In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libvpxUpgrade libvpx-devel | May 4, 2022 | Aug 20, 2019 |
| Centos_linux | — | Upgrade libvpx-debugsourceUpgrade libvpx-utils-debuginfoUpgrade libvpxUpgrade libvpx-debuginfo | Nov 5, 2020 | Aug 20, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvpx | Aug 31, 2020 | Aug 20, 2019 |
| Oracle_linux | — | Upgrade libvpxUpgrade libvpx-devel | Nov 12, 2020 | Oct 26, 2019 |
| Redhat_linux | — | No solution existsUpgrade libvpx-debugsourceUpgrade libvpx-debuginfoUpgrade libvpx-utils-debuginfoUpgrade libvpx-develUpgrade libvpx | Nov 5, 2020 | Aug 20, 2019 |
| Rocky_linux | — | Upgrade libvpxUpgrade libvpx-develUpgrade libvpx-debugsourceUpgrade libvpx-debuginfo | Mar 12, 2024 | Aug 20, 2019 |
| Suse | — | Upgrade libvpx4Upgrade libvpx-develUpgrade libvpx4-32bitUpgrade vpx-tools | Jan 21, 2020 | Aug 20, 2019 |
| Ubuntu | — | Upgrade godot3Upgrade godot3 (Ubuntu Pro)Upgrade libvpx5Upgrade libvpx3Upgrade godot3-runnerUpgrade godot3-runner (Ubuntu Pro) | Nov 26, 2019 | Aug 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub