PT-2018-5262 · Google · Androidsvg

Prodigysml · Publicado 2018-01-03 · Atualizado 2020-01-30 · CVE-2017-1000498

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AndroidSVG version 1.2.2

Description The issue affects the SVG parsing component, making it vulnerable to XXE attacks. This can result in denial of service and possibly remote code execution.

Recommendations For AndroidSVG version 1.2.2, update to a version that fixes the XXE vulnerability in the SVG parsing component to prevent denial of service and potential remote code execution.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-1000498

GHSA-G556-X5VX-QH59

Produtos afetados

Androidsvg

Referências · 6

• https://github.com/BigBadaboom/androidsvg/issues/122 · Nota
• https://github.com/BigBadaboom/androidsvg · Nota
• https://osv.dev/vulnerability/GHSA-g556-x5vx-qh59 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-1000498 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000498 · Nota de Segurança
• https://github.com/advisories/GHSA-g556-x5vx-qh59 · Nota