IM
IronMonkey Threat Research

CVE-2017-0663 HIGH

Published: 2017-06-14 | Last Modified: 2026-06-17 | Status: Modified

Description

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

Additional Descriptions (1)

Una vulnerabilidad de ejecución remota de código en libxml2 podría permitir a un atacante usar un archivo especialmente diseñado para ejecutar código arbitrario dentro del contexto de un proceso no privilegiado. Este problema se ha calificado como Alto debido a la posibilidad de ejecución remota de código en una aplicación que use esta biblioteca. Producto: Android. Versiones: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. ID de Android: A-37104170

CVSS Metrics

Base Score: 6.8 (MEDIUM)

AV:N/AC:M/Au:N/C:P/I:P/A:P

Access VectorNETWORK
Access ComplexityMEDIUM
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 8.6

Impact Score: 6.4

Weaknesses

Source Type Description
[email protected] Primary
en CWE-787

Affected Products

Vendor Product Version Update Type
google android 4.4.4 <built-in method update of dict object at 0x7fd340af7fc0> Operating System
google android 5.0.2 <built-in method update of dict object at 0x7fd37039c080> Operating System
google android 5.1.1 <built-in method update of dict object at 0x7fd37039c800> Operating System
google android 6.0 <built-in method update of dict object at 0x7fd385451cc0> Operating System
google android 6.0.1 <built-in method update of dict object at 0x7fd340a31940> Operating System
google android 7.0 <built-in method update of dict object at 0x7fd340a312c0> Operating System
google android 7.1.1 <built-in method update of dict object at 0x7fd3703a3600> Operating System
google android 7.1.2 <built-in method update of dict object at 0x7fd340b00040> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*
Yes cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*

References