PT-2017-1426 · Google · Android

Stéphane Marques · Published 2017-03-08 · Updated 2017-07-17 · CVE-2017-0494

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions 6.0 through 7.1.1

Description The issue is related to an information disclosure problem in the AOSP Messaging component of the Android operating system, which is caused by a lack of protection for internal data. This could allow a remote attacker, using a specially crafted file, to access data beyond their permission levels. The problem is considered moderate because it could be used to access sensitive data without proper authorization.

Recommendations For Android versions 6.0 through 7.1.1, update to a version that includes the fix for this issue to prevent potential data access beyond permission levels.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2017-00566

CVE-2017-0494

Affected Products

Android

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2017-0494 · Security Note
• https://ubuntu.com/security/CVE-2017-0494 · Vendor Advisory
• https://source.android.com/security/bulletin/2017-03-01.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0494 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-0494 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00566 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-0494 · Security Note
• https://source.android.com/security/bulletin/2017-03-01 · Note
• http://securityfocus.com/bid/96789 · Note
• http://securitytracker.com/id/1037968 · Note