CVE-2017-13194
Published: 12 January 2018
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.
Notes
| Author | Note |
|---|---|
| leosilva | code in trusty is quite different needs to be tested with the POC if possible. |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
libvpx Launchpad, Ubuntu, Debian |
upstream |
Released
(1.3.0-3+deb8u1, 1.7.0-2)
|
| trusty |
Released
(1.3.0-2ubuntu0.1~esm1)
Available with Ubuntu Pro or Ubuntu Pro (Infra-only) |
|
| xenial |
Released
(1.5.0-2ubuntu1.1)
|
|
| zesty |
Ignored
(end of life)
|
|
| artful |
Ignored
(end of life)
|
|
| bionic |
Not vulnerable
(1.7.0-3)
|
|
| cosmic |
Not vulnerable
(1.7.0-3)
|
|
| disco |
Not vulnerable
(1.7.0-3)
|
|
| eoan |
Not vulnerable
(1.7.0-3)
|
|
| focal |
Not vulnerable
(1.7.0-3)
|
|
|
Patches: upstream: https://github.com/webmproject/libvpx/commit/5a40c8fde11bf82cccb5bd2f57c46ab5e6262cbf upstream: https://github.com/webmproject/libvpx/commit/33c598990bc771d7367fe6282bd445e92cd856a6 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 7.5 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-13194
- https://android.googlesource.com/platform/external/libvpx/+/55cd1dd7c8d0a3de907d22e0f12718733f4e41d9
- https://source.android.com/security/bulletin/pixel/2018-01-01
- https://ubuntu.com/security/notices/USN-4199-1
- https://ubuntu.com/security/notices/USN-4199-2
- NVD
- Launchpad
- Debian