PT-2018-3986 · Google+4 · Android+4

Published 2018-04-04 · Updated 2020-11-04 · CVE-2020-0182

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Name of the Vulnerable Software and Affected Versions Android versions Android-10

Description The issue is related to a missing bounds check in the exif entry get value function of the exif-entry.c component, which can lead to an out of bounds read. This could result in local information disclosure without requiring additional execution privileges. User interaction is not necessary for exploitation. The vulnerability may allow a remote attacker to access confidential data and cause a denial of service.

Recommendations For Android version Android-10, consider applying a patch or fix that addresses the missing bounds check in the exif entry get value function to prevent out of bounds reads and potential information disclosure. As a temporary workaround, consider restricting access to EXIF file parsing functionality until a patch is available.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

BDU:2024-07614

CESA-2020_4040

CESA-2020_4766

CVE-2020-0182

DLA-2249-1

RHSA-2020:4040

RHSA-2020:4766

RHSA-2020_4040

RHSA-2020_4766

USN-4396-1

Affected Products

Android

Centos

Linuxmint

Red Hat

Ubuntu

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2020-0182 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-0182 · Vendor Advisory
• https://source.android.com/security/bulletin/pixel/2020-06-01 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-13114 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4396-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-0182 · Security Note
• https://ubuntu.com/security/CVE-2020-13113 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0198 · Vendor Advisory
• https://usn.ubuntu.com/4396-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-07614 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-0182 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-0093 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-0182 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-0182 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4396-1 · Vendor Advisory