CVE-2013-4710: Input Validation

Published Mar 3, 2014

Updated

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

Affected Software

14 affected components

Google Android=3.0

Google Android=3.1

Google Android=3.2

Google Android=3.2.1

Google Android=3.2.2

Google Android=3.2.4

Google Android=3.2.6

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Event History

Mar 3, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·04:50 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2013-4710?

CVE-2013-4710 is considered a critical vulnerability due to the potential for remote code execution or denial of service.

How do I fix CVE-2013-4710?

To remediate CVE-2013-4710, it is recommended to upgrade to a patched version of the Android operating system, beyond 4.1.

Which devices are affected by CVE-2013-4710?

CVE-2013-4710 affects various Android devices running versions 3.0 to 4.1.x, including those from Disney Mobile, eAccess, KDDI, NTT DOCOMO, and SoftBank.

What type of attack can exploit CVE-2013-4710?

CVE-2013-4710 can be exploited via crafted web pages that allow attackers to execute arbitrary Java methods on vulnerable Android devices.

What versions of Android are vulnerable to CVE-2013-4710?

The vulnerable versions of Android for CVE-2013-4710 include 3.0 through 4.1.2.