CVE-2017-0874: Input Validation
Published Dec 4, 2017
·Updated
A denial of service vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63315932.
Affected Software
7 affected components
Google Android=6.0
Google Android=6.0.1
Google Android=7.0
Google Android=7.1.1
Google Android=7.1.2
Google Android=8.0
Google Android
Event History
Dec 4, 2017
CVE Published
via Android·12:00 AM
Dec 6, 2017
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
DescriptionWeakness
Frequently Asked Questions
1
What does an attacker need to do to exploit this issue?
The CVSS vector indicates network reachability, low attack complexity, no privileges required, and user interaction required. Exploitation requires a user to interact with attacker-supplied content or a delivery mechanism that reaches the affected media framework.
2
What is the likely impact if exploitation succeeds?
The documented impact is denial of service. The CVSS vector indicates no confidentiality or integrity impact, with high impact on availability.
3
Which Android releases are identified as affected?
The affected versions listed are Android 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0.