PT-2017-3657 · Google · Android

Publicado 2017-12-19 · Atualizado 2019-10-03 · CVE-2018-3594

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Android versions prior to security patch level 2018-04-05

Description: A buffer over-read can occur when parsing a private frame in an ID3 tag, potentially allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information. This issue is related to the Qualcomm Video Services component in the Android operating system and involves an out-of-bounds operation in memory when processing ID3 metadata.

Recommendations: For Android versions prior to security patch level 2018-04-05, update to a version with a security patch level of 2018-04-05 or later to resolve the issue.

Correção

Buffer Overflow

Out of bounds Read

Enumeração de Fraquezas

CWE-119

CWE-125

Identificadores relacionados

BDU:2018-00846

CVE-2018-3594

Produtos afetados

Android

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2018-3594 · Nota de Segurança
• http://securityfocus.com/bid/103671 · Nota
• https://bdu.fstec.ru/vul/2018-00846 · Nota de Segurança
• https://source.android.com/security/bulletin/2018-04-01 · Aviso do Fabricante