CVE-2017-0640: Medium severity Google Android vulnerability
A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High severity due to the possibility of remote denial of service. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33129467.
Affected Software
Event History
Frequently Asked Questions
What must an attacker do to trigger the denial of service?
The attacker must cause the device to process a specially crafted file. The CVSS vector indicates user interaction is required, so exploitation depends on a user opening or otherwise handling that file.
Is this exploitable without prior access to the device?
The CVSS vector lists no privileges required, meaning the attacker does not need an existing account or permissions on the target device. However, exploitation is local in the CVSS vector and requires user interaction with the crafted file.
What is the practical impact if exploitation succeeds?
Successful exploitation can cause the device to hang or reboot. The reported CVSS impact is limited to availability; no confidentiality or integrity impact is specified.