Media framework

CVE-2017-0673

(json)

CVE numbers: CVE-2017-0673 [Bulletin-CVE-2017-0673]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33974623. [NIST-CVE-2017-0673]
Discovered by: on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0673]
Fixed on: 2016-12-30 [A-33974623]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0673] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0673]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0673]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0680

(json)

CVE numbers: CVE-2017-0680 [Bulletin-CVE-2017-0680]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37008096. [NIST-CVE-2017-0680]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0680] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0680]
Fixed on: 2017-02-10 [A-37008096]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0680] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0680]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0680]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0677

(json)

CVE numbers: CVE-2017-0677 [Bulletin-CVE-2017-0677]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36035074. [NIST-CVE-2017-0677]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0677] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0677]
Fixed on: 2017-03-20 [A-36035074]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0677] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0677]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0677]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0637

(json)

CVE numbers: CVE-2017-0637 [Bulletin-CVE-2017-0637]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34064500. [NIST-CVE-2017-0637]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0637] on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2017-0637]
Fixed on: 2017-03-31 [A-34064500]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0637] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0637]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0637]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0674

(json)

CVE numbers: CVE-2017-0674 [Bulletin-CVE-2017-0674]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34231163. [NIST-CVE-2017-0674]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0674] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0674]
Fixed on: 2017-04-05 [A-34231163]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0674] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0674]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0674]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0675

(json)

CVE numbers: CVE-2017-0675 [Bulletin-CVE-2017-0675]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34779227. [NIST-CVE-2017-0675]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0675] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0675]
Fixed on: 2017-04-05 [2]
Fix released on: Unknown
Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0675] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0675]
Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0675]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0676

(json)

CVE numbers: CVE-2017-0676 [Bulletin-CVE-2017-0676]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34896431. [NIST-CVE-2017-0676]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0676] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0676]
Fixed on: 2017-04-05 [A-34896431]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0676] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0676]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0676]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0719

(json)

CVE numbers: CVE-2017-0719 [Bulletin-CVE-2017-0719]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273673. [NIST-CVE-2017-0719]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0719] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0719]
Fixed on: 2017-04-20 [A-37273673]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0719] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0719]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0719]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0721

(json)

CVE numbers: CVE-2017-0721 [Bulletin-CVE-2017-0721]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37561455. [NIST-CVE-2017-0721]
Discovered by: on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0721]
Fixed on: 2017-04-21 [A-37561455]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0721] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0721]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0721]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0723

(json)

CVE numbers: CVE-2017-0723 [Bulletin-CVE-2017-0723]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37968755. [NIST-CVE-2017-0723]
Discovered by: on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0723]
Fixed on: 2017-04-21 [A-37968755]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0723] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0723]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0723]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0540

(json)

CVE numbers: CVE-2017-0540 [Bulletin-CVE-2017-0540]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33966031. [NIST-CVE-2017-0540]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0540] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0540]
Fixed on: 2017-04-22 [A-33966031]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0540] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0540]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0540]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0811

(json)

CVE numbers: CVE-2017-0811 [Bulletin-CVE-2017-0811]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37930177. [NIST-CVE-2017-0811]
Discovered by: on: Unknown
Reported on: 2017-10-01 [Bulletin-CVE-2017-0811]
Fixed on: 2017-05-03 [A-37930177]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0811] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0811]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0811]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0679

(json)

CVE numbers: CVE-2017-0679 [Bulletin-CVE-2017-0679]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978. [NIST-CVE-2017-0679]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0679] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0679]
Fixed on: 2017-05-08 [A-36996978]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0679] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0679]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0679]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0715

(json)

CVE numbers: CVE-2017-0715 [Bulletin-CVE-2017-0715]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36998372. [NIST-CVE-2017-0715]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0715] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0715]
Fixed on: 2017-05-08 [A-36998372]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0715] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0715]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0715]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0681

(json)

CVE numbers: CVE-2017-0681 [Bulletin-CVE-2017-0681]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37208566. [NIST-CVE-2017-0681]
Discovered by: Xuxian Jiang of C0RE Team [Discovery-CVE-2017-0681] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0681]
Fixed on: 2017-05-11 [A-37208566]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0681]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0716

(json)

