CVE-2017-13274: Critical severity Google Android vulnerability

Published Apr 2, 2018

Updated

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71360761.

Affected Software

8 affected components

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android=8.0

Google Android=8.1

Google Android

Event History

Apr 2, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Apr 4, 2018

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-13274?

CVE-2017-13274 has been classified with a moderate severity level due to the potential for incorrect security decisions.

How do I fix CVE-2017-13274?

To fix CVE-2017-13274, ensure that your Android system is updated to a version that addresses this vulnerability.

Which Android versions are affected by CVE-2017-13274?

CVE-2017-13274 affects Android versions 6.0, 6.0.1, 7.0, 7.1.x, as well as 8.0 and 8.1.

Can CVE-2017-13274 be exploited without user interaction?

Yes, CVE-2017-13274 can be exploited without any user interaction required.

What component is primarily responsible for the vulnerability in CVE-2017-13274?

The vulnerability in CVE-2017-13274 originates from the getHost() function in UriTest.java.