CVE-2017-13285: XSS
In SvoxSsmlParser and startElement of svoxssmlparser.cpp, there is a possible out of bounds write due to an uninitialized buffer. This could lead to remote code execution in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69177126.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-13285?
CVE-2017-13285 is classified as a high-severity vulnerability that can lead to remote code execution.
How do I fix CVE-2017-13285?
To fix CVE-2017-13285, ensure that your Android device is updated to a version that includes the patch provided in the security bulletin.
Which versions of Android are affected by CVE-2017-13285?
CVE-2017-13285 affects Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, and 8.1.
Can CVE-2017-13285 be exploited without user interaction?
Yes, CVE-2017-13285 can be exploited remotely with no user interaction required.
What components of Android are impacted by CVE-2017-13285?
CVE-2017-13285 impacts the SvoxSsmlParser and the startElement function in the svox_ssml_parser.cpp file.