CVE-2018-9362 — Improper Input Validation in INC Android

CWE-20 — Improper Input Validation4 documents4 sources

Severity

7.5HIGHNVD

EPSS

0.6%

top 29.93%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google INC Android Google Android

Timeline

PublishedNov 6

Latest updateMay 14

Description

In processMessagePart of InboundSmsHandler.java, there is a possible remote denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-72298611.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDgoogle/android7 versions+6

▶CVEListV5google_inc/androidAndroid-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

GHSA

GHSA-2rph-qjxq-ggpw: In processMessagePart of InboundSmsHandler↗2022-05-14

▶

CVEList

CVE-2018-9362: In processMessagePart of InboundSmsHandler↗2018-11-06

▶

📋Vendor Advisories

Android

CVE-2018-9362: Android Security Bulletin 2018-06-01 CVE: CVE-2018-9362 Severity: HIGH Type: DoS Affected AOSP versions: 6↗2018-06-01

▶