CVE numbers: CVE-2017-0716 [Bulletin-CVE-2017-0716]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37203196. [NIST-CVE-2017-0716]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0716] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0716]
Fixed on: 2017-05-12 [A-37203196]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0716] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0716]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0716]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0678

(json)

CVE numbers: CVE-2017-0678 [Bulletin-CVE-2017-0678]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36576151. [NIST-CVE-2017-0678]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0678] on: Unknown
Reported on: 2017-07-01 [Bulletin-CVE-2017-0678]
Fixed on: 2017-05-15 [A-36576151]
Fix released on: Unknown
Affected versions: 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0678] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0678]
Fixed versions: 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0678]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0745

(json)

CVE numbers: CVE-2017-0745 [Bulletin-CVE-2017-0745]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (avc decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37079296. [NIST-CVE-2017-0745]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0745] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0745]
Fixed on: 2017-05-18 [A-37079296]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0745]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0714

(json)

CVE numbers: CVE-2017-0714 [Bulletin-CVE-2017-0714]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492637. [NIST-CVE-2017-0714]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0714] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0714]
Fixed on: 2017-05-19 [A-36492637]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0714]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0722

(json)

CVE numbers: CVE-2017-0722 [Bulletin-CVE-2017-0722]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37660827. [NIST-CVE-2017-0722]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0722] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0722]
Fixed on: 2017-05-19 [A-37660827]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0722]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0720

(json)

CVE numbers: CVE-2017-0720 [Bulletin-CVE-2017-0720]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37430213. [NIST-CVE-2017-0720]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0720] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0720]
Fixed on: 2017-05-23 [A-37430213]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0720] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0720]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0720]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0718

(json)

CVE numbers: CVE-2017-0718 [Bulletin-CVE-2017-0718]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273547. [NIST-CVE-2017-0718]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0718] on: Unknown
Reported on: 2017-08-01 [Bulletin-CVE-2017-0718]
Fixed on: 2017-05-30 [A-37273547]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0718] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0718]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0718]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0810

(json)

CVE numbers: CVE-2017-0810 [Bulletin-CVE-2017-0810]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38207066. [NIST-CVE-2017-0810]
Discovered by: on: Unknown
Reported on: 2017-10-01 [Bulletin-CVE-2017-0810]
Fixed on: 2017-06-09 [A-38207066]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0810] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0810]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0810]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0832

(json)

CVE numbers: CVE-2017-0832 [Bulletin-CVE-2017-0832]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62887820. [NIST-CVE-2017-0832]
Discovered by: on: Unknown
Reported on: 2017-11-01 [Bulletin-CVE-2017-0832]
Fixed on: 2017-06-09 [A-62887820]
Fix released on: 2017-11-06 [Bulletin-CVE-2017-0832]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0832] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0832]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0832]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0835

(json)

CVE numbers: CVE-2017-0835 [Bulletin-CVE-2017-0835]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63316832. [NIST-CVE-2017-0835]
Discovered by: on: Unknown
Reported on: 2017-11-01 [Bulletin-CVE-2017-0835]
Fixed on: 2017-06-09 [A-63316832]
Fix released on: 2017-11-06 [Bulletin-CVE-2017-0835]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0835] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0835]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0835]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0833

(json)

CVE numbers: CVE-2017-0833 [Bulletin-CVE-2017-0833]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62896384. [NIST-CVE-2017-0833]
Discovered by: on: Unknown
Reported on: 2017-11-01 [Bulletin-CVE-2017-0833]
Fixed on: 2017-06-22 [A-62896384]
Fix released on: 2017-11-06 [Bulletin-CVE-2017-0833]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0833] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0833]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0833]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0809

(json)

CVE numbers: CVE-2017-0809 [Bulletin-CVE-2017-0809]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128. [NIST-CVE-2017-0809]
Discovered by: on: Unknown
Reported on: 2017-10-01 [Bulletin-CVE-2017-0809]
Fixed on: 2017-06-27 [A-62673128]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0809]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0834

(json)

CVE numbers: CVE-2017-0834 [Bulletin-CVE-2017-0834]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63125953. [NIST-CVE-2017-0834]
Discovered by: on: Unknown
Reported on: 2017-11-01 [Bulletin-CVE-2017-0834]
Fixed on: 2017-06-27 [A-63125953]
Fix released on: 2017-11-06 [Bulletin-CVE-2017-0834]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0834] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0834]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0834]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13230

