PT-2018-1252 · Apple · Xcode+1

Published 2018-03-29 · Updated 2018-05-04 · CVE-2018-4164

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Xcode versions prior to 9.3

Description The issue involves the LLVM component and is related to insecure privilege management. Exploitation of this issue may allow a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Xcode versions prior to 9.3, update to version 9.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the LLVM component to minimize the risk of exploitation.

Fix

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2018-00725

CVE-2018-4164

Affected Products

Llvm

Xcode

References · 9

• https://osv.dev/vulnerability/CVE-2018-4164 · Vendor Advisory
• https://developer.apple.com/library/content/releasenotes/DeveloperTools/RN-Xcode/Chapters/Introduction.html · Vendor Advisory
• https://support.apple.com/HT208699 · Vendor Advisory
• https://bdu.fstec.ru/vul/2018-00725 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-4164 · Security Note
• http://lists.llvm.org/pipermail/llvm-commits · Note
• http://securitytracker.com/id/1040610 · Note
• http://releases.llvm.org · Note
• http://securityfocus.com/bid/103583 · Note