CVE-2018-9522 — Out-of-bounds Write in INC Android

CWE-787 — Out-of-bounds Write4 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 95.37%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google INC AndroidGoogle Android
Timeline
PublishedNov 14
Latest updateMay 14

Description

In the serialization functions of StatsLogEventWrapper.java, there is a possible out-of-bounds write due to unnecessary functionality which may be abused. This could lead to local escalation of privilege in the system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112550251

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5google_inc/androidAndroid-9

Patches

Patch: source.android.com ↗Patch: source.android.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-9p67-cmxj-h92h: In the serialization functions of StatsLogEventWrapper↗2022-05-14
▶
CVEList
CVE-2018-9522: In the serialization functions of StatsLogEventWrapper↗2018-11-14
▶

📋Vendor Advisories

1
Android
CVE-2018-9522: Android Security Bulletin 2018-11-01 CVE: CVE-2018-9522 Severity: HIGH Type: EoP Affected AOSP versions: 9 References: A-112550251↗2018-11-01
▶
CVE-2018-9522 — Out-of-bounds Write in INC Android | cvebase