TI-2018-12987 Aliases CVE-2018-18369 GHSA-cqr9-3mc7-gvpr

Untrusted search path in Symantec Norton Security

LOW 39CWE-426Published 2019-04-25 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-426.

Summary

Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead.

Why it matters now

EPSS 0.02381 83rd percentileScored 2026-11-07

Fix Fixed Norton Security (Symantec Corporation): 22.16.3

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Symantec	Norton Security	before 22.16.3	22.16.3	Patch available	CNA
Symantec	Symantec Endpoint Protection Small Business Edition	Prior to Cloud Agent 3.00.31.2817; NIS-22.15.2.22; SEP-12.1.7484.7002	—	No fix listed	CNA

Norton Security VendorSymantec Affected before 22.16.3 Fixed in 22.16.3 Patch available CNA
Symantec Endpoint Protection Small Business Edition VendorSymantec Affected Prior to Cloud Agent 3.00.31.2817; NIS-22.15.2.22; SEP-12.1.7484.7002 Fixed in — No fix listed CNA

CPE configurations NVD · 5

CPE	Versions	Role	Vendor
cpe:2.3:a:symantec:endpoint_protection:nis-22.15.2.22::::small_business:::	nis-22.15.2.22	Vulnerable	Symantec
cpe:2.3:a:symantec:endpoint_protection:sep-12.1.7484.7002::::small_business:::	sep-12.1.7484.7002	Vulnerable	Symantec
cpe:2.3:a:symantec:endpoint_protection_cloud::::::::	before 22.16.3	Vulnerable	Symantec
cpe:2.3:a:symantec:endpoint_protection_cloud_agent:::::small_business:::*	before 3.00.31.2817	Vulnerable	Symantec
cpe:2.3:a:symantec:norton_security::::::windows::*	before 22.16.3	Vulnerable	Symantec

cpe:2.3:a:symantec:endpoint_protection:nis-22.15.2.22:*:*:*:small_business:*:*:* Versions nis-22.15.2.22 Vulnerable ·Symantec
cpe:2.3:a:symantec:endpoint_protection:sep-12.1.7484.7002:*:*:*:small_business:*:*:* Versions sep-12.1.7484.7002 Vulnerable ·Symantec
cpe:2.3:a:symantec:endpoint_protection_cloud:*:*:*:*:*:*:*:* Versions before 22.16.3 Vulnerable ·Symantec
cpe:2.3:a:symantec:endpoint_protection_cloud_agent:*:*:*:*:small_business:*:*:* Versions before 3.00.31.2817 Vulnerable ·Symantec
cpe:2.3:a:symantec:norton_security:*:*:*:*:*:windows:*:* Versions before 22.16.3 Vulnerable ·Symantec

Remediation

Fix · CNA Norton Security (Symantec Corporation) Fixed in 22.16.3

Timeline

2026-10-02 Threatist record created from CVE-2018-18369
2026-10-03 Alias added: GHSA-cqr9-3mc7-gvpr

References

Advisory 1

https://support.symantec.com/en_US/article.SYMSA1479.html

TI-2009-01353 The Intel LANDesk Common Base Agent (CBA) in Symantec Alert Management System 2 (AMS2)… CVSS 2.0HIGH 10.0
TI-2009-01354 Multiple stack-based buffer overflows in IAO.EXE in the Intel Alert Originator Service in… CVSS 2.0HIGH 9.3
TI-2016-02020 The AntiVirus Decomposer engine in Symantec Advanced Threat Protection (ATP); Symantec… CVSS 3.0HIGH 7.8
TI-2012-01284 The ZIP file parser in AhnLab V3 Internet Security 2011.01.18.00, AVG Anti-Virus… CVSS 2.0MEDIUM 4.3
TI-2012-01283 The Gzip file parser in AVG Anti-Virus 10.0.0.1190, Bitdefender 7.2, Command Antivirus… CVSS 2.0MEDIUM 4.3
TI-2012-01281 The TAR file parser in AhnLab V3 Internet Security 2011.01.18.00, Avira AntiVir… CVSS 2.0MEDIUM 4.3

See all 70 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences