CVE-2017-13191: High severity Google Android vulnerability

Published Jan 2, 2018

Updated

In the ihevcddecode function of ihevcddecode.c, there is an infinite loop due to an incomplete frame error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64380403.

Affected Software

9 affected components

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android

Remediation

Patch Available

https://source.android.com/security/bulletin/2018-01-01

Event History

Jan 2, 2018

CVE Published

via Android·12:00 AM

Jan 12, 2018

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-13191?

CVE-2017-13191 has a severity rating that indicates it can cause a remote denial of service.

How do I fix CVE-2017-13191?

To fix CVE-2017-13191, update your Android device to the latest version that includes the security patch.

Which versions of Android are affected by CVE-2017-13191?

CVE-2017-13191 affects Android versions 5.1.1 through 8.1.

Can CVE-2017-13191 be exploited without user interaction?

Yes, CVE-2017-13191 can be exploited remotely without any user interaction required.

What is the potential impact of CVE-2017-13191 on my device?

The potential impact of CVE-2017-13191 is an infinite loop that can result in a denial of service for critical system processes.