CVE-2017-13228
published 2018-02-12CVE-2017-13228: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to…
PriorityP348high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
1.47%
70.8th percentile
In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| android | — | — | |
| google_inc | android | — | — |
| google_inc | android | — | — |
| google_inc | android | — | — |
| google_inc | android | — | — |
| google_inc | android | — | — |
| google_inc | android | — | — |
| google_inc | android | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-fxfr-mrqw-xqqw: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character
ghsa_unreviewed·2022-05-14
CVE-2017-13228 [HIGH] CWE-787 GHSA-fxfr-mrqw-xqqw: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character
In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425.
Android
CVE-2017-13228: Android Security Bulletin 2018-02-01
CVE: CVE-2017-13228
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 6
vendor_android·2018-02-01·CVSS 8.8
CVE-2017-13228 [HIGH] CVE-2017-13228: Android Security Bulletin 2018-02-01
CVE: CVE-2017-13228
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 6
Android Security Bulletin 2018-02-01
CVE: CVE-2017-13228
Severity: CRITICAL
Type: RCE
Affected AOSP versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
References: A-69478425
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2018-02-12
Published