9.8crit
CVE-2017-13281
In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check.
Published 8 y ago · modified 4 mo ago · JSON
CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
1.8%
percentile 78%
Public exploits
0
none known
Summary
In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-71603262.
Exploit prediction (EPSS)
1.76% probability of exploitation in the next 30 days, higher than 78% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 9.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Google Inc. Android
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- source.android.com /security/bulletin/2018-04-01 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-13281
- NVD: CVE-2017-13281
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.