Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.9

Apple macOS Mail may expose encrypted email to eavesdroppers

CVE-2018-4111 · published 8 years ago
Summary

The Mail app in macOS versions older than 10.13.4 can be tricked into revealing the contents of S/MIME encrypted messages. An attacker who can insert themselves between the sender and recipient could read the message by sending a specially crafted HTML email that references external resources without a proper signature. Update macOS to version 10.13.4 or later, or apply any available security patches, to prevent this risk.

What to do
  • Update apple mac_os_x to version 10.13.4 or later.
Affected software
VendorProductAffected versions
apple mac_os_x < 10.13.4
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Original advisory text
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It allows man-in-the-middle attackers to read S/MIME encrypted message ...
An issue was discovered in certain Apple products. macOS before 10.13.4 is affected. The issue involves the "Mail" component. It allows man-in-the-middle attackers to read S/MIME encrypted message content by sending HTML e-mail that references remote resources but lacks a valid S/MIME signature.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.9 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-347Improper Verification of Cryptographic Signature
Timeline
Published3 Apr 2018
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-4111 · NVD
Track software like this
Free during beta