CVE-2017-0391: High severity android vulnerability

Published Jan 12, 2017

Updated

A denial of service vulnerability in decoder/ihevcddecode.c in libhevc in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1. Android ID: A-32322258.

Affected Software

5 affected components

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/external/libhevc/+/a33f6725d7e9f92330f995ce2dcf4faa33f6433f

Event History

Jan 12, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Jun 5, 2017

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-0391?

CVE-2017-0391 is rated as High due to the potential for remote denial of service.

How do I fix CVE-2017-0391?

To fix CVE-2017-0391, update your Android device to the latest available version or security patch that addresses this vulnerability.

What versions of Android are affected by CVE-2017-0391?

CVE-2017-0391 affects Android versions 6.0, 6.0.1, 7.0, and 7.1.0.

Can CVE-2017-0391 be exploited remotely?

Yes, CVE-2017-0391 can be exploited remotely using a specially crafted file.

What type of attack does CVE-2017-0391 facilitate?

CVE-2017-0391 facilitates a denial of service attack, causing devices to hang or reboot.