PT-2018-1214 · Google · Android

Published 2018-04-02 · Updated 2018-05-02 · CVE-2016-10476

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 2018-04-05

Description The issue is caused by missing array index checks on app index in the qcril uim clear encrypted pin function, resulting in accessing addresses outside the bounds of the buffer when the app index is too large. This can lead to a buffer overflow. The vulnerability may allow a remote attacker to cause a buffer overflow.

Recommendations For Android versions prior to 2018-04-05, consider applying the April 2018 security patch level to resolve the issue. As a temporary workaround, restrict access to the qcril uim clear encrypted pin function to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2018-00682

CVE-2016-10476

Affected Products

Android

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2016-10476 · Security Note
• https://bdu.fstec.ru/vul/2018-00682 · Security Note
• https://source.android.com/security/bulletin/2018-04-01 · Vendor Advisory
• http://securityfocus.com/bid/103671 · Note