PT-2017-1892 · Google · Android

Published 2017-04-07 · Updated 2019-10-03 · CVE-2017-0546

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1

Description The issue is related to an elevation of privilege vulnerability in the SurfaceFlinger component of the Android operating system, which could enable a local malicious application to execute arbitrary code within the context of a privileged process. This vulnerability is rated as High because it could be used to gain local access to elevated capabilities. The vulnerability is also associated with insufficient access control, which could allow a remote attacker to execute arbitrary code.

Recommendations For versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

NULL Pointer Dereference

Weakness Enumeration

CWE-264

CWE-476

Related Identifiers

BDU:2017-01052

CVE-2017-0546

Affected Products

Android

References · 6

• https://osv.dev/vulnerability/CVE-2017-0546 · Vendor Advisory
• https://source.android.com/security/bulletin/2017-04-01 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-01052 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0546 · Security Note
• http://securitytracker.com/id/1038201 · Note
• http://securityfocus.com/bid/97341 · Note