PT-2018-1618 · Google · Android

Publicado 2018-06-25 · Atualizado 2018-11-20 · CVE-2018-9497

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 7.0 through 9.0

Description The issue is related to the impeg2 fmt conv yuv420p to yuv420sp uv av8 function in the Media framework component of the Android operating system. It involves an out-of-bounds write due to a missing bounds check, which could lead to remote code execution. User interaction is required for exploitation.

Recommendations For Android versions 7.0 through 9.0, consider restricting access to the impeg2 fmt conv yuv420p to yuv420sp uv av8 function until a patch is available. As a temporary workaround, disabling the impeg2 fmt conv yuv420p to yuv420sp uv av8 function may help minimize the risk of exploitation.

Correção

Buffer Overflow

Memory Corruption

Enumeração de Fraquezas

CWE-119

CWE-787

Identificadores relacionados

BDU:2018-01177

CVE-2018-9497

Produtos afetados

Android

Referências · 7

• https://source.android.com/security/bulletin/2018-10-01%2C · Nota
• https://bdu.fstec.ru/vul/2018-01177 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-9497 · Aviso do Fabricante
• https://android.googlesource.com/platform/external/libmpeg2/+/bef16671c891e16f25a7b174bc528eea109357be · Aviso do Fabricante
• http://securityfocus.com/bid/105481 · Nota
• https://source.android.com/security/bulletin/2018-10-01 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-9497 · Nota de Segurança