CVE-2017-13314

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In setAllowOnlyVpnForUids of NetworkManagementService.java, there is a possible security settings bypass due to a missing permission check. This could lead to local escalation of privilege allowing users to access non-VPN networks, when they are supposed to be restricted to the VPN networks, with no additional execution privileges needed. User interaction is not needed for exploitation.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862CWE-276

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2017

CVE-2017-133157.8In writeToParcel and createFromParcel of DcParamObject.java, there is a permission bypass due to a write size mismatch. This could lead to aCVE-2017-133167.8In checkPermissions of RecognitionService.java, there is a possible permissions bypass due to a missing permission check. This could lead toCVE-2017-133175.7In HeifDecoderImpl::getScanline of HeifDecoderImpl.cpp, there is a possible out of bounds read due to improper input validation. This could CVE-2017-133185.7In HeifDataSource::readAt of HeifDecoderImpl.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remoCVE-2017-133197.5In pvmp3_get_main_data_size of pvmp3_get_main_data_size.cpp, there is a possible buffer overread due to a missing bounds check. This could lCVE-2017-13326.1IBM iNotes 8.5 and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web CVE-2017-133206.5In impeg2d_bit_stream_flush() of libmpeg2dec there is a possible OOB read due to a missing bounds check. This could lead to Remote DoS with CVE-2017-133215.5In SensorService::isDataInjectionEnabled of frameworks/native/services/sensorservice/SensorService.cpp, there is a possible out of bounds reCVE-2017-133225.5In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error CVE-2017-133237.8In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privCVE-2017-13335.3IBM OpenPages GRC Platform 7.1, 7.2, and 7.3 could allow an unauthenticated user to obtain sensitive information about the server that couldCVE-2017-13345.4IBM RELM 4.0, 5.0, and 6.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the