PT-2021-4179 · Google · Android

Published 2021-09-01 · Updated 2022-07-12 · CVE-2021-0687

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions 8.1 through 11

Description The issue is related to improper input validation in the ellipsize function of Layout.java, which could lead to a local denial of service with no additional execution privileges needed. User interaction is required for exploitation. This could result in a permanent denial of service.

Recommendations For Android versions 8.1 through 11, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting user interaction with the vulnerable component until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

CWE-834

Related Identifiers

ASB-A-188913943

BDU:2021-04774

CVE-2021-0687

Affected Products

Android

References · 12

• https://osv.dev/vulnerability/ASB-A-188913943 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0687 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04774 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-0687 · Security Note
• https://source.android.com/security/bulletin/2021-09-01 · Vendor Advisory
• https://t.me/cvenotify/22140 · Telegram Post
• https://t.me/nekaspersky/1217 · Telegram Post
• https://t.me/cibsecurity/30056 · Telegram Post
• https://anti-malware.ru/news/2021-09-09-111332/36884 · Note
• https://t.me/true_secator/2087 · Telegram Post
• https://t.me/cvenotify/21985 · Telegram Post
• https://android.googlesource.com/platform/frameworks/base/+/ed0c637a311d98426ff29cecd96aa429b53544dc · Note