CVE-2018-18366

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
Symantec Corporation	Norton Security	Prior to 22.16.3
Symantec Corporation	SEP (Windows client)	Prior to and including 12.1 RU6 MP9; Prior to 14.2 RU1
Symantec Corporation	SEP SBE	Prior to Cloud Agent 3.00.31.2817; NIS-22.15.2.22; SEP-12.1.7484.7002
Symantec Corporation	SEP Cloud	Prior to 22.16.3

References

http://www.securityfocus.com/bid/107994Third Party Advisory, VDB Entry
https://support.symantec.com/en_US/article.SYMSA1479.htmlVendor Advisory
http://www.securityfocus.com/bid/107994Third Party Advisory, VDB Entry
https://support.symantec.com/en_US/article.SYMSA1479.htmlVendor Advisory

Timeline

Published: Apr 25, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-183677.8Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading CVE-2018-183687.8Symantec Endpoint Protection Manager (SEPM), prior to 14.2 RU1, may be susceptible to a privilege escalation vulnerability, which is a type CVE-2018-183697.8Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.CVE-2018-183706.1The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web brow CVE-2018-183716.5The ASG/ProxySG FTP proxy WebFTP mode allows intercepting FTP connections where a user accesses an FTP server via a ftp:// URL in a web brow CVE-2018-183726.1A Stored XSS vulnerability has been discovered in KAASoft Library CMS - Powerful Book Management System 2.1.1 via the /admin/book/create/ ti CVE-2018-183735.4In the Schiocco "Support Board - Chat And Help Desk" plugin 1.2.3 for WordPress, a Stored XSS vulnerability has been discovered in file uplo CVE-2018-183745.4XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.CVE-2018-183759.8goform/getProfileList in Orange AirBox Y858_FL_01.16_04 allows attackers to extract APN data (name, number, username, and password) via the CVE-2018-183767.5goform/getWlanClientInfo in Orange AirBox Y858_FL_01.16_04 allows remote attackers to discover information about currently connected devices CVE-2018-183777.5goform/setReset on Orange AirBox Y858_FL_01.16_04 devices allows attackers to reset a router to factory settings, which can be used to login CVE-2018-183796.1The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS.