PT-2018-5318 · Mozilla+2 · Firefox Os+2

Published 2018-03-30 · Updated 2018-04-25 · CVE-2017-11087

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to the libOmxVenc component, which copies the output buffer to an application with the filled length, larger than the output buffer's actual size. This leads to an information disclosure problem within the context of mediaserver.

Recommendations For Android for MSM, update to a version that addresses the information disclosure issue in libOmxVenc. For Firefox OS for MSM, update to a version that addresses the information disclosure issue in libOmxVenc. For QRD Android, update to a version that addresses the information disclosure issue in libOmxVenc.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-11087

Affected Products

Android

Firefox Os

Qrd Android

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2017-11087 · Security Note
• https://source.android.com/security/bulletin/pixel/2018-02-01 · Vendor Advisory
• http://securityfocus.com/bid/103669 · Note