PT-2018-5309 · Mozilla+2 · Firefox Os+2

Published 2018-01-10 · Updated 2019-10-03 · CVE-2017-11003

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue occurs when updating a firmware image, where data is read from flash into RAM without verifying that the data fits within the allotted RAM size.

Recommendations For Android for MSM, ensure proper validation of data size before transferring it to RAM to prevent potential issues. For Firefox OS for MSM, implement checks to verify that firmware image data does not exceed the allocated RAM size during updates. For QRD Android, modify the firmware update process to include validation of data size against available RAM to mitigate potential problems. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2017-11003

Affected Products

Android

Firefox Os

Qrd Android

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2017-11003 · Security Note
• https://source.android.com/security/bulletin/pixel/2018-01-01 · Vendor Advisory