CVE-2017-0663CWE-787

CVE-2017-0663

High · published June 14, 2017

CVSS v3.0
7.8
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

The record
Technical detail
CVSS v3.0
7.8 · HIGH
Vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.02318 · 83.2th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2017-06-14T17:29Z
Affected products (8)
ProductVersionsFixed in
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
google/androidall versions—
References (15)
http://www.debian.org/security/2017/dsa-3952 · [email protected]http://www.securityfocus.com/bid/98877 · [email protected]http://www.securitytracker.com/id/1038623 · [email protected]https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://security.gentoo.org/glsa/201711-01 · [email protected]https://source.android.com/security/bulletin/2017-06-01 · [email protected]http://www.debian.org/security/2017/dsa-3952 · af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/98877 · af854a3a-2127-422b-91ae-364da2661108http://www.securitytracker.com/id/1038623 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/201711-01 · af854a3a-2127-422b-91ae-364da2661108https://source.android.com/security/bulletin/2017-06-01 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 14 JUN 13:00Z
    A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an…
    cvelistv5