(json)

CVE numbers: CVE-2017-13230 [Bulletin-CVE-2017-13230]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65483665. [NIST-CVE-2017-13230]
Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2017-13230] on: Unknown
Reported on: 2018-02-01 [Bulletin-CVE-2017-13230]
Fixed on: 2017-07-06 [A-65483665]
Fix released on: 2018-02-05 [Bulletin-CVE-2017-13230]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13230]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13151

(json)

CVE numbers: CVE-2017-13151 [Bulletin-CVE-2017-13151]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456. [NIST-CVE-2017-13151]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-13151]
Fixed on: 2017-07-12 [A-63874456]
Fix released on: 2017-12-05 [Bulletin-CVE-2017-13151]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13151] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13151]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13151]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13249

(json)

CVE numbers: CVE-2017-13249 [Bulletin-CVE-2017-13249]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In impeg2d_api_set_display_frame of impeg2d_api_main.c, there is an out of bound write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70399408. [NIST-CVE-2017-13249]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13249] on: Unknown
Reported on: 2018-03-01 [Bulletin-CVE-2017-13249]
Fixed on: 2017-08-09 [A-70399408]
Fix released on: 2018-03-05 [Bulletin-CVE-2017-13249]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13249]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0878

(json)

CVE numbers: CVE-2017-0878 [Bulletin-CVE-2017-0878]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291. [NIST-CVE-2017-0878]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-0878]
Fixed on: 2017-08-29 [A-65186291]
Fix released on: 2017-12-05 [Bulletin-CVE-2017-0878]
Affected versions: 8.0 [Bulletin-CVE-2017-0878] regex: (8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0878]
Fixed versions: 8.0 [Bulletin-CVE-2017-0878]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2018-9473

(json)

CVE numbers: CVE-2018-9473 [Bulletin-CVE-2018-9473]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android ID: A-65484460 [NIST-CVE-2018-9473]
Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2018-9473] on: Unknown
Reported on: 2018-10-01 [Bulletin-CVE-2018-9473]
Fixed on: 2017-08-29 [A-65484460]
Fix released on: 2018-10-05 [Bulletin-CVE-2018-9473]
Affected versions: 8.0 [Bulletin-CVE-2018-9473] regex: (8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9473]
Fixed versions: 8.0 [Bulletin-CVE-2018-9473]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0836

(json)

CVE numbers: CVE-2017-0836 [Bulletin-CVE-2017-0836]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226. [NIST-CVE-2017-0836]
Discovered by: Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-0836] on: Unknown
Reported on: 2017-11-01 [Bulletin-CVE-2017-0836]
Fixed on: 2017-08-31 [A-64893226]
Fix released on: 2017-11-06 [Bulletin-CVE-2017-0836]
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0836] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0836]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0836]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0872

(json)

CVE numbers: CVE-2017-0872 [Bulletin-CVE-2017-0872]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323. [NIST-CVE-2017-0872]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-0872]
Fixed on: 2017-09-27 [A-65290323]
Fix released on: 2017-12-05 [Bulletin-CVE-2017-0872]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0872] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0872]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0872]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13178

(json)

CVE numbers: CVE-2017-13178 [Bulletin-CVE-2017-13178]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969281. [NIST-CVE-2017-13178]
Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13178] on: Unknown
Reported on: 2018-01-01 [Bulletin-CVE-2017-13178]
Fixed on: 2017-10-04 [A-66969281]
Fix released on: 2018-01-05 [Bulletin-CVE-2017-13178]
Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13178]
Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13179

(json)

CVE numbers: CVE-2017-13179 [Bulletin-CVE-2017-13179]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both ps_codec_obj and ps_create_op->s_ivd_create_op_t.pv_handle point to the same memory and ps_codec_obj could be freed without clearing ps_create_op->s_ivd_create_op_t.pv_handle. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969193. [NIST-CVE-2017-13179]
Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13179] on: Unknown
Reported on: 2018-01-01 [Bulletin-CVE-2017-13179]
Fixed on: 2017-10-04 [A-66969193]
Fix released on: 2018-01-05 [Bulletin-CVE-2017-13179]
Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13179]
Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13177

(json)

