7.8high
CVE-2017-0477
A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code within th…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 61%
Public exploits
0
none known
Summary
A remote code execution vulnerability in libgdx could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 7.1.1. Android ID: A-33621647.
Exploit prediction (EPSS)
0.95% probability of exploitation in the next 30 days, higher than 61% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Google Inc. Android
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securityfocus.com /bid/96760 · vdb-entry, x_refsource_BID, x_transferred
- source.android.com /security/bulletin/2017-03-01 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1037968 · vdb-entry, x_refsource_SECTRACK, x_transferred
- source.android.com /security/bulletin/2017-03-01.html · Vendor Advisory
Sources
- CVE List: CVE-2017-0477
- NVD: CVE-2017-0477
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.