CVE-2017-0420
Google Inc. Android
MEDIUM 5.5
En bref
- Source
- NVD
- EPSS
- EPSS 0.65 % · centile 51 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- google_android
- Statut NVD
- Modified
Description
An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32615212.
Faiblesses (CWE)
- CWE-200 — Exposition d'informations sensibles à un acteur non autorisé
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | MEDIUM 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2017-0774
- GCVE · GCVE-0-2017-0420
Avis du CERT-FR
- CERTFR-2017-AVI-040 — Multiples vulnérabilités dans Google Android (Nexus) · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:*cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.0.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Google Inc. · Android | affected Android-4.4.4 ; affected Android-5.0.2 ; affected Android-5.1.1 ; affected Android-6.0 ; affected Android-6.0.1 ; affected Android-7.0 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |