High severity7.8NVD Advisory· Published Jun 13, 2018· Updated Jun 17, 2026
CVE-2018-10406
CVE-2018-10406
Description
An issue was discovered in Yelp OSXCollector. A maliciously crafted Universal/fat binary can evade third-party code signing checks. By not completing full inspection of the Universal/fat binary, the user of the third-party tool will believe that the code is signed by Apple, but the malicious unsigned code will execute.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
osxcollectorPyPI | < 1.10 | 1.10 |
Affected products
1Patches
Vulnerability mechanics
References
7- www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checks/nvdExploitThird Party Advisory
- github.com/advisories/GHSA-g3cc-pvjj-9xq9ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2018-10406ghsaADVISORY
- github.com/Yelp/osxcollector/pull/160ghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/osxcollector/PYSEC-2018-95.yamlghsaWEB
- thehackernews.com/2018/06/apple-mac-code-signing.htmlghsaWEB
- www.okta.com/security-blog/2018/06/issues-around-third-party-apple-code-signing-checksghsaWEB
News mentions
0No linked articles in our index yet.