An issue was discovered in certain Apple products. iOS before 11.2.6 is affected. macOS before 10.13.3 Supplemental Update is affected. tvOS before 11.2.6 is affected. watchOS before 4.2.3 is affected. The issue involves the "CoreText" component. It allows remote attackers to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a crafted string containing a certain Telugu character.

The version of Apple iOS running on the mobile device is prior to 11.2.6. It is, therefore, affected by a memory corruption vulnerability as referenced in the HT208534 advisory.

The remote host is running a version of macOS 10.13.3 that is missing the macOS 10.13.3 Supplemental Update.  This update fixes an input- validation flaw, which allows an attacker to cause memory corruption leading to application crashes and potentially to arbitrary code execution.

According to its banner, the version of Apple TV on the remote device is prior to 11.2.6. It is, therefore, affected by a memory corruption vulnerability as described in the HT208536 security advisory.

Note that only 4th and 5th generation models are affected by these vulnerabilities.

ID	Name	Product	Family	Severity
700547	Apple iOS < 11.2.6 Telugu Character Handling Remote Memory Corruption Vulnerability (APPLE-SA-2018-02-19-1)	Nessus Network Monitor	Mobile Devices	high
107071	macOS 10.13.3 Supplemental Update	Nessus	MacOS X Local Security Checks	critical
106974	Apple TV < 11.2.6 Telugu Character Handling Remote Memory Corruption Vulnerability	Nessus	Misc.	critical
106946	Apple iOS < 11.2.6 Telugu Character Handling Remote Memory Corruption Vulnerability	Nessus	Mobile Devices	critical

Detections

Analytics

CVE-2018-4124

critical

Tenable Plugins

high

critical

critical

critical