CVE-2017-0872: Input Validation
Published Dec 4, 2017
·Updated
A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323.
Affected Software
5 affected components
Google Android=7.0
Google Android=7.1.1
Google Android=7.1.2
Google Android=8.0
Google Android
Remediation
Patch Available
Event History
Dec 4, 2017
CVE Published
via Android·12:00 AM
Dec 6, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
Which Android versions should be prioritized for triage?
Devices running Android 7.0, 7.1.1, 7.1.2, or 8.0 are identified as affected. The issue is in the Android media framework's libskia component.
2
What does an attacker need to exploit this issue?
The CVSS vector indicates network attack access, low attack complexity, no required privileges, and required user interaction. An attacker would need to induce a user to interact with malicious content in order to trigger exploitation.
3
What should teams do to remediate the vulnerability?
A patch is available. Apply the vendor-provided remediation for the affected Android version.