Google Inc Android vulnerabilities

CVE-2017-0539 [HIGH] CWE-119 CVE-2017-0539: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a spe A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1,

CVE-2017-0542 [HIGH] CWE-119 CVE-2017-0542: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a spec A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0

CVE-2017-0538 [HIGH] CWE-119 CVE-2017-0538: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a spec A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0

CVE-2017-0591 [HIGH] CWE-119 CVE-2017-0591: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a spec A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0

CVE-2017-0590 [HIGH] CWE-119 CVE-2017-0590: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a spe A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1,

CVE-2017-0587 [HIGH] CWE-119 CVE-2017-0587: A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a sp A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7

CVE-2017-0592 [HIGH] CWE-119 CVE-2017-0592: A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could en A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Andro

CVE-2017-0589 [HIGH] CWE-119 CVE-2017-0589: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a spe A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1,

CVE-2017-0588 [HIGH] CWE-119 CVE-2017-0588: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable a A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Ve

CVE-2018-9491 [HIGH] CWE-190 CVE-2018-9491: In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an In AMediaCodecCryptoInfo_new of NdkMediaCodec.cpp, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution in external apps with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Androi

CVE-2018-9473 [HIGH] CWE-190 CVE-2018-9473: In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due t In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android ID: A-65484460

CVE-2018-9490 [HIGH] CWE-704 CVE-2018-9490: In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type co In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0

CVE-2018-9536 [HIGH] CWE-787 CVE-2018-9536: In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds che In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112662184

CVE-2017-13197 [HIGH] CWE-119 CVE-2017-13197: In the ihevcd_parse_slice.c function, slave threads are not joined if there is an error. This could In the ihevcd_parse_slice.c function, slave threads are not joined if there is an error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64784973.

CVE-2017-13211 [HIGH] CWE-400 CVE-2017-13211: In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated BLE scan results are received. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.

CVE-2018-9550 [HIGH] CWE-787 CVE-2018-9550: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing boun In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112660981.

CVE-2018-9527 [HIGH] CWE-787 CVE-2018-9527: In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing boun In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android

CVE-2018-9549 [HIGH] CWE-787 CVE-2018-9549: In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-11

CVE-2017-13191 [HIGH] CWE-835 CVE-2017-13191: In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete fra In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete frame error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0,

CVE-2017-13278 [HIGH] CWE-416 CVE-2017-13278: In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. In MediaPlayerService::Client::notify of MediaPlayerService.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70546581.