CVE-2017-8184 Information disclosure in Nice-AL00

Medium 5.5 Published 22 Nov 2017 Updated 16 Sep 2024

An attacker can leak sensitive information by tricking a user into installing a malicious app that triggers arbitrary memory access on Huawei smartphones.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Local or same network only
Victim action needed: A user has to click or open something
Fix: None listed

What is CVE-2017-8184?

CVE-2017-8184 is a medium-severity vulnerability in Huawei Technologies Co., Ltd. Nice-AL00, published on 22 Nov 2017. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.

Official description

MTK platform in Huawei smart phones with software of earlier than Nice-AL00C00B160 versions, earlier than Nice-AL10C00B140 versions has a any memory access vulnerability. An attacker tricks a user into installing a malicious application on the smart phone, and send given parameter to cause to any memory access vulnerabilities, leading to sensitive information leakage.

Weakness: CWE-119

Which versions are affected by CVE-2017-8184?

It affects 1 product.

Products include Huawei Mtk Platform Smart Phone Firmware.

How do I fix CVE-2017-8184?

No fix has been published for CVE-2017-8184 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-8184 being exploited?

There is no known exploitation of CVE-2017-8184 in the wild and no public exploit code.

Sources

Also known as GHSA-m9qj-8whm-9cg3.