CVE-2017-13178: Use After Free
In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969281.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13178?
CVE-2017-13178 has a critical severity level as it can lead to remote code execution without the need for user interaction.
How can I fix CVE-2017-13178?
To fix CVE-2017-13178, users should update their Android devices to the latest security patch that addresses this vulnerability.
Which versions of Android are affected by CVE-2017-13178?
CVE-2017-13178 affects Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.
What type of vulnerability is CVE-2017-13178?
CVE-2017-13178 is a use after free vulnerability that can result in an out-of-bounds write.
Does CVE-2017-13178 require user interaction to exploit?
No, CVE-2017-13178 does not require user interaction for exploitation.