8.8high
CVE-2018-4207
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windo…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.0%
percentile 81%
Public exploits
0
none known
Summary
In iOS before 11.3, Safari before 11.1, iCloud for Windows before 7.4, tvOS before 11.3, watchOS before 4.3, iTunes before 12.7.4 for Windows, unexpected interaction causes an ASSERT failure. This issue was addressed with improved checks.
Exploit prediction (EPSS)
2.04% probability of exploitation in the next 30 days, higher than 81% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Classification
- Weakness
- CWE-20 Improper Input Validation
References
- support.apple.com /HT208695%2C · x_refsource_MISC, x_transferred
- support.apple.com /HT208697%2C · x_refsource_MISC, x_transferred
- support.apple.com /HT208696%2C · x_refsource_MISC, x_transferred
- usn.ubuntu.com /3781-1/ · vendor-advisory, x_refsource_UBUNTU, x_transferred
- support.apple.com /HT208698%2C · x_refsource_MISC, x_transferred
- security.gentoo.org /glsa/201812-04 · vendor-advisory, x_refsource_GENTOO, x_transferred
- support.apple.com /HT208694 · x_refsource_CONFIRM, x_transferred
- support.apple.com /HT208693%2C · x_refsource_MISC, x_transferred
Sources
- CVE List: CVE-2018-4207
- NVD: CVE-2018-4207
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.