CVE-2018-6336

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An issue was discovered in osquery. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute. This issue affects osquery prior to v3.2.7

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-254CWE-354

Affected software

VendorProductVersions
Facebookosquery3.2.7; >= unspecified, < 3.2.7

References

Timeline

Published
Dec 31, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-63377.5folly::secureRandom will re-use a buffer between parent and child processes when fork() is called. That will result in multiple forked childCVE-2018-63399.8When receiving calls using WhatsApp on Android, a stack allocation failed to properly account for the amount of data being passed in. An offCVE-2018-63408.1The Memcache::getextendedstats function can be used to trigger an out-of-bounds read. Exploiting this issue requires control over memcached CVE-2018-63416.1React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That CVE-2018-63429.8react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editoCVE-2018-63437.5Proxygen fails to validate that a secondary auth manager is set before dereferencing it. That can cause a denial of service issue when parsiCVE-2018-63447.5A heap corruption in WhatsApp can be caused by a malformed RTP packet being sent after a call is established. The vulnerability can be used CVE-2018-63459.8The function number_format is vulnerable to a heap overflow issue when its second argument ($dec_points) is excessively large. The internal CVE-2018-63467.5A potential denial-of-service issue in the Proxygen handling of invalid HTTP2 priority settings (specifically a circular dependency). This aCVE-2018-63477.5An issue in the Proxygen handling of HTTP2 parsing of headers/trailers can lead to a denial-of-service attack. This affects Proxygen prior tCVE-2018-63499.8When receiving calls using WhatsApp for Android, a missing size check when parsing a sender-provided packet allowed for a stack-based overflCVE-2018-63509.8An out-of-bounds read was possible in WhatsApp due to incorrect parsing of RTP extension headers. This issue affects WhatsApp for Android pr