<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for webkit2gtk3</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>openSUSE-SU-2018:3473-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-10-25T17:38:56Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-10-25T17:38:56Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-10-25T17:38:56Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for webkit2gtk3</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for webkit2gtk3 to version 2.20.3 fixes the issues:

The following security vulnerabilities were addressed:

- CVE-2018-12911: Fixed an off-by-one error in xdg_mime_get_simple_globs
  (boo#1101999)
- CVE-2017-13884: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2017-13885: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2017-7153: An unspecified issue allowed remote attackers to spoof
  user-interface information (about whether the entire content is derived from a
  valid TLS session) via a crafted web site that sends a 401 Unauthorized
  redirect (bsc#1077535).
- CVE-2017-7160: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2017-7161: An unspecified issue allowed remote attackers to execute
  arbitrary code via special characters that trigger command injection
  (bsc#1075775, bsc#1077535).
- CVE-2017-7165: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2018-4088: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2018-4096: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1075775).
- CVE-2018-4200: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site that triggers a
  WebCore::jsElementScrollHeightGetter use-after-free (bsc#1092280).
- CVE-2018-4204: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1092279).
- CVE-2018-4101: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4113: An issue in the JavaScriptCore function in the 'WebKit'
  component allowed attackers to trigger an assertion failure by leveraging
  improper array indexing (bsc#1088182)
- CVE-2018-4114: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182) 
- CVE-2018-4117: An unspecified issue allowed remote attackers to bypass the
  Same Origin Policy and obtain sensitive information via a crafted web site
  (bsc#1088182, bsc#1102530).
- CVE-2018-4118: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182) 
- CVE-2018-4119: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182) 
- CVE-2018-4120: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4121: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1092278).
- CVE-2018-4122: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4125: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4127: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4128: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4129: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4146: An unspecified issue allowed attackers to cause a denial of
  service (memory corruption) via a crafted web site (bsc#1088182).
- CVE-2018-4161: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4162: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4163: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4165: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1088182).
- CVE-2018-4190: An unspecified issue allowed remote attackers to obtain
  sensitive credential information that is transmitted during a CSS mask-image
  fetch (bsc#1097693)
- CVE-2018-4199: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (buffer overflow and application
  crash) via a crafted web site (bsc#1097693)
- CVE-2018-4218: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site that triggers an @generatorState use-after-free
  (bsc#1097693)
- CVE-2018-4222: An unspecified issue allowed remote attackers to execute
  arbitrary code via a crafted web site that leverages a getWasmBufferFromValue
  out-of-bounds read during WebAssembly compilation (bsc#1097693) 
- CVE-2018-4232: An unspecified issue allowed remote attackers to overwrite
  cookies via a crafted web site (bsc#1097693) 
- CVE-2018-4233: An unspecified issue allowed remote attackers to execute
  arbitrary code or cause a denial of service (memory corruption and application
  crash) via a crafted web site (bsc#1097693) 
- CVE-2018-4246: An unspecified issue allowed remote attackers to execute
  arbitrary code via a crafted web site that leverages type confusion
  (bsc#1104169) 
- CVE-2018-11646: webkitFaviconDatabaseSetIconForPageURL and
  webkitFaviconDatabaseSetIconURLForPageURL mishandled an unset pageURL, leading
  to an application crash (bsc#1095611)
- CVE-2018-4133: A Safari cross-site scripting (XSS) vulnerability allowed
  remote attackers to inject arbitrary web script or HTML via a crafted URL
  (bsc#1088182).
- CVE-2018-11713: The libsoup network backend of WebKit unexpectedly failed to
  use system proxy settings for WebSocket connections. As a result, users could
  be deanonymized by crafted web sites via a WebSocket connection (bsc#1096060).
- CVE-2018-11712: The libsoup network backend of WebKit failed to perform TLS
  certificate verification for WebSocket connections (bsc#1096061).


This update for webkit2gtk3 fixes the following issues:

- Fixed a crash when atk_object_ref_state_set is called on an AtkObject that's
  being destroyed (bsc#1088932).
- Fixed crash when using Wayland with QXL/virtio (bsc#1079512)
- Disable Gigacage if mmap fails to allocate in Linux.
