Out-of-bounds write in Google Android - CVE-2017-0663

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU38871

Out-of-bounds write in Google Android - CVE-2017-0663

Published: June 14, 2017 / Updated: August 8, 2020


Vulnerability identifier: #VU38871
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-0663
CWE-ID: CWE-787
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.


Affected software

Google Android
Gentoo Linux
App Connect Enterprise Certified Container

How to mitigate CVE-2017-0663

Install update from vendor's website.

App Connect Enterprise Certified Container - addressed in versions 5.0.1, 6.1.0

External References

Related Security Bulletins