CVE-2017-13313 — Infinite Loop in Google Android

CWE-835 — Infinite LoopCWE-787 — Out-of-bounds Write3 documents3 sources
Severity
6.5MEDIUMNVD
EPSS
2.7%
top 14.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Google Android
Timeline
PublishedNov 15
Latest updateNov 16

Description

In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue.cpp, there is a possible infinite loop leading to resource exhaustion due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is needed for exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5google/android5 versions+4
▶NVDgoogle/android7 versions+6

Patches

Patch: source.android.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-h9q9-3g7p-gq9x: In ElementaryStreamQueue::dequeueAccessUnitMPEG4Video of ESQueue↗2024-11-16
▶

📋Vendor Advisories

1
Android
CVE-2017-13313: Android Security Bulletin 2018-05-01 CVE: CVE-2017-13313 Severity: HIGH Type: DoS Affected AOSP versions: 6↗2018-05-01
▶