- Add user agent quirk for paypal website.
- Properly detect compiler flags, needed libs, and fallbacks for
  usage of 64-bit atomic operations.
- Fix a network process crash when trying to get cookies of
  about:blank page.
- Fix UI process crash when closing the window under Wayland.
- Fix several crashes and rendering issues.
- Do TLS error checking on GTlsConnection::accept-certificate to
  finish the load earlier in case of errors.
- Properly close the connection to the nested wayland compositor
  in the Web Process.
- Avoid painting backing stores for zero-opacity layers.
- Fix downloads started by context menu failing in some websites
  due to missing user agent HTTP header.
- Fix video unpause when GStreamerGL is disabled.
- Fix several GObject introspection annotations.
- Update user agent quiks to fix Outlook.com and Chase.com.
- Fix several crashes and rendering issues.
- Improve error message when Gigacage cannot allocate virtual memory.
- Add missing WebKitWebProcessEnumTypes.h to webkit-web-extension.h.
- Improve web process memory monitor thresholds.
- Fix a web process crash when the web view is created and destroyed quickly.
- Fix a network process crash when load is cancelled while searching for
  stored HTTP auth credentials.
- Fix the build when ENABLE_VIDEO, ENABLE_WEB_AUDIO and
  ENABLE_XSLT are disabled.
- New API to retrieve and delete cookies with WebKitCookieManager.
- New web process API to detect when form is submitted via JavaScript.
- Several improvements and fixes in the touch/gestures support.
- Support for the “system” CSS font family.
- Complex text rendering improvements and fixes.
- More complete and spec compliant WebDriver implementation.
- Ensure DNS prefetching cannot be re-enabled if disabled by settings.
- Fix seek sometimes not working.
- Fix rendering of emojis that were using the wrong scale factor
  in some cases.
- Fix rendering of combining enclosed keycap.
- Fix rendering scale of some layers in HiDPI.
- Fix a crash in Wayland when closing the web view.
- Fix crashes upower crashes when running inside a chroot or on
  systems with broken dbus/upower.
- Fix memory leaks in GStreamer media backend when using
  GStreamer 1.14.
- Fix several crashes and rendering issues.
- Add ENABLE_ADDRESS_SANITIZER to make it easier to build with
  asan support.
- Fix a crash a under Wayland when using mesa software
  rasterization.
- Make fullscreen video work again.
- Fix handling of missing GStreamer elements.
- Fix rendering when webm video is played twice.
- Fix kinetic scrolling sometimes jumping around.
- Fix build with ICU configured without collation support.
- WebSockets use system proxy settings now (requires libsoup 2.61.90).
- Show the context menu on long-press gesture.
- Add support for Shift + mouse scroll to scroll horizontally.
- Fix zoom gesture to actually zoom instead of changing the page
  scale.
- Implement support for Graphics ARIA roles.
- Make sleep inhibitors work under Flatpak.
- Add get element CSS value command to WebDriver.
- Fix a crash aftter a swipe gesture.
- Fix several crashes and rendering issues.
- Fix crashes due to duplicated symbols in libjavascriptcoregtk
  and libwebkit2gtk.
- Fix parsing of timeout values in WebDriver.
- Implement get timeouts command in WebDriver.
- Fix deadlock in GStreamer video sink during shutdown when
  accelerated compositing is disabled.
- Fix several crashes and rendering issues.
- Add web process API to detect when form is submitted via
  JavaScript.
- Add new API to replace
  webkit_form_submission_request_get_text_fields() that is now
  deprecated.
- Add WebKitWebView::web-process-terminated signal and deprecate
  web-process-crashed.
- Fix rendering issues when editing text areas.
- Use FastMalloc based GstAllocator for GStreamer.
- Fix web process crash at startup in bmalloc.
- Fix several memory leaks in GStreamer media backend.
- WebKitWebDriver process no longer links to
  libjavascriptcoregtk.
- Fix several crashes and rendering issues.
- Add new API to add, retrieve and delete cookies via
  WebKitCookieManager.
- Add functions to WebSettings to convert font sizes between
  points and pixels.
