS versions prior to 11.2 **Description** The issue involves the WebKit component and allows remote attackers to execute arbitrary code or cause a denial of service, resulting in memory corruption and application crash, via a crafted web site. **Recommendations** For iOS versions prior to 11.2, update to version 11.2 or later. For Safari versions prior to 11.0.2, update to version 11.0.2 or later. For iCloud versions prior to 7.2 on Windows, update to version 7.2 or later. For iTunes versions prior to 12.7.2 on Windows, update to version 12.7.2 or later. For tvOS versions prior to 11.2, update to version 11.2 or later.

**Name of the Vulnerable Software and Affected Versions** International Components for Unicode (ICU) for C/C++ versions prior to 60.2 Google Chrome versions prior to 62.0.3202.75 **Description** A stack buffer overflow in the NumberingSystem component allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. This issue affects various products, including Google Chrome, Opera, and others. **Recommendations** For International Components for Unicode (ICU) for C/C++ versions prior to 60.2, update to version 60.2 or later. For Google Chrome versions prior to 62.0.3202.75, update to version 62.0.3202.75 or later.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 60.0.3112.78 **Description** The issue is related to insufficient validation of untrusted input in PPAPI Plugins, which could allow a remote attacker to potentially gain privilege elevation. This can be achieved via a crafted HTML page. **Recommendations** For versions prior to 60.0.3112.78, update to version 60.0.3112.78 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 60.0.3112.78 Opera versions prior to 60.0.3112.78 **Description** The issue is related to insufficient validation of untrusted input in PPAPI Plugins, which could allow a remote attacker to potentially perform a sandbox escape via a crafted HTML page. This could be achieved by exploiting the vulnerability in the PPAPI implementation. **Recommendations** For Google Chrome versions prior to 60.0.3112.78, update to version 60.0.3112.78 or later to resolve the issue. For Opera versions prior to 60.0.3112.78, update to version 60.0.3112.78 or later to resolve the issue. As a temporary workaround, consider restricting access to PPAPI Plugins until a patch is available.