CVE-2018-4187 — Improper Input Validation in Apple Iphone OS

CWE-20 — Improper Input Validation9 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
0.6%
top 29.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
8
Apple Iphone OSApple MAC OS XApple IOS+5 more
Timeline
PublishedJun 8
Latest updateMay 14

Description

An issue was discovered in certain Apple products. iOS before 11.3.1 is affected. macOS before 10.13.4 Security Update 2018-001 is affected. The issue involves the "LinkPresentation" component. It allows remote attackers to spoof the UI via a crafted URL in a text message.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages8 packages

▶NVDapple/mac_os_x< 10.13.4
▶NVDapple/iphone_os< 11.3.1

🔴Vulnerability Details

1
GHSA
GHSA-m35w-m68r-3qr2: An issue was discovered in certain Apple products↗2022-05-14
▶

📋Vendor Advisories

7
Apple
CVE-2018-4187: macOS Mojave 10.14.1, Security Update 2018-002 High Sierra, Security Update 2018-005 Sierra↗2018-10-30
▶
Apple
CVE-2018-4187: tvOS 11.4↗2018-05-29
▶
Apple
CVE-2018-4187: watchOS 4.3.1↗2018-05-29
▶
Apple
CVE-2018-4187: Security Update 2018-001↗2018-04-24
▶
Apple
CVE-2018-4187: iOS 11.3.1↗2018-04-24
▶