CVE-2017-0393: High severity android vulnerability

Published Jan 3, 2017

Updated

A denial of service vulnerability in libvpx in Mediaserver could enable a remote attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-30436808.

Affected Software

28 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=4.4.4

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.0

Google Android

Remediation

Patch Available

https://android.googlesource.com/platform/external/libvpx/+/6886e8e0a9db2dbad723dc37a548233e004b33bc

Event History

Jan 3, 2017

CVE Published

via Android·12:00 AM

Jan 12, 2017

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

DescriptionWeakness

Data Sourced

via NVD·08:59 PM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of CVE-2017-0393?

CVE-2017-0393 is rated as High due to the potential for remote denial of service.

How do I fix CVE-2017-0393?

To mitigate CVE-2017-0393, upgrade your Android version to a patch that addresses this vulnerability.

What products are affected by CVE-2017-0393?

CVE-2017-0393 affects multiple versions of Android including 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0.

What type of attack can exploit CVE-2017-0393?

CVE-2017-0393 can be exploited by a remote attacker using a specially crafted file to cause device hang or reboot.

When was CVE-2017-0393 reported?

CVE-2017-0393 was identified in the security bulletin released on January 1, 2017.