PT-2021-8853 · Apple · Ios+5

Gustavo Grieco · Published 2021-12-23 · Updated 2022-01-05 · CVE-2018-4302

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions macOS High Sierra versions prior to 10.13 iCloud for Windows versions prior to 7.0 watchOS versions prior to 4 iOS versions prior to 11 iTunes for Windows versions prior to 12.7

Description A null pointer dereference issue was addressed with improved validation. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.

Recommendations For macOS High Sierra, update to version 10.13 or later. For iCloud for Windows, update to version 7.0 or later. For watchOS, update to version 4 or later. For iOS, update to version 11 or later. For iTunes for Windows, update to version 12.7 or later.

Fix

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

CVE-2018-4302

Affected Products

Icloud For Windows

Ios

Itunes

Itunes For Windows

Macos High Sierra

Watchos

References · 8

• https://support.apple.com/en-us/HT208112 · Vendor Advisory
• https://support.apple.com/en-us/HT208144 · Vendor Advisory
• https://support.apple.com/en-us/HT208142 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-4302 · Vendor Advisory
• https://support.apple.com/en-us/HT208115 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-4302 · Security Note
• https://support.apple.com/en-us/HT208141 · Vendor Advisory
• https://t.me/cibsecurity/34590 · Telegram Post