Lucene search

[email protected]CVE-2017-0410

HistoryFeb 08, 2017 - 3:59 p.m.

CVE-2017-0410

2017-02-0815:59:00

CWE-190

[email protected]

web.nvd.nist.gov

cve-2017-0410

android

elevation of privilege

vulnerability

framework apis

local access

arbitrary code

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

47.2%

JSON

An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31929765.

Affected configurations

NVD

Node

googleandroidMatch5.0

googleandroidMatch5.0.1

googleandroidMatch5.0.2

googleandroidMatch5.1

googleandroidMatch5.1.0

googleandroidMatch5.1.1

googleandroidMatch6.0

googleandroidMatch6.0.1

googleandroidMatch7.0

googleandroidMatch7.1.0

googleandroidMatch7.1.1

CPENameOperatorVersion
google:androidgoogle androideq5.0
google:androidgoogle androideq5.0.1
google:androidgoogle androideq5.0.2
google:androidgoogle androideq5.1
google:androidgoogle androideq5.1.0
google:androidgoogle androideq5.1.1
google:androidgoogle androideq6.0
google:androidgoogle androideq6.0.1
google:androidgoogle androideq7.0
google:androidgoogle androideq7.1.0

CPE	Name	Operator	Version
google:android	google android	eq	5.0
google:android	google android	eq	5.0.1
google:android	google android	eq	5.0.2
google:android	google android	eq	5.1
google:android	google android	eq	5.1.0
google:android	google android	eq	5.1.1
google:android	google android	eq	6.0
google:android	google android	eq	6.0.1
google:android	google android	eq	7.0
google:android	google android	eq	7.1.0

Rows per page:

1-10 of 111

CNA Affected

[
  {
    "product": "Android",
    "vendor": "Google Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "Android-5.0.2"
      },
      {
        "status": "affected",
        "version": "Android-5.1.1"
      },
      {
        "status": "affected",
        "version": "Android-6.0"
      },
      {
        "status": "affected",
        "version": "Android-6.0.1"
      },
      {
        "status": "affected",
        "version": "Android-7.0"
      },
      {
        "status": "affected",
        "version": "Android-7.1.1"
      }
    ]
  }
]

References

www.securityfocus.com/bid/96056

www.securitytracker.com/id/1037798

source.android.com/security/bulletin/2017-02-01.html

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

47.2%

JSON

Related for CVE-2017-0410

cvelist1 ubuntucve1 nvd1 prion1 androidsecurity1