PT-2018-17435 · Google+1 · Android+1

Published 2018-05-10 · Updated 2018-06-14 · CVE-2018-6246

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android versions prior to the 2018-05-05 security patch level

Description The issue concerns a buffer overflow in the NVIDIA Widevine Trustlet, specifically in the Widevine TA, where the software reads data past the end or before the beginning of the intended buffer. This may lead to information disclosure. The issue is rated as moderate.

Recommendations For Android versions prior to the 2018-05-05 security patch level, update to a version that includes the 2018-05-05 security patch level or later to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-6246

Affected Products

Android

Nvidia Widevine Trustlet

References · 3

• https://osv.dev/vulnerability/CVE-2018-6246 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2018-05-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6246 · Security Note