Lucene search
HistoryNov 11, 2022 - 12:15 a.m.
CVE-2022-36938
redex
dexloader
vulnerability
out of bound
remote code execution
android
apk
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.004 Low
EPSS
Percentile
72.6%
DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
Affected configurations
Node
facebookredexRange<2022-11-04
Related
prion
prion
Remote code execution
2022-11-11 00:15:00
cve
cve
CVE-2022-36938
2022-11-11 00:15:10
cvelist
cvelist
CVE-2022-36938
2022-11-10 00:00:00
osv
osv
CVE-2022-36938
2022-11-11 00:15:10
9.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
0.004 Low
EPSS
Percentile
72.6%
Related for NVD:CVE-2022-36938