CVE-2018-9339: Incorrect Type Cast
Published Jun 4, 2018
·Updated
In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected Software
3 affected components
Google Android
Google Android=8.0
Google Android=8.1
Remediation
Patch Available
Event History
Jun 4, 2018
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityWeaknessAffected Software
Nov 19, 2024
CVE Published
via MITRE·06:45 PM
Data Sourced
via MITRE·06:45 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-9339?
CVE-2018-9339 is considered a critical vulnerability that allows for local escalation of privilege.
2
How do I fix CVE-2018-9339?
The issue in CVE-2018-9339 can be mitigated by updating to the latest versions of Android, specifically 8.1 and above.
3
What causes CVE-2018-9339?
CVE-2018-9339 is caused by type confusion in the Parcel.java methods writeTypedArrayList and readTypedArrayList.
4
Is user interaction required to exploit CVE-2018-9339?
No, user interaction is not required to exploit CVE-2018-9339.
5
Which versions of Android are affected by CVE-2018-9339?
CVE-2018-9339 affects Android versions 8.0 and 8.1.