CVE-2018-4182
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox...
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
- Record
CVE-2018-4182- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 7.2 High
AV:L/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE List No score
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
- Record
CVE-2018-4182- Updated
- 2026-11-02
EUVDEUVD-2018-15968 No score
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
- Record
EUVD-2018-15968- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-77qc-wcq2-m5v2
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox...
In macOS High Sierra before 10.13.5, an access issue was addressed with additional sandbox restrictions on CUPS.
- Record
GHSA-77qc-wcq2-m5v2- CVSS 3.0
- 8.2 High
CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVSUSE-SU-2018:2162-1 No score
Security update for cups
This update for cups fixes the following issues:
The following security vulnerabilities were fixed:
- CVE-2017-18248: Handle invalid characters properly in printing jobs. This fixes a problem that was causing the DBUS library to abort the calling process. (bsc#1061066 bsc#1087018)
- Fixed a local privilege escalation to root and sandbox bypasses in the scheduler
- CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend (bsc#1096405)
- CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406)
- CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling (bsc#1096407)
- CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration (bsc#1096408)
The following other issue was fixed:
- Fixed authorization check for clients (like samba) connected through the local socket when Kerberos authentication is enabled (bsc#1050082)
- Record
SUSE-SU-2018:2162-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2172-1 No score
Security update for cups
This update for cups fixes the following issues:
The following security vulnerabilities were fixed:
- Fixed a local privilege escalation to root and sandbox bypasses in the scheduler
- CVE-2018-4180: Fixed a local privilege escalation to root in dnssd backend (bsc#1096405)
- CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406)
- CVE-2018-4182: Fixed a sandbox bypass due to insecure error handling (bsc#1096407)
- CVE-2018-4183: Fixed a sandbox bypass due to profile misconfiguration (bsc#1096408)
- Record
SUSE-SU-2018:2172-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:2233-1 No score
Security update for cups
This update for cups fixes the following issues:
Security issues fixed:
- CVE-2018-4180: Fix local privilege escalation to root in dnssd backend (bsc#1096405).
- CVE-2018-4181: Limited local file reads as root via cupsd.conf include directive (bsc#1096406).
- CVE-2018-4182: Fix cups-exec sandbox bypass due to insecure error handling (bsc#1096407).
- CVE-2018-4183: Fix cups-exec sandbox bypass due to profile misconfiguration (bsc#1096408).
- Record
SUSE-SU-2018:2233-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cupsSUSE:Linux Enterprise Desktop 12 SP3 |
before 1.7.5-20.14.1 | 1.7.5-20.14.1 |
cupsSUSE:Linux Enterprise Software Development Kit 12 SP3 |
before 1.7.5-20.14.1 | 1.7.5-20.14.1 |
cupsSUSE:Linux Enterprise Server 12 SP3 |
before 1.7.5-20.14.1 | 1.7.5-20.14.1 |
cupsSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.7.5-20.14.1 | 1.7.5-20.14.1 |
cupsSUSE:Linux Enterprise Module for Basesystem 15 |
before 2.2.7-3.3.1 | 2.2.7-3.3.1 |
cupsSUSE:Linux Enterprise Module for Desktop Applications 15 |
before 2.2.7-3.3.1 | 2.2.7-3.3.1 |
cupsSUSE:Linux Enterprise Module for Development Tools 15 |
before 2.2.7-3.3.1 | 2.2.7-3.3.1 |
cupsSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 1.3.9-8.46.56.3.1 | 1.3.9-8.46.56.3.1 |
cupsSUSE:Linux Enterprise Server 11 SP4 |
before 1.3.9-8.46.56.3.1 | 1.3.9-8.46.56.3.1 |
cupsSUSE:Linux Enterprise Server for SAP Applications 11 SP4 |
before 1.3.9-8.46.56.3.1 | 1.3.9-8.46.56.3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-4182 is a high vulnerability (CVSS 8.2) in Apple Mac Os X, published August 1, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.38%, the 31st percentile. Fixed in cups 1.7.5-20.14.1.
References
debian.org/security/2018/dsa-4243
support.apple.com/HT208849
security.gentoo.org/glsa/201908-08
nvd.nist.gov/vuln/detail/CVE-2018-4182
access.redhat.com/security/cve/cve-2018-4182
github.com/advisories/GHSA-77qc-wcq2-m5v2
Show 15 moreShow less
suse.com/support/update/announcement/2018/suse-su-20182162-1
bugzilla.suse.com/1050082