- Ensure cookie operations take effect when they happen before a
  web process has been spawned.
- Automatically adjust font size when GtkSettings:gtk-xft-dpi
  changes.
- Add initial resource load statistics support.
- Add API to expose availability of certain editing commands in
  WebKitEditorState.
- Add API to query whether a WebKitNavigationAction is a redirect
  or not.
- Improve complex text rendering.
- Add support for the 'system' CSS font family.
- Disable USE_GSTREAMER_GL

This update was imported from the SUSE:SLE-12-SP2:Update update project.</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      <Description>E-Mail link for openSUSE-SU-2018:3473-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="openSUSE Leap 42.3">
      <Branch Type="Product Name" Name="openSUSE Leap 42.3">
        <FullProductName ProductID="openSUSE Leap 42.3">openSUSE Leap 42.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libjavascriptcoregtk-4_0-18-2.20.3-11.1">
      <FullProductName ProductID="libjavascriptcoregtk-4_0-18-2.20.3-11.1">libjavascriptcoregtk-4_0-18-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1">
      <FullProductName ProductID="libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1">libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwebkit2gtk-4_0-37-2.20.3-11.1">
      <FullProductName ProductID="libwebkit2gtk-4_0-37-2.20.3-11.1">libwebkit2gtk-4_0-37-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwebkit2gtk-4_0-37-32bit-2.20.3-11.1">
      <FullProductName ProductID="libwebkit2gtk-4_0-37-32bit-2.20.3-11.1">libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libwebkit2gtk3-lang-2.20.3-11.1">
      <FullProductName ProductID="libwebkit2gtk3-lang-2.20.3-11.1">libwebkit2gtk3-lang-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1">
      <FullProductName ProductID="typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1">typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="typelib-1_0-WebKit2-4_0-2.20.3-11.1">
      <FullProductName ProductID="typelib-1_0-WebKit2-4_0-2.20.3-11.1">typelib-1_0-WebKit2-4_0-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1">
      <FullProductName ProductID="typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1">typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="webkit-jsc-4-2.20.3-11.1">
      <FullProductName ProductID="webkit-jsc-4-2.20.3-11.1">webkit-jsc-4-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="webkit2gtk-4_0-injected-bundles-2.20.3-11.1">
      <FullProductName ProductID="webkit2gtk-4_0-injected-bundles-2.20.3-11.1">webkit2gtk-4_0-injected-bundles-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="webkit2gtk3-2.20.3-11.1">
      <FullProductName ProductID="webkit2gtk3-2.20.3-11.1">webkit2gtk3-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="webkit2gtk3-devel-2.20.3-11.1">
      <FullProductName ProductID="webkit2gtk3-devel-2.20.3-11.1">webkit2gtk3-devel-2.20.3-11.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="webkit2gtk3-plugin-process-gtk2-2.20.3-11.1">
      <FullProductName ProductID="webkit2gtk3-plugin-process-gtk2-2.20.3-11.1">webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libjavascriptcoregtk-4_0-18-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1">libjavascriptcoregtk-4_0-18-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1">libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwebkit2gtk-4_0-37-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1">libwebkit2gtk-4_0-37-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwebkit2gtk-4_0-37-32bit-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1">libwebkit2gtk-4_0-37-32bit-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libwebkit2gtk3-lang-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1">libwebkit2gtk3-lang-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1">typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="typelib-1_0-WebKit2-4_0-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1">typelib-1_0-WebKit2-4_0-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1">typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="webkit-jsc-4-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1">webkit-jsc-4-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="webkit2gtk-4_0-injected-bundles-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1">webkit2gtk-4_0-injected-bundles-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="webkit2gtk3-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1">webkit2gtk3-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="webkit2gtk3-devel-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1">webkit2gtk3-devel-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="webkit2gtk3-plugin-process-gtk2-2.20.3-11.1" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 42.3">
      <FullProductName ProductID="openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1">webkit2gtk3-plugin-process-gtk2-2.20.3-11.1 as a component of openSUSE Leap 42.3</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2017-13884</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-13884.html</URL>
        <Description>CVE-2017-13884</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2017-13885</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-13885.html</URL>
        <Description>CVE-2017-13885</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to spoof user-interface information (about whether the entire content is derived from a valid TLS session) via a crafted web site that sends a 401 Unauthorized redirect.</Note>
    </Notes>
    <CVE>CVE-2017-7153</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7153.html</URL>
        <Description>CVE-2017-7153</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2017-7160</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7160.html</URL>
        <Description>CVE-2017-7160</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="5">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. Safari before 11.0.2 is affected. The issue involves the "WebKit Web Inspector" component. It allows remote attackers to execute arbitrary code via special characters that trigger command injection.</Note>
    </Notes>
    <CVE>CVE-2017-7161</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7161.html</URL>
        <Description>CVE-2017-7161</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="6">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2 is affected. Safari before 11.0.2 is affected. iCloud before 7.2 on Windows is affected. iTunes before 12.7.2 on Windows is affected. tvOS before 11.2 is affected. watchOS before 4.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2017-7165</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2017-7165.html</URL>
