TI-2008-03715 Aliases CVE-2008-3876 GHSA-gq2r-cfxv-jhvj

Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to…

LOW 11CWE-264Published 2008-09-02 · Updated 2024-08-07

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Medium
Impact type: Security bypass
Confidentiality · integrity · availability: Partial · None · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

Apple iPhone 2.0.2, in some configurations, allows physically proximate attackers to bypass intended access restrictions, and obtain sensitive information or make arbitrary use of the device, via an Emergency Call tap and a Home double-tap, followed by a tap of any contact's blue arrow.

Why it matters now

EPSS 0.00457 39th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:apple:iphone:2.0.2:::::::*	2.0.2	Vulnerable	Apple

cpe:2.3:h:apple:iphone:2.0.2:*:*:*:*:*:*:* Versions 2.0.2 Vulnerable ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-3876
2026-10-03 Alias added: GHSA-gq2r-cfxv-jhvj

References

Exploit 1

http://forums.macrumors.com/showthread.php?t=551617

Other 1

http://forums.macrumors.com/showpost.php?p=6121914&postcount=118

TI-2008-03478 Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone… CVSS 2.0HIGH 9.3
TI-2007-03642 Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to… CVSS 2.0HIGH 7.5
TI-2008-03789 Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function… CVSS 2.0MEDIUM 5.0
TI-2022-06859 Apple iOS and iPadOS: Processing maliciously crafted web content may prevent Content… CVSS 3.1MEDIUM 6.5
TI-2007-03644 Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user… CVSS 2.0MEDIUM 4.3
TI-2007-03643 Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server… CVSS 2.0MEDIUM 4.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences