CVE-2018-4124

CRITICAL

Apple Iphone OS < 11.2.6 - Memory Corruption

Title source: rule

Description

An issue was discovered in certain Apple products. iOS before 11.2.6 is affected. macOS before 10.13.3 Supplemental Update is affected. tvOS before 11.2.6 is affected. watchOS before 4.2.3 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a crafted string containing a certain Telugu character.

Exploits (1)

nomisec NO CODE 2 stars

by jamf · poc

https://github.com/jamf/TELUGU_CVE-2018-4124_POC

View Code ZIP pw:eip

References (6)

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1040396

[Third Party Advisory] https://nakedsecurity.sophos.com/2018/02/20/apple-fixes-that-1-character-to-crash-your-mac-and-iphone-bug/

[Vendor Advisory] https://support.apple.com/HT208534

[Vendor Advisory] https://support.apple.com/HT208535

[Vendor Advisory] https://support.apple.com/HT208536

[Vendor Advisory] https://support.apple.com/HT208537

Scores

CVSS v3 9.8

EPSS 0.2622

EPSS Percentile 96.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-119

Status published

Products (4)

apple/iphone_os < 11.2.6

apple/mac_os_x < 10.13.3

apple/tvos < 11.2.6

apple/watchos < 4.2.3

Published Apr 03, 2018

Tracked Since Feb 18, 2026