CVE-2018-9557: High severity Google Android vulnerability

Published Dec 3, 2018

Updated

In reallyinstallpackage of install.cpp, there is a possible free of arbitrary memory due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2. Android ID: A-35385357.

Affected Software

4 affected components

Google Android=7.0

Google Android=7.1.1

Google Android=7.1.2

Google Android

Event History

Dec 3, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Dec 6, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-9557?

CVE-2018-9557 has been classified as a high severity vulnerability due to its potential for local escalation of privilege.

How do I fix CVE-2018-9557?

To fix CVE-2018-9557, update your Android device to a version that includes the security patches addressed in the December 2018 security update.

What versions of Android are affected by CVE-2018-9557?

CVE-2018-9557 affects Android versions 7.0, 7.1.1, and 7.1.2.

Can CVE-2018-9557 be exploited without user interaction?

Yes, CVE-2018-9557 can be exploited without any additional user interaction.

What type of vulnerability is CVE-2018-9557?

CVE-2018-9557 is a memory corruption vulnerability that can lead to arbitrary memory free, resulting in local privilege escalation.