CVE-2018-9444 — Infinite Loop in INC Android

CWE-835 — Infinite Loop4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 77.09%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google INC AndroidGoogle Android
Timeline
PublishedNov 6
Latest updateMay 13

Description

In ih264d_video_decode of ih264d_api.c there is a possible resource exhaustion due to an infinite loop. This could lead to remote temporary device denial of service (remote hang or reboot) with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android ID: A-63521984.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages2 packages

▶NVDgoogle/android5 versions+4
▶CVEListV5google_inc/androidAndroid-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2

🔴Vulnerability Details

2
GHSA
GHSA-m35f-82qc-hmw7: In ih264d_video_decode of ih264d_api↗2022-05-13
▶
CVEList
CVE-2018-9444: In ih264d_video_decode of ih264d_api↗2018-11-06
▶

📋Vendor Advisories

1
Android
CVE-2018-9444: Android Security Bulletin 2018-08-01 CVE: CVE-2018-9444 Severity: HIGH Type: DoS Affected AOSP versions: 6↗2018-08-01
▶
CVE-2018-9444 — Infinite Loop in Google INC Android | cvebase