{"api_version":"1","generated_at":"2026-07-23T09:12:43+00:00","cve":"CVE-2018-4302","urls":{"html":"https://cve.report/CVE-2018-4302","api":"https://cve.report/api/cve/CVE-2018-4302.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2018-4302","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2018-4302"},"summary":{"title":"CVE-2018-4302","description":"A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.","state":"PUBLIC","assigner":"product-security@apple.com","published_at":"2021-12-23 20:15:00","updated_at":"2022-01-05 20:04:00"},"problem_types":["CWE-476"],"metrics":[],"references":[{"url":"https://support.apple.com/en-us/HT208142","name":"https://support.apple.com/en-us/HT208142","refsource":"MISC","tags":[],"title":"About the security content of iCloud for Windows 7.0 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/en-us/HT208144","name":"https://support.apple.com/en-us/HT208144","refsource":"MISC","tags":[],"title":"About the security content of macOS High Sierra 10.13 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/en-us/HT208141","name":"https://support.apple.com/en-us/HT208141","refsource":"MISC","tags":[],"title":"About the security content of iTunes 12.7 for Windows - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/en-us/HT208112","name":"https://support.apple.com/en-us/HT208112","refsource":"MISC","tags":[],"title":"About the security content of iOS 11 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://support.apple.com/en-us/HT208115","name":"https://support.apple.com/en-us/HT208115","refsource":"MISC","tags":[],"title":"About the security content of watchOS 4 - Apple Support","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-4302","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-4302","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2018","cve_id":"4302","vulnerable":"1","versionEndIncluding":"7.0","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"icloud","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"4302","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"iphone_os","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"4302","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"apple","cpe5":"itunes","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"windows","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"4302","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"mac_os_x","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2018","cve_id":"4302","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"apple","cpe5":"watchos","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"data_type":"CVE","data_format":"MITRE","data_version":"4.0","CVE_data_meta":{"ID":"CVE-2018-4302","ASSIGNER":"product-security@apple.com","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"vendor_name":"Apple","product":{"product_data":[{"product_name":"iOS","version":{"version_data":[{"version_affected":"<","version_value":"11"}]}},{"product_name":"watchOS","version":{"version_data":[{"version_affected":"<","version_value":"4"}]}},{"product_name":"iTunes for Windows","version":{"version_data":[{"version_affected":"<","version_value":"12.7"}]}},{"product_name":"iCloud for Windows","version":{"version_data":[{"version_affected":"<","version_value":"7.0"}]}},{"product_name":"macOS","version":{"version_data":[{"version_affected":"<","version_value":"10.13"}]}}]}}]}},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution"}]}]},"references":{"reference_data":[{"refsource":"MISC","url":"https://support.apple.com/en-us/HT208144","name":"https://support.apple.com/en-us/HT208144"},{"refsource":"MISC","url":"https://support.apple.com/en-us/HT208112","name":"https://support.apple.com/en-us/HT208112"},{"refsource":"MISC","url":"https://support.apple.com/en-us/HT208115","name":"https://support.apple.com/en-us/HT208115"},{"refsource":"MISC","url":"https://support.apple.com/en-us/HT208141","name":"https://support.apple.com/en-us/HT208141"},{"refsource":"MISC","url":"https://support.apple.com/en-us/HT208142","name":"https://support.apple.com/en-us/HT208142"}]},"description":{"description_data":[{"lang":"eng","value":"A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution."}]}},"nvd":{"publishedDate":"2021-12-23 20:15:00","lastModifiedDate":"2022-01-05 20:04:00","problem_types":["CWE-476"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":6.8},"severity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*","versionEndExcluding":"10.13","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apple:itunes:*:*:*:*:*:windows:*:*","versionEndExcluding":"12.7","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*","versionEndExcluding":"11","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:o:apple:watchos:*:*:*:*:*:*:*:*","versionEndExcluding":"4","cpe_name":[]},{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:apple:icloud:*:*:*:*:*:windows:*:*","versionEndIncluding":"7.0","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2018","CveId":"4302","Ordinal":"120216","Title":"CVE-2018-4302","CVE":"CVE-2018-4302","Year":"2018"},"notes":[{"CveYear":"2018","CveId":"4302","Ordinal":"1","NoteData":"A null pointer dereference was addressed with improved validation. This issue is fixed in macOS High Sierra 10.13, iCloud for Windows 7.0, watchOS 4, iOS 11, iTunes 12.7 for Windows. Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution.","Type":"Description","Title":null},{"CveYear":"2018","CveId":"4302","Ordinal":"2","NoteData":"2021-12-23","Type":"Other","Title":"Published"},{"CveYear":"2018","CveId":"4302","Ordinal":"3","NoteData":"2021-12-23","Type":"Other","Title":"Modified"}]}}}