CVSS: 10.0EPSS: 0%CPEs: 6EXPL: 0CVE-2017-13179
https://notcve.org/view.php?id=CVE-2017-13179
In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both ps_codec_obj and ps_create_op->s_ivd_create_op_t.pv_handle point to the same memory and ps_codec_obj could be freed without clearing ps_create_op->s_ivd_create_op_t.pv_handle. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. • http://www.securityfocus.com/bid/102414 http://www.securitytracker.com/id/1040106 https://source.android.com/security/bulletin/2018-01-01 • CWE-416: Use After Free CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2017-13189
https://notcve.org/view.php?id=CVE-2017-13189
A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68300072. Existe una vulnerabilidad en el framework media de Android (libavc) relacionado con la gestión de los fallos de asignación de memoria de dec_hdl. • https://android.googlesource.com/platform/external/libavc/+/5acaa6fc86c73a750e5f4900c4e2d44bf22f683a https://source.android.com/security/bulletin/pixel/2018-01-01 • CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 11EXPL: 0CVE-2017-13194
https://notcve.org/view.php?id=CVE-2017-13194
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201. Existe una vulnerabilidad en el framework media de Android (libvpx) relacionado con un ancho de frame extraño. • https://android.googlesource.com/platform/external/libvpx/+/55cd1dd7c8d0a3de907d22e0f12718733f4e41d9 https://lists.debian.org/debian-lts-announce/2018/02/msg00025.html https://source.android.com/security/bulletin/pixel/2018-01-01 https://usn.ubuntu.com/4199-1 https://usn.ubuntu.com/4199-2 https://www.debian.org/security/2018/dsa-4132 • CWE-20: Improper Input Validation •
CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-13203
https://notcve.org/view.php?id=CVE-2017-13203
An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-63122634. Existe una vulnerabilidad de divulgación de información en el media framework de Android (libavc). • https://android.googlesource.com/platform/external/libavc/+/e86d3cfd2bc28dac421092106751e5638d54a848 https://source.android.com/security/bulletin/pixel/2018-01-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.1EPSS: 0%CPEs: 7EXPL: 0CVE-2017-13205
https://notcve.org/view.php?id=CVE-2017-13205
An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64550583. Existe una vulnerabilidad de revelación de información en el media framework de Android (libmpeg2). • https://android.googlesource.com/platform/external/libmpeg2/+/29a78a11844fc027fa44be7f8bd8dc1cf8bf89f6 https://source.android.com/security/bulletin/pixel/2018-01-01 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •