CVE-2014-7952

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The backup mechanism in the adb tool in Android might allow attackers to inject additional applications (APKs) and execute arbitrary code by leveraging failure to filter application data streams.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/46Exploit, Mailing List, Third Party Advisory
http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerabilityExploit, Third Party Advisory
http://www.securityfocus.com/archive/1/535980/100/0/threaded
http://www.securityfocus.com/bid/75705Third Party Advisory, VDB Entry
https://github.com/irsl/ADB-Backup-APK-Injection/Exploit, Third Party Advisory
http://packetstormsecurity.com/files/132645/ADB-Backup-APK-Injection.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2015/Jul/46Exploit, Mailing List, Third Party Advisory
http://www.search-lab.hu/about-us/news/110-android-adb-backup-apk-injection-vulnerabilityExploit, Third Party Advisory
http://www.securityfocus.com/archive/1/535980/100/0/threaded
http://www.securityfocus.com/bid/75705Third Party Advisory, VDB Entry
https://github.com/irsl/ADB-Backup-APK-Injection/Exploit, Third Party Advisory

Timeline

Published: Jan 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-79537.0Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to exec CVE-2014-79544.6Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically CVE-2014-79564.3Cross-site scripting (XSS) vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script CVE-2014-79576.8Multiple cross-site request forgery (CSRF) vulnerabilities in the Pods plugin before 2.5 for WordPress allow remote attackers to hijack the CVE-2014-79584.3Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allow CVE-2014-79596.5SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote auth CVE-2014-79604.0OpenStack Object Storage (Swift) before 2.2.0 allows remote authenticated users to bypass the max_meta_count and other metadata constraints CVE-2014-79677.5Multiple unspecified vulnerabilities in Google V8 before 3.28.71.15, as used in Google Chrome before 38.0.2125.101, allow attackers to cause CVE-2014-79685.0VDSM allows remote attackers to cause a denial of service (connection blocking) by keeping an SSL connection open.CVE-2014-79705.5The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chro CVE-2014-79755.5The do_umount function in fs/namespace.c in the Linux kernel through 3.17 does not require the CAP_SYS_ADMIN capability for do_remount_sb ca CVE-2014-79783.5Cross-site scripting (XSS) vulnerability in the BlueMasters theme 7.x-2.x before 7.x-2.1 for Drupal allows remote authenticated users with t