High · 7.5 CVE-2018-9340 EUVD-2018-20934GHSA-x386-xj3c-xjx5

In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, ca…

Published Nov 19, 2024 · Updated Nov 20, 2024 · Assigned by google_android

Vendor: Google Product: Android Platform: Android

Description

In ResStringPool::setTo of ResourceTypes.cpp, it's possible for an attacker to control the value of mStringPoolSize to be out of bounds, causing information disclosure.

Affected products

Vendor	Product	Affected	Fixed
Google	Android	6, 6.0.1, 7, 8, 8.1, nyc-mr1-dev, nyc-mr2-dev	—

References

https://source.android.com/security/bulletin/2018-06-01