CVE-2018-5383

CVE.org · Published

Record status: Published
Identifier year (not publication year): 2018
Source publication: Aug 7, 2018
Source updated: Sep 16, 2024
Imported by cveboard: Oct 24, 2026
Source snapshot: cve_2026-10-24_midnight_baseline · Oct 24, 2026

CNA source text (English)

Bluetooth implementations may not sufficiently validate elliptic curve parameters during Diffie-Hellman key exchange

Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

Scoped product and version facts

Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.

Exploitation unknown; this catalogue does not assess exploitation.

macOS

Vendor: Apple
Product: macOS
Platforms: Unknown
Default status: Unknown

macOS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
10.13 High Sierra	`affected`	custom	10.13.6	Unavailable	None listed

iOS

Vendor: Apple
Product: iOS
Platforms: Unknown
Default status: Unknown

iOS · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
11	`affected`	custom	11.4	Unavailable	None listed

Android

Vendor: Android Open Source Project
Product: Android
Platforms: Unknown
Default status: Unknown

Android · Scoped product and version facts
Version (version)	Status (status)	Version scheme (versionType)	Exclusive end (lessThan)	Inclusive end (lessThanOrEqual)	Status changes (at → status)
unspecified	`affected`	custom	2018-06-05 patch level	Unavailable	None listed