PT-2017-1426 · Google · Android

Stéphane Marques · Publicado 2017-03-08 · Atualizado 2017-07-17 · CVE-2017-0494

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 7.1.1

Description The issue is related to an information disclosure problem in the AOSP Messaging component of the Android operating system, which is caused by a lack of protection for internal data. This could allow a remote attacker, using a specially crafted file, to access data beyond their permission levels. The problem is considered moderate because it could be used to access sensitive data without proper authorization.

Recommendations For Android versions 6.0 through 7.1.1, update to a version that includes the fix for this issue to prevent potential data access beyond permission levels.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2017-00566

CVE-2017-0494

Produtos afetados

Android

Referências · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-0494 · Nota de Segurança
• https://source.android.com/security/bulletin/2017-03-01 · Nota
• https://ubuntu.com/security/CVE-2017-0494 · Aviso do Fabricante
• https://source.android.com/security/bulletin/2017-03-01.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0494 · Aviso do Fabricante
• http://securityfocus.com/bid/96789 · Nota
• http://securitytracker.com/id/1037968 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0494 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2017-00566 · Nota de Segurança
• https://cve.org/CVERecord?id=CVE-2017-0494 · Nota de Segurança