CVE-2018-9433: Input Validation

Published Jul 2, 2018

Updated

In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.

Affected Software

6 affected components

Google Android

Google Android=6.0

Google Android=6.0.1

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Event History

Jul 2, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Nov 19, 2024

CVE Published

via MITRE·09:28 PM

Data Sourced

via MITRE·09:28 PM

Description

Frequently Asked Questions

What is the severity of CVE-2018-9433?

CVE-2018-9433 is rated as a critical severity vulnerability as it can lead to remote code execution.

How do I mitigate CVE-2018-9433?

Mitigation for CVE-2018-9433 involves updating to the latest version of Android that addresses this vulnerability.

Who is affected by CVE-2018-9433?

CVE-2018-9433 affects users running specific versions of Google Android, including 6.0, 6.0.1, 7.0, and 7.1.x.

Can CVE-2018-9433 be exploited without user interaction?

Exploitation of CVE-2018-9433 requires user interaction, making it less likely but still possible.

What type of vulnerability is CVE-2018-9433?

CVE-2018-9433 is a type confusion vulnerability that arises from improper input validation.