CVE-2018-4206: Buffer Overflow
First published: Fri Jun 08 2018(Updated: )
An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. tvOS before 11.4 is affected. watchOS before 4.3.1 is affected. The issue involves the "Crash Reporter" component. It allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted app that replaces a privileged port name.
Credit: product-security@apple.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apple Apple Tv | <11.4 | |
| Apple iPhone OS | <11.3.1 | |
| Apple Mac OS X | <10.13.4 | |
| Apple watchOS | <4.3.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/103957
- http://www.securityfocus.com/bid/103958
- http://www.securitytracker.com/id/1040744
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1529
- https://support.apple.com/HT208742
- https://support.apple.com/HT208743
- https://support.apple.com/HT208850
- https://support.apple.com/HT208851
- https://www.exploit-db.com/exploits/44562/
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID for this issue is CVE-2018-4206.
Which Apple products are affected by this vulnerability?
The vulnerability affects certain Apple products, including Apple TV, iPhone OS, Mac OS X, and watchOS.
What is the severity rating of this vulnerability?
The severity rating for this vulnerability is high, with a value of 7.8.
How can an attacker exploit this vulnerability?
Attackers can exploit this vulnerability by executing arbitrary code through the "Crash Reporter" component.
Are there any known fixes or patches for this vulnerability?
Yes, Apple has released security updates and patches to address this vulnerability. It is recommended to update to the latest available version of the affected software.
- agent/type
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/description
- agent/weakness
- agent/severity
- agent/references
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/first-publish-date
- agent/event
- agent/source
- vendor/apple
- canonical/apple apple tv
- canonical/apple iphone os
- canonical/apple mac os x
- canonical/apple watchos