CVE-2017-0718: Critical severity Google Android vulnerability
A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273547.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
Which Android versions should be treated as affected?
Devices running Android 6.0, 6.0.1, 7.0, 7.1.1, or 7.1.2 are identified as affected. The vulnerability is in the Android media framework's MPEG-2 decoder.
What does an attacker need to exploit this issue?
The CVSS vector indicates local attack vector, low attack complexity, no privileges required, and user interaction required. Exploitation therefore requires a user to interact with attacker-provided content locally, rather than an attacker authenticating to the device.
What is the remediation?
Apply the available patch for the Android media framework MPEG-2 decoder. The provided Android security bulletin and upstream libmpeg2 change can be used to identify the relevant fix.