TI-2008-04378 Aliases CVE-2008-4593 GHSA-6gw4-928q-mg88

Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS…

LOW 8CWE-200Published 2008-10-17 · Updated 2024-08-07

Key facts

Attack vector: Local
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: Partial · None · None
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

Apple iPhone 2.1 with firmware 5F136, when Require Passcode is enabled and Show SMS Preview is disabled, allows physically proximate attackers to obtain sensitive information by performing an Emergency Call tap and then reading SMS messages on the device screen, aka Apple bug number 6267416.

Why it matters now

EPSS 0.00323 25th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:apple:iphone:2.1:::::::*	2.1	Vulnerable	Apple

cpe:2.3:h:apple:iphone:2.1:*:*:*:*:*:*:* Versions 2.1 Vulnerable ·Apple

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2008-4593
2026-10-03 Alias added: GHSA-6gw4-928q-mg88

References

Other 1

http://www.karlkraft.com/index.php/2008/10/03/yet-another-iphone-emergency-call-security-bug/

TI-2008-03478 Use-after-free vulnerability in WebKit in Apple iPod touch 1.1 through 2.0.2, and iPhone… CVSS 2.0HIGH 9.3
TI-2007-03642 Apple iPhone 1.1.1, with Bluetooth enabled, allows physically proximate attackers to… CVSS 2.0HIGH 7.5
TI-2008-03789 Off-by-one error in the _web_drawInRect:withFont:ellipsis:alignment:measureOnly function… CVSS 2.0MEDIUM 5.0
TI-2022-06859 Apple iOS and iPadOS: Processing maliciously crafted web content may prevent Content… CVSS 3.1MEDIUM 6.5
TI-2007-03644 Mail in Apple iPhone 1.1.1 allows remote user-assisted attackers to force the iPhone user… CVSS 2.0MEDIUM 4.3
TI-2007-03643 Mail in Apple iPhone 1.1.1, when using SSL, does not warn the user when the mail server… CVSS 2.0MEDIUM 4.3

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences