CVE-2018-5383

MediumCVSS 6.8/10Last modified Jun 17, 2026

Description

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-325CWE-347

Affected software

VendorProductVersions
ApplemacOS>= 10.13 High Sierra, < 10.13.6
AppleiOS>= 11, < 11.4
Android Open Source ProjectAndroid>= unspecified, < 2018-06-05 patch level

References

Timeline

Published
Aug 7, 2018
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-53849.8Navarino Infinity web interface up to version 2.2 exposes an unauthenticated script that is prone to blind sql injection. If successfully exCVE-2018-53858.8Navarino Infinity is prone to session fixation attacks. The server accepts the session ID as a GET parameter which can lead to bypassing theCVE-2018-53867.5Some Navarino Infinity functions, up to version 2.2, placed in the URL can bypass any authentication mechanism leading to an information leaCVE-2018-53877.5Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be aCVE-2018-53886.5In stroke_socket.c in strongSwan before 5.6.3, a missing packet length check could allow a buffer underflow, which may lead to resource exhaCVE-2018-53895.9The Internet Key Exchange v1 main mode is vulnerable to offline dictionary or brute force attacks. Reusing a key pair across different versiCVE-2018-53907.5Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incomiCVE-2018-53917.5The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragmCVE-2018-53927.5mingw-w64 version 5.0.4 by default produces executables that opt in to ASLR, but are not compatible with ASLR. ASLR is an exploit mitigationCVE-2018-53939.8The TP-LINK EAP Controller is TP-LINK's software for remotely controlling wireless access point devices. It utilizes a Java remote method inCVE-2018-53999.8The Auto-Maskin DCU 210E firmware contains an undocumented Dropbear SSH server, v2015.55, configured to listen on Port 22 while the DCU is rCVE-2018-54009.1The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those
CVE-2018-5383: Medium severity, CVSS 6.8 | Vulnix