5.9

CVE-2018-4086

An issue was discovered in certain Apple products. iOS before 11.2.5 is affected. macOS before 10.13.3 is affected. tvOS before 11.2.5 is affected. watchOS before 4.2.2 is affected. The issue involves the "Security" component. It allows remote attackers to spoof certificate validation via crafted name constraints.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Apple ≫ Apple TV Version < 11.2.5
Apple ≫ iPhone OS Version < 11.2.5
Apple ≫ macOS X Version < 10.13.3
Apple ≫ watchOS Version < 4.2.2
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.97% 0.57
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

http://www.securityfocus.com/bid/102782
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040265
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040267
Third Party Advisory
VDB Entry
https://support.apple.com/HT208462
Vendor Advisory
https://support.apple.com/HT208463
Vendor Advisory
https://support.apple.com/HT208464
Vendor Advisory
https://support.apple.com/HT208465
Vendor Advisory