PT-2017-10590 · Google+3 · Android+3

Published 2017-06-14 · Updated 2024-06-15 · CVE-2017-0663

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2

Description A remote code execution issue in libxml2 could allow an attacker to execute arbitrary code within the context of an unprivileged process by using a specially crafted file. This issue is considered High due to the possibility of remote code execution in an application that uses this library.

Recommendations For Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2017-0663

DLA-1060-1

DSA-3952-1

MGASA-2018-0048

OPENSUSE-SU-2024:11016-1

SUSE-SU-2017:1670-1

SUSE-SU-2017:1813-1

SUSE-SU-2017_1670-1

SUSE-SU-2017_1813-1

USN-3424-1

USN-3424-2

Affected Products

Android

Suse

Ubuntu

Libxml2

References · 64

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0663 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0663 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-0663 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-7375 · Vendor Advisory
• http://debian.org/security/2017/dsa-3952 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3424-2 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0048.html · Security Note
• https://ubuntu.com/security/CVE-2017-9047 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-0663 · Security Note
• https://osv.dev/vulnerability/MGASA-2018-0048 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:1670-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9050 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-3952-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9049 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9048 · Vendor Advisory