CVE-2020-0034: Input Validation
In vp8decodeframe of decodeframe.c, there is a possible out of bounds read due to improper input validation. This could lead to remote information disclosure if error correction were turned on, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1Android ID: A-62458770
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/libvpxto a version that resolves this vulnerability.Fixed in 1.8.2-r0
Event History
Frequently Asked Questions
Which Android releases are identified as affected?
Android 8.0 and Android 8.1 are identified as affected. The Android tracking identifier is A-62458770.
What condition is required for exploitation?
Error correction must be turned on. Exploitation does not require user interaction or additional execution privileges.
Is Debian Linux potentially in scope?
Debian Linux is listed in the affected software data, and a Debian LTS advisory is referenced. No Debian package or version information is provided here.