PT-2018-4518 · Google · Android

Publicado 2018-04-18 · Atualizado 2018-05-09 · CVE-2015-9185

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05

Description The issue arises in Secure DEMUX functions, such as SDMX open session, SDMX close session, and SDMX set session cfg, when parameter validation fails. In this scenario, an error code is written into a response buffer without verifying that the response buffer length (rsplen) passed from HLOS is sufficient to hold the response. This can lead to secure memory corruption if the buffer is located at the end of a non-secure page followed by a secured memory page.

Recommendations For Android versions prior to 2018-04-05, update to a version with a security patch level of 2018-04-05 or later to resolve the issue.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2015-9185

Produtos afetados

Android

Referências · 3

• https://source.android.com/security/bulletin/2018-04-01 · Aviso do Fabricante
• http://securityfocus.com/bid/103671 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-9185 · Nota de Segurança