PT-2018-3986 · Google+4 · Android+4
Publicado
2018-04-04
·
Atualizado
2020-11-04
·
CVE-2020-0182
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
Name of the Vulnerable Software and Affected Versions
Android versions Android-10
Description
The issue is related to a missing bounds check in the
exif entry get value function of the exif-entry.c component, which can lead to an out of bounds read. This could result in local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation. The vulnerability may allow a remote attacker to access confidential data and cause a denial of service.Recommendations
For Android version Android-10, consider applying a patch or fix that addresses the missing bounds check in the
exif entry get value function to prevent out of bounds reads and potential information disclosure. As a temporary workaround, consider restricting access to EXIF file parsing functionality until a patch is available.Correção
Out of bounds Read
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Android
Centos
Linuxmint
Red Hat
Ubuntu