CVEvulnerability

CVE-2018-18366

6.5 MEDIUM Published 2019-04-25 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-04-25
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
6.5 MEDIUM — CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.1 LOW — AV:L/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-908

Description

Symantec Norton Security prior to 22.16.3, SEP (Windows client) prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type of issue where a specially crafted IRP request can cause the driver to return uninitialized memory.

Affected configurations

• symantec endpoint protection 11.0 • symantec endpoint protection 12.1 • symantec endpoint protection 14 • symantec endpoint protection 14.0.0 • symantec endpoint protection 14.0.1 • symantec endpoint protection 14.2 • symantec endpoint protection nis-22.15.2.22 • symantec endpoint protection sep-12.1.7484.7002 • symantec endpoint protection cloud (< 22.16.3) • symantec endpoint protection cloud agent (< 3.00.31.2817) • symantec norton security (< 22.16.3)

Related

Weakness · CWE (1)

  • CWE-908 Use of Uninitialized Resource weakness

References