PT-2018-5262 · Google · Androidsvg

Prodigysml · Published 2018-01-03 · Updated 2020-01-30 · CVE-2017-1000498

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AndroidSVG version 1.2.2

Description The issue affects the SVG parsing component, making it vulnerable to XXE attacks. This can result in denial of service and possibly remote code execution.

Recommendations For AndroidSVG version 1.2.2, update to a version that fixes the XXE vulnerability in the SVG parsing component to prevent denial of service and potential remote code execution.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-1000498

GHSA-G556-X5VX-QH59

Affected Products

Androidsvg

References · 6

• https://osv.dev/vulnerability/GHSA-g556-x5vx-qh59 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1000498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1000498 · Security Note
• https://github.com/BigBadaboom/androidsvg/issues/122 · Note
• https://github.com/BigBadaboom/androidsvg · Note
• https://github.com/advisories/GHSA-g556-x5vx-qh59 · Note