In ParseContentEncodingEntry of mkvparser.cc, there is a possible double free due to a missing reset of a freed pointer. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-127702368.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libvpx-develUpgrade libvpx | May 4, 2022 | Aug 20, 2019 |
| Centos_linux | — | Upgrade libvpx-debuginfoUpgrade libvpx-debugsourceUpgrade libvpx-utils-debuginfoUpgrade libvpx | Nov 5, 2020 | Aug 20, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libvpx | Aug 31, 2020 | Aug 20, 2019 |
| Oracle_linux | — | Upgrade libvpx-develUpgrade libvpx | Nov 12, 2020 | Oct 26, 2019 |
| Redhat_linux | — | Upgrade libvpxUpgrade libvpx-debugsourceUpgrade libvpx-debuginfoNo solution existsUpgrade libvpx-develUpgrade libvpx-utils-debuginfo | Nov 5, 2020 | Aug 20, 2019 |
| Rocky_linux | — | Upgrade libvpxUpgrade libvpx-develUpgrade libvpx-debugsourceUpgrade libvpx-debuginfo | Mar 12, 2024 | Aug 20, 2019 |
| Suse | — | Upgrade libvpx4-32bitUpgrade libvpx-develUpgrade vpx-toolsUpgrade libvpx4 | Jan 