CVE-2018-9471
En bref Sévérité CRITICAL 9.8 EPSS EPSS 0.17 % · centile 6 (2026-10-27) État PUBLISHED Publiée 2024-11-20 Mise à jour 2024-11-20 Attribuée par google_android Statut NVD Analyzed Description In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.
Scores Version Score Vecteur Évalué par CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CISA-ADP CVSS 3.1 HIGH 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H NVD · nvd@nist.gov (Primary) CVSS 3.1 CRITICAL 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
Faiblesses (CWE)
Références européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:*Produits affectés Produit Versions Google · Android affected 7 ; affected 8 ; affected 8.1 ; affected 9 ; affected nyc-mr1-dev ; affected nyc-mr2-dev
Références
Sources
