CVE-2013-4787: Critical severity android vulnerability
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4787?
CVE-2013-4787 is considered a high severity vulnerability as it allows attackers to execute arbitrary code on affected Android devices.
How do I fix CVE-2013-4787?
To mitigate CVE-2013-4787, it is recommended to upgrade to a version of Android that is not affected, specifically beyond 4.2.
Which versions of Android are affected by CVE-2013-4787?
CVE-2013-4787 affects Android versions from 1.6 Donut to 4.2 Jelly Bean.
What type of attack does CVE-2013-4787 enable?
CVE-2013-4787 enables attackers to modify APKs in such a way that they can bypass cryptographic signature checks, potentially leading to code execution.
Is there a patch available for CVE-2013-4787?
There is no specific patch for CVE-2013-4787; updating to a newer, unaffected Android version is the recommended approach.