CVE numbers: CVE-2017-13177 [Bulletin-CVE-2017-13177]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413. [NIST-CVE-2017-13177]
Discovered by: on: Unknown
Reported on: 2018-01-01 [Bulletin-CVE-2017-13177]
Fixed on: 2017-10-09 [A-68320413]
Fix released on: 2018-01-05 [Bulletin-CVE-2017-13177]
Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13177]
Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-13228

(json)

CVE numbers: CVE-2017-13228 [Bulletin-CVE-2017-13228]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425. [NIST-CVE-2017-13228]
Discovered by: on: Unknown
Reported on: 2018-02-01 [Bulletin-CVE-2017-13228]
Fixed on: 2017-11-28 [A-69478425]
Fix released on: 2018-02-05 [Bulletin-CVE-2017-13228]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13228]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0876

(json)

CVE numbers: CVE-2017-0876 [Bulletin-CVE-2017-0876]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675. [NIST-CVE-2017-0876]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-0876]
Fixed on: Unknown
Fix released on: 2017-12-05 [Bulletin-CVE-2017-0876]
Affected versions: 6.0 [Bulletin-CVE-2017-0876] regex: (6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0876]
Fixed versions: 6.0 [Bulletin-CVE-2017-0876]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0877

(json)

CVE numbers: CVE-2017-0877 [Bulletin-CVE-2017-0877]
Coordinated disclosure?: unknown
Categories: Media framework
Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937. [NIST-CVE-2017-0877]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-0877]
Fixed on: Unknown
Fix released on: 2017-12-05 [Bulletin-CVE-2017-0877]
Affected versions: 6.0 [Bulletin-CVE-2017-0877] regex: (6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0877]
Fixed versions: 6.0 [Bulletin-CVE-2017-0877]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13248

(json)

CVE numbers: CVE-2017-13248 [Bulletin-CVE-2017-13248]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In impeg2_idct_recon_sse42() of impeg2_idct_recon_sse42_intr.c, there is an out of bound write due to a missing bounds check. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70349612. [NIST-CVE-2017-13248]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13248] on: Unknown
Reported on: 2018-03-01 [Bulletin-CVE-2017-13248]
Fixed on: 2017-12-18 [A-70349612]
Fix released on: 2018-03-05 [Bulletin-CVE-2017-13248]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13248]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13250

(json)

CVE numbers: CVE-2017-13250 [Bulletin-CVE-2017-13250]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c, there is an out of bound write due to a missing out of bounds check because of a multiplication error. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71375536. [NIST-CVE-2017-13250]
Discovered by: on: Unknown
Reported on: 2018-03-01 [Bulletin-CVE-2017-13250]
Fixed on: 2017-12-27 [A-71375536]
Fix released on: 2018-03-05 [Bulletin-CVE-2017-13250]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13250]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13251

(json)

CVE numbers: CVE-2017-13251 [Bulletin-CVE-2017-13251]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In impeg2d_dec_pic_data_thread of impeg2d_dec_hdr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when running multi threaded with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69269702. [NIST-CVE-2017-13251]
Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13251] on: Unknown
Reported on: 2018-03-01 [Bulletin-CVE-2017-13251]
Fixed on: 2017-12-28 [A-69269702]
Fix released on: 2018-03-05 [Bulletin-CVE-2017-13251]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13251]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9498

(json)

CVE numbers: CVE-2018-9498 [Bulletin-CVE-2018-9498]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78354855 [NIST-CVE-2018-9498]
Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9498] on: Unknown
Reported on: 2018-10-01 [Bulletin-CVE-2018-9498]
Fixed on: 2018-01-05 [A-78354855]
Fix released on: 2018-10-05 [Bulletin-CVE-2018-9498]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9498] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9498]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9498]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13276

(json)

CVE numbers: CVE-2017-13276 [Bulletin-CVE-2017-13276]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In CProgramConfig_ReadHeightExt of tpdec_asc.cpp, there is a possible stack buffer overflow due to a missing bounds check. This could lead to a remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70637599. [NIST-CVE-2017-13276]
Discovered by: Elphet and Gong Guang of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13276] on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-13276]
Fixed on: 2018-01-12 [A-70637599]
Fix released on: 2018-04-05 [Bulletin-CVE-2017-13276]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13276] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13276]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13276]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13277

(json)