        <Description>CVE-2017-7165</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="7">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.</Note>
    </Notes>
    <CVE>CVE-2018-11646</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11646.html</URL>
        <Description>CVE-2018-11646</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1095611</URL>
        <Description>SUSE Bug 1095611</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="8">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ versions 2.20.0 and 2.20.1, failed to perform TLS certificate verification for WebSocket connections.</Note>
    </Notes>
    <CVE>CVE-2018-11712</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11712.html</URL>
        <Description>CVE-2018-11712</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1096061</URL>
        <Description>SUSE Bug 1096061</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="9">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">WebCore/platform/network/soup/SocketStreamHandleImplSoup.cpp in the libsoup network backend of WebKit, as used in WebKitGTK+ prior to version 2.20.0 or without libsoup 2.62.0, unexpectedly failed to use system proxy settings for WebSocket connections. As a result, users could be deanonymized by crafted web sites via a WebSocket connection.</Note>
    </Notes>
    <CVE>CVE-2018-11713</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-11713.html</URL>
        <Description>CVE-2018-11713</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1096060</URL>
        <Description>SUSE Bug 1096060</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="10">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">WebKitGTK+ 2.20.3 has an off-by-one error, with a resultant out-of-bounds write, in the get_simple_globs functions in ThirdParty/xdgmime/src/xdgmimecache.c and ThirdParty/xdgmime/src/xdgmimeglob.c.</Note>
    </Notes>
    <CVE>CVE-2018-12911</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.4</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-12911.html</URL>
        <Description>CVE-2018-12911</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1101999</URL>
        <Description>SUSE Bug 1101999</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104169</URL>
        <Description>SUSE Bug 1104169</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="11">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4088</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4088.html</URL>
        <Description>CVE-2018-4088</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="12">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. Safari before 11.0.3 is affected. iCloud before 7.3 on Windows is affected. iTunes before 12.7.3 on Windows is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4096</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4096.html</URL>
        <Description>CVE-2018-4096</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1075775</URL>
        <Description>SUSE Bug 1075775</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1077535</URL>
        <Description>SUSE Bug 1077535</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="13">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4101</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4101.html</URL>
        <Description>CVE-2018-4101</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="14">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves a JavaScriptCore function in the "WebKit" component. It allows attackers to trigger an assertion failure by leveraging improper array indexing.</Note>
    </Notes>
    <CVE>CVE-2018-4113</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4113.html</URL>
        <Description>CVE-2018-4113</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="15">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4114</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4114.html</URL>
        <Description>CVE-2018-4114</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="16">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. watchOS before 4.3 is affected. The issue involves the fetch API in the "WebKit" component. It allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4117</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4117.html</URL>
        <Description>CVE-2018-4117</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1102530</URL>
        <Description>SUSE Bug 1102530</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="17">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4118</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4118.html</URL>
        <Description>CVE-2018-4118</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="18">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4119</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4119.html</URL>
        <Description>CVE-2018-4119</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="19">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4120</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4120.html</URL>
        <Description>CVE-2018-4120</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="20">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4121</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4121.html</URL>
        <Description>CVE-2018-4121</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1092278</URL>
        <Description>SUSE Bug 1092278</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="21">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4122</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4122.html</URL>
        <Description>CVE-2018-4122</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="22">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4125</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4125.html</URL>
        <Description>CVE-2018-4125</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="23">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4127</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4127.html</URL>
        <Description>CVE-2018-4127</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="24">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4128</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4128.html</URL>
        <Description>CVE-2018-4128</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="25">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4129</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.2</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4129.html</URL>
        <Description>CVE-2018-4129</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="26">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. Safari before 11.1 is affected. The issue involves the "WebKit" component. A Safari cross-site scripting (XSS) vulnerability allows remote attackers to inject arbitrary web script or HTML via a crafted URL.</Note>
    </Notes>
    <CVE>CVE-2018-4133</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.2</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4133.html</URL>
        <Description>CVE-2018-4133</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="27">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows attackers to cause a denial of service (memory corruption) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4146</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.1</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4146.html</URL>
        <Description>CVE-2018-4146</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="28">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4161</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4161.html</URL>
        <Description>CVE-2018-4161</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="29">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4162</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4162.html</URL>
        <Description>CVE-2018-4162</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="30">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4163</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.3</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4163.html</URL>
        <Description>CVE-2018-4163</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="31">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3 is affected. Safari before 11.1 is affected. iCloud before 7.4 on Windows is affected. iTunes before 12.7.4 on Windows is affected. tvOS before 11.3 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4165</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4165.html</URL>
        <Description>CVE-2018-4165</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1088182</URL>
        <Description>SUSE Bug 1088182</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="32">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to obtain sensitive credential information that is transmitted during a CSS mask-image fetch.</Note>
    </Notes>
    <CVE>CVE-2018-4190</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4190.html</URL>
        <Description>CVE-2018-4190</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="33">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4199</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4199.html</URL>
        <Description>CVE-2018-4199</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="34">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers a WebCore::jsElementScrollHeightGetter use-after-free.</Note>
    </Notes>
    <CVE>CVE-2018-4200</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4200.html</URL>
        <Description>CVE-2018-4200</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1092280</URL>
        <Description>SUSE Bug 1092280</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="35">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. iOS before 11.3.1 is affected. Safari before 11.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4204</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4204.html</URL>
        <Description>CVE-2018-4204</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1092279</URL>
        <Description>SUSE Bug 1092279</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="36">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site that triggers an @generatorState use-after-free.</Note>
    </Notes>
    <CVE>CVE-2018-4218</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4218.html</URL>
        <Description>CVE-2018-4218</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="37">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages a getWasmBufferFromValue out-of-bounds read during WebAssembly compilation.</Note>
    </Notes>
    <CVE>CVE-2018-4222</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4222.html</URL>
        <Description>CVE-2018-4222</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="38">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. The issue involves the "WebKit" component. It allows remote attackers to overwrite cookies via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4232</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>4.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:N/I:P/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4232.html</URL>
        <Description>CVE-2018-4232</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="39">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-4233</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4233.html</URL>
        <Description>CVE-2018-4233</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1097693</URL>
        <Description>SUSE Bug 1097693</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="40">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An issue was discovered in certain Apple products. iOS before 11.4 is affected. Safari before 11.1.1 is affected. iCloud before 7.5 on Windows is affected. iTunes before 12.7.5 on Windows is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "WebKit" component. It allows remote attackers to execute arbitrary code via a crafted web site that leverages type confusion.</Note>
    </Notes>
    <CVE>CVE-2018-4246</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libjavascriptcoregtk-4_0-18-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk-4_0-37-32bit-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:libwebkit2gtk3-lang-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-JavaScriptCore-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:typelib-1_0-WebKit2WebExtension-4_0-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit-jsc-4-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk-4_0-injected-bundles-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-devel-2.20.3-11.1</ProductID>
        <ProductID>openSUSE Leap 42.3:webkit2gtk3-plugin-process-gtk2-2.20.3-11.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">Please Install the update.</Description>
        <URL>https://lists.opensuse.org/opensuse-security-announce/2018-10/msg00071.html</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-4246.html</URL>
        <Description>CVE-2018-4246</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1104169</URL>
        <Description>SUSE Bug 1104169</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
