CVE-2018-9574: Critical severity android vulnerability

Published Dec 7, 2018

Updated

In impdparsesplitdrccharacteristic of impddrcstaticpayload.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116619337.

Affected Software

1 affected component

Google Android=9.0

Event History

Dec 7, 2018

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

DescriptionWeakness

Frequently Asked Questions

What attacker access and user action are required for exploitation?

The CVSS vector indicates local attack access, no privileges required, and required user interaction. The issue is described as potentially leading to remote code execution, but the provided data does not specify the delivery mechanism or the exact user action involved.

Which Android versions are identified as affected?

The provided data identifies Android 9 as affected. It does not provide information about other Android versions, device models, or vendor-specific patch availability.

How can I determine whether a device is exposed?

Check whether the device is running Android 9 and whether it has received the security fix associated with Android ID A-116619337. The supplied reference is the Android security bulletin dated 2018-11-01.

CVE-2018-9574: Critical severity android vulnerability

Affected Software

Event History

Frequently Asked Questions

What attacker access and user action are required for exploitation?

Which Android versions are identified as affected?

How can I determine whether a device is exposed?

Company

Resources

Contact

Frequently Asked Questions

What attacker access and user action are required for exploitation?

Which Android versions are identified as affected?

How can I determine whether a device is exposed?