Skip to content
OpenAdvisories
Unscored CVE-2017-13287 EUVD-2017-4804GHSA-256j-3jw3-gwcq

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could …

Published Apr 4, 2018 · Updated Sep 16, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In createFromParcel of VerifyCredentialResponse.java, there is a possible invalid parcel read due to improper input validation. This could lead to local escalation of privilege if mPayload in writeToParcel were null, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71714464.

Affected products

VendorProductAffectedFixed
Google Android 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 —

References