CVE numbers: CVE-2017-13277 [Bulletin-CVE-2017-13277]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_fmt_conv of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-72165027. [NIST-CVE-2017-13277]
Discovered by: Weichao Sun of Alibaba Inc (@sunblate) [Discovery-CVE-2017-13277] on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-13277]
Fixed on: 2018-01-23 [A-72165027]
Fix released on: 2018-04-05 [Bulletin-CVE-2017-13277]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13277] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-13277]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13277]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9341

(json)

CVE numbers: CVE-2018-9341 [Bulletin-CVE-2018-9341]
Coordinated disclosure?: unknown
Categories: Media framework
Details:
Discovered by: Stephan Zeisberg of Security Research Labs [Discovery-CVE-2018-9341] on: Unknown
Reported on: 2018-06-01 [Bulletin-CVE-2018-9341]
Fixed on: 2018-03-15 [A-74016277]
Fix released on: 2018-06-05 [Bulletin-CVE-2018-9341]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9341] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9341]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9341]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9411

(json)

CVE numbers: CVE-2018-9411 [Bulletin-CVE-2018-9411]
Coordinated disclosure?: unknown
Categories: Media framework
Details:
Discovered by: Tamir Zahavi-Brunner (@tamir_zb) of Zimperium zLabs Team [Discovery-CVE-2018-9411] on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-9411]
Fixed on: 2018-05-11 [A-79376389]
Fix released on: 2018-07-05 [Bulletin-CVE-2018-9411]
Affected versions: 8.0, 8.1 [Bulletin-CVE-2018-9411] regex: (8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9411]
Fixed versions: 8.0, 8.1 [Bulletin-CVE-2018-9411]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9427

(json)

CVE numbers: CVE-2018-9427 [Bulletin-CVE-2018-9427]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In CopyToOMX of OMXNodeInstance.cpp there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-77486542. [NIST-CVE-2018-9427]
Discovered by: on: Unknown
Reported on: 2018-08-01 [Bulletin-CVE-2018-9427]
Fixed on: 2018-05-23 [2]
Fix released on: 2018-08-05 [Bulletin-CVE-2018-9427]
Affected versions: 8.0, 8.1 [Bulletin-CVE-2018-9427] regex: (8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9427]
Fixed versions: 8.0, 8.1 [Bulletin-CVE-2018-9427]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5146

(json)

CVE numbers: CVE-2018-5146 [Bulletin-CVE-2018-5146]
Coordinated disclosure?: unknown
Categories: Media framework
Details: An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7. [NIST-CVE-2018-5146]
Discovered by: Jose Martinez [Discovery-CVE-2018-5146] on: Unknown
Reported on: 2018-06-01 [Bulletin-CVE-2018-5146]
Fixed on: Unknown
Fix released on: 2018-06-05 [Bulletin-CVE-2018-5146]
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-5146] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-5146]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-5146]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9536

(json)

CVE numbers: CVE-2018-9536 [Bulletin-CVE-2018-9536]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112662184 [NIST-CVE-2018-9536]
Discovered by: on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2018-9536]
Fixed on: 2018-06-08 [A-112662184]
Fix released on: 2018-11-05 [Bulletin-CVE-2018-9536]
Affected versions: 9 [Bulletin-CVE-2018-9536] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9536]
Fixed versions: 9 [Bulletin-CVE-2018-9536]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9550

(json)

CVE numbers: CVE-2018-9550 [Bulletin-CVE-2018-9550]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112660981. [NIST-CVE-2018-9550]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-9550]
Fixed on: 2018-06-08 [A-112660981]
Fix released on: 2018-12-05 [Bulletin-CVE-2018-9550]
Affected versions: 9 [Bulletin-CVE-2018-9550] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9550]
Fixed versions: 9 [Bulletin-CVE-2018-9550]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9496

(json)

CVE numbers: CVE-2018-9496 [Bulletin-CVE-2018-9496]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-110769924 [NIST-CVE-2018-9496]
Discovered by: on: Unknown
Reported on: 2018-10-01 [Bulletin-CVE-2018-9496]
Fixed on: 2018-06-25 [A-110769924]
Fix released on: 2018-10-05 [Bulletin-CVE-2018-9496]
Affected versions: 9 [Bulletin-CVE-2018-9496] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9496]
Fixed versions: 9 [Bulletin-CVE-2018-9496]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9497

(json)

