PT-2017-1080 · Google+1 · Android+1

V.E.O + 1 · Published 2017-01-12 · Updated 2019-10-03 · CVE-2017-0381

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1

Description An information disclosure issue in the libopus Mediaserver could allow a local malicious application to access data outside of its permission levels. This could be used to access sensitive data without permission. The issue is caused by a buffer overflow in the silk/NLSF stabilize.c function.

Recommendations For versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Integer Overflow

Weakness Enumeration

CWE-119

CWE-190

Related Identifiers

BDU:2017-00172

CVE-2017-0381

DLA-793-1

MGASA-2017-0029

OPENSUSE-SU-2017_0510-1

OPENSUSE-SU-2024:11132-1

SUSE-SU-2017:0436-1

SUSE-SU-2017_0436-1

Affected Products

Android

Suse

References · 25

• https://bdu.fstec.ru/vul/2017-00172 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0381 · Security Note
• https://source.android.com/security/bulletin/2017-01-01.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2017-0029.html · Security Note
• https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7 · Patch
• https://ubuntu.com/security/CVE-2017-0381 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-0381 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2017:0436-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-0381 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2017-0381 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0029 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0381 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0381 · Vendor Advisory
• https://security.gentoo.org/glsa/201702-21 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/ZKHZKWBC6F5SBYVTHQOQ5ZQURSZSNQ36 · Vendor Advisory