CVE-2018-5383

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Link	Resource
https://www.kb.cert.org/vuls/id/304725	Third Party Advisory US Government Resource
https://www.bluetooth.com/news/unknown/2018/07/bluetooth-sig-security-update	Vendor Advisory
http://www.cs.technion.ac.il/~biham/BT/	Mitigation Third Party Advisory
http://www.securitytracker.com/id/1041432	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/104879	Third Party Advisory VDB Entry
https://lists.debian.org/debian-lts-announce/2019/04/msg00005.html
https://access.redhat.com/errata/RHSA-2019:2169
https://usn.ubuntu.com/4094-1/
https://usn.ubuntu.com/4095-2/
https://usn.ubuntu.com/4095-1/
https://usn.ubuntu.com/4118-1/
https://usn.ubuntu.com/4351-1/

Configuration 1

cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:* cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* cpe:2.3:o:apple:iphone_os:*:*:*:*:*:*:*:*

---

Published : 2018-08-07 09:29

Updated : 2019-10-03 12:03

---

NVD link : CVE-2018-5383

Mitre link : CVE-2018-5383

No products.

CWE-347

Improper Verification of Cryptographic Signature