CVE numbers: CVE-2018-9497 [Bulletin-CVE-2018-9497]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 of impeg2_format_conv.s there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-74078669 [NIST-CVE-2018-9497]
Discovered by: Stephan Zeisberg of Security Research Labs [Discovery-CVE-2018-9497] on: Unknown
Reported on: 2018-10-01 [Bulletin-CVE-2018-9497]
Fixed on: 2018-06-25 [A-74078669]
Fix released on: 2018-10-05 [Bulletin-CVE-2018-9497]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9497] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9497]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9497]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9531

(json)

CVE numbers: CVE-2018-9531 [Bulletin-CVE-2018-9531]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112661641 [NIST-CVE-2018-9531]
Discovered by: on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2018-9531]
Fixed on: 2018-06-29 [A-112661641]
Fix released on: 2018-11-05 [Bulletin-CVE-2018-9531]
Affected versions: 9 [Bulletin-CVE-2018-9531] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9531]
Fixed versions: 9 [Bulletin-CVE-2018-9531]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9537

(json)

CVE numbers: CVE-2018-9537 [Bulletin-CVE-2018-9537]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In CAacDecoder_DecodeFrame of aacdecode.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891564 [NIST-CVE-2018-9537]
Discovered by: on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2018-9537]
Fixed on: 2018-08-15 [A-112891564]
Fix released on: 2018-11-05 [Bulletin-CVE-2018-9537]
Affected versions: 9 [Bulletin-CVE-2018-9537] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9537]
Fixed versions: 9 [Bulletin-CVE-2018-9537]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9551

(json)

CVE numbers: CVE-2018-9551 [Bulletin-CVE-2018-9551]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out-of-bound write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891548. [NIST-CVE-2018-9551]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-9551]
Fixed on: 2018-08-15 [A-112891548]
Fix released on: 2018-12-05 [Bulletin-CVE-2018-9551]
Affected versions: 9 [Bulletin-CVE-2018-9551] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9551]
Fixed versions: 9 [Bulletin-CVE-2018-9551]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9527

(json)

CVE numbers: CVE-2018-9527 [Bulletin-CVE-2018-9527]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112159345 [NIST-CVE-2018-9527]
Discovered by: Zinuo Han(weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9527] on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2018-9527]
Fixed on: 2018-08-16 [A-112159345]
Fix released on: 2018-11-05 [Bulletin-CVE-2018-9527]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9527] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9527]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9527]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9549

(json)

CVE numbers: CVE-2018-9549 [Bulletin-CVE-2018-9549]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112160868. [NIST-CVE-2018-9549]
Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9549] on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-9549]
Fixed on: 2018-09-10 [A-112160868]
Fix released on: 2018-12-05 [Bulletin-CVE-2018-9549]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9549] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9549]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9549]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9552

(json)

CVE numbers: CVE-2018-9552 [Bulletin-CVE-2018-9552]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_sao_shift_ctb of ihevcd_sao.c there is a possible out of bounds write due to missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-113260892. [NIST-CVE-2018-9552]
Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9552] on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-9552]
Fixed on: 2018-09-11 [A-113260892]
Fix released on: 2018-12-05 [Bulletin-CVE-2018-9552]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9552] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2018-9552]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9552]
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2019-2095

(json)

CVE numbers: CVE-2019-2095 [Bulletin-CVE-2019-2095]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-124232283. [NIST-CVE-2019-2095]
Discovered by: on: Unknown
Reported on: 2019-06-01 [Bulletin-CVE-2019-2095]
Fixed on: 2018-09-17 [A-124232283]
Fix released on: 2019-06-05 [Bulletin-CVE-2019-2095]
Affected versions: 9 [Bulletin-CVE-2019-2095] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2095]
Fixed versions: 9 [Bulletin-CVE-2019-2095]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1989

(json)

CVE numbers: CVE-2019-1989 [Bulletin-CVE-2019-1989]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118399205 [NIST-CVE-2019-1989]
Discovered by: on: Unknown
Reported on: 2019-03-01 [Bulletin-CVE-2019-1989]
Fixed on: 2018-10-24 [A-118399205]
Fix released on: 2019-03-05 [Bulletin-CVE-2019-1989]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1989] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-1989]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1989]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2028

(json)

