CVE-2014-7911

🗓️ 15 Dec 2014 17:27:00Reported by ChromeType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 52 Views

CVE-2014-7911 luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291

Reporter	Title	Published	Views	Family All 14
GithubExploit	Exploit for Out-of-bounds Write in Linux Linux_Kernel	26 Jan 201507:02	–	githubexploit
Tenable Nessus	Google Android Operating System < 5.0.0 Multiple Vulnerabilities	10 Apr 201500:00	–	nessus
Gitee	Exploit for CVE-2014-7911	27 Jul 202504:02	–	gitee
Gitee	Exploit for CVE-2014-7911	11 Sep 202017:02	–	gitee
Gitee	Exploit for CVE-2014-7911	11 Feb 202023:47	–	gitee
android	ObjectInputStream deserializable	14 Nov 201400:00	–	android
Circl	CVE-2014-7911	9 Oct 202017:31	–	circl
Cvelist	CVE-2014-7911	15 Dec 201417:27	–	cvelist
Huawei	Security Advisory - Privilege Escalation Vulnerability in Huawei Mate7	11 Feb 201500:00	–	huawei
NVD	CVE-2014-7911	15 Dec 201418:59	–	nvd