CVE-2017-0589

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34897036.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Google Inc.	Android	5.0.2; 5.1.1; 6.0; 6.0.1; 7.0; 7.1.1; 7.1.2

References

http://www.securityfocus.com/bid/98122Third Party Advisory, VDB Entry
https://android.googlesource.com/platform/external/libhevc/+/bcfc7124f6ef9f1ec128fb2e90de774a5b33d199Issue Tracking, Patch, Third Party Advisory
https://source.android.com/security/bulletin/2017-05-01Patch, Vendor Advisory
http://www.securityfocus.com/bid/98122Third Party Advisory, VDB Entry
https://android.googlesource.com/platform/external/libhevc/+/bcfc7124f6ef9f1ec128fb2e90de774a5b33d199Issue Tracking, Patch, Third Party Advisory
https://source.android.com/security/bulletin/2017-05-01Patch, Vendor Advisory

Timeline

Published: May 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-05907.8A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corr CVE-2017-05917.8A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corru CVE-2017-05927.8A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially craft CVE-2017-05937.8An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissi CVE-2017-05947.8An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious CVE-2017-05957.8An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary cod CVE-2017-05967.8An elevation of privilege vulnerability in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary cod CVE-2017-05977.8An elevation of privilege vulnerability in Audioserver could enable a local malicious application to execute arbitrary code within the conte CVE-2017-05985.5An information disclosure vulnerability in the Framework APIs could enable a local malicious application to bypass operating system protecti CVE-2017-05995.5A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a devic CVE-2017-06005.5A remote denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause CVE-2017-06015.5An Elevation of Privilege vulnerability in Bluetooth could potentially enable a local malicious application to accept harmful files shared v