CVE-2017-13194 Memory corruption in Android
A flaw in the Android media framework's libvpx library allows attackers to execute arbitrary code or escalate privileges via crafted media files.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-13194?
CVE-2017-13194 is a high-severity memory corruption vulnerability in Debian Debian Linux, published on 12 Jan 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.
Weakness: CWE-20
Which versions are affected by CVE-2017-13194?
It affects 2 products.
Linux distribution packages (11)
libvpx SUSE:Linux Enterprise Desktop 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Desktop 12 SP3 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Server 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Server 12 SP3 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Software Development Kit 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Software Development Kit 12 SP3 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Workstation Extension 12 SP2 | All versions | 1.3.0-3.3.1 |
libvpx SUSE:Linux Enterprise Workstation Extension 12 SP3 | All versions | 1.3.0-3.3.1 |
Products include Debian Debian Linux, Google Android.
How do I fix CVE-2017-13194?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-13194 being exploited?
There is no known exploitation of CVE-2017-13194 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as DEBIAN-CVE-2017-13194, DLA-1290-1, DSA-4132-1, GHSA-9g26-5wqj-4px2, MGASA-2018-0112, SUSE-SU-2018:0181-1 and 1 more.