PT-2018-6001 · Mozilla+1 · Firefox Os+1
Published
2018-03-16
·
Updated
2018-04-04
·
CVE-2017-15831
CVSS v2.0
4.6
Medium
| Vector | AV:L/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions:
Android for MSM versions (affected versions not specified)
Firefox OS for MSM versions (affected versions not specified)
QRD Android versions (affected versions not specified)
Description:
The issue is related to a lack of input validation in the
wma ndp end indication event handler() function, which can lead to an integer overflow. This overflow can potentially cause a heap overwrite. The problem arises from an unvalidated event info value coming from firmware.Recommendations:
For Android for MSM, ensure proper validation of the
event info value in the wma ndp end indication event handler() function to prevent integer overflow.
For Firefox OS for MSM, consider implementing input validation checks for the event info value to mitigate the risk of heap overwrite.
For QRD Android, restrict access to the wma ndp end indication event handler() function until proper input validation is implemented.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.RCE
Integer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Android
Firefox Os