CVE numbers: CVE-2019-2028 [Bulletin-CVE-2019-2028]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-120644655. [NIST-CVE-2019-2028]
Discovered by: Suresh Sivaraman of Ittiam [Discovery-CVE-2019-2028] on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2019-2028]
Fixed on: 2018-11-07 [A-120644655]
Fix released on: 2019-04-05 [Bulletin-CVE-2019-2028]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2028] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2028]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2028]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1990

(json)

CVE numbers: CVE-2019-1990 [Bulletin-CVE-2019-1990]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118453553 [NIST-CVE-2019-1990]
Discovered by: on: Unknown
Reported on: 2019-03-01 [Bulletin-CVE-2019-1990]
Fixed on: 2018-11-12 [A-118453553]
Fix released on: 2019-03-05 [Bulletin-CVE-2019-1990]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1990] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-1990]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1990]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2093

(json)

CVE numbers: CVE-2019-2093 [Bulletin-CVE-2019-2093]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-119292397. [NIST-CVE-2019-2093]
Discovered by: on: Unknown
Reported on: 2019-06-01 [Bulletin-CVE-2019-2093]
Fixed on: 2018-12-20 [A-119292397]
Fix released on: 2019-06-05 [Bulletin-CVE-2019-2093]
Affected versions: 9 [Bulletin-CVE-2019-2093] regex: (9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2093]
Fixed versions: 9 [Bulletin-CVE-2019-2093]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2027

(json)

CVE numbers: CVE-2019-2027 [Bulletin-CVE-2019-2027]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In floor0_inverse1 of floor0.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-119120561. [NIST-CVE-2019-2027]
Discovered by: Qi Zhao ( @JHyrathon) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2019-2027] on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2019-2027]
Fixed on: 2019-01-23 [A-119120561]
Fix released on: 2019-04-05 [Bulletin-CVE-2019-2027]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2027] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2027]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2027]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2044

(json)

CVE numbers: CVE-2019-2044 [Bulletin-CVE-2019-2044]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In MakeMP>G4VideoCodecSpecificData of APacketSource.cpp, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9 Android ID: A-123701862 [NIST-CVE-2019-2044]
Discovered by: Cusas of L.O. Team [Discovery-CVE-2019-2044] on: Unknown
Reported on: 2019-05-01 [Bulletin-CVE-2019-2044]
Fixed on: 2019-02-26 [A-123701862]
Fix released on: 2019-05-05 [Bulletin-CVE-2019-2044]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2044] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2044]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2044]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2106

(json)

CVE numbers: CVE-2019-2106 [Bulletin-CVE-2019-2106]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_sao_shift_ctb of ihevcd_sao.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130023983. [NIST-CVE-2019-2106]
Discovered by: Kostya Serebryany of Google, using libFuzzer and AddressSanitizer [Discovery-CVE-2019-2106] on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2106]
Fixed on: 2019-03-29 [A-130023983]
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2106]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2106] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2106]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2106]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2094

(json)

CVE numbers: CVE-2019-2094 [Bulletin-CVE-2019-2094]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In parseMPEGCCData of NuPlayerCCDecoder.cpp, there is a possible out of bounds write due to missing bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-129068792. [NIST-CVE-2019-2094]
Discovered by: Cusas of L.O. Team [Discovery-CVE-2019-2094] on: Unknown
Reported on: 2019-06-01 [Bulletin-CVE-2019-2094]
Fixed on: 2019-04-01 [A-129068792]
Fix released on: 2019-06-05 [Bulletin-CVE-2019-2094]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2094] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2094]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2094]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2107

(json)

CVE numbers: CVE-2019-2107 [Bulletin-CVE-2019-2107]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-130024844. [NIST-CVE-2019-2107]
Discovered by: Kostya Serebryany of Google, using libFuzzer and AddressSanitizer [Discovery-CVE-2019-2107] on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2107]
Fixed on: 2019-04-05 [A-130024844]
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2107]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2107] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2107]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2107]
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2109

(json)

CVE numbers: CVE-2019-2109 [Bulletin-CVE-2019-2109]
Coordinated disclosure?: unknown
Categories: Media framework
Details: In MakeMPEG4VideoCodecSpecificData of AVIExtractor.cpp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1. Android ID: A-130651570. [NIST-CVE-2019-2109]
Discovered by: on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2109]
Fixed on: Unknown
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2109]
Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2019-2109] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2019-2109]
Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2019-2109]
Submission: by: Daniel Carter, on: 2019-07-24