CVE-2014-7911: High severity Google Android vulnerability
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to systemservice, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7911?
CVE-2014-7911 has a high severity rating due to its potential to allow remote code execution.
How do I fix CVE-2014-7911?
To fix CVE-2014-7911, ensure that your Android device is updated to version 5.0.0 or greater.
What systems are affected by CVE-2014-7911?
CVE-2014-7911 affects Android versions prior to 5.0.0, including all versions from 1.0 up to 4.4.4.
What type of vulnerability is CVE-2014-7911?
CVE-2014-7911 is a deserialization vulnerability in the java.io.ObjectInputStream implementation.
Can CVE-2014-7911 be exploited remotely?
Yes, CVE-2014-7911 can be exploited remotely by attackers using specially crafted data.