CVE-2017-13228

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Feb 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-132299.8A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-6 CVE-2017-132308.8In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead CVE-2017-132317.8In libmediadrm, there is an out-of-bounds write due to improper input validation. This could lead to local elevation of privileges with no a CVE-2017-132327.5In audioserver, there is an out-of-bounds write due to a log statement using %s with an array that may not be NULL terminated. This could le CVE-2017-132336.5In ihevcd_ctb_boundary_strength_pbslice of libhevc, there is possible resource exhaustion. This could lead to a remote temporary denial of s CVE-2017-132346.5In DLSParser of the sonivox library, there is possible resource exhaustion due to a memory leak. This could lead to remote temporary denial CVE-2017-132356.5A other vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68342866.CVE-2017-132367.8In the KeyStore service, there is a permissions bypass that allows access to protected resources. This could lead to local escalation of pri CVE-2017-132384.2In XBLRamDump mode, there is a debug feature that can be used to dump memory contents, if an attacker has physical access to the device. Thi CVE-2017-132397.5A information disclosure vulnerability in the Android framework (ui framework). Product: Android. Versions: 8.0. ID: A-66244132.CVE-2017-13245.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the CVE-2017-132407.5A information disclosure vulnerability in the Android framework (crypto framework). Product: Android. Versions: 8.0, 8.1. ID: A-68694819.