PT-2021-5450 · Google · Android

Published 2021-09-15 · Updated 2021-12-17 · CVE-2021-0967

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android versions Android-9 through Android-12

Description The issue is related to a missing bounds check in the vorbis book decodev set function of the Media Framework component, which could lead to an out of bounds write. This might result in remote information disclosure, and user interaction is required for exploitation. The vulnerability could potentially allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Android versions Android-9 through Android-12, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

ASB-A-199065614

BDU:2021-06294

CVE-2021-0967

Affected Products

Android

References · 8

• https://osv.dev/vulnerability/ASB-A-199065614 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-0967 · Vendor Advisory
• https://source.android.com/security/bulletin/2021-12-01 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-0967 · Security Note
• https://bdu.fstec.ru/vul/2021-06294 · Security Note
• https://t.me/true_secator/2423 · Telegram Post
• https://cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-remote-code-execution_2021-155 · Note
• https://anti-malware.ru/news/2021-12-09-111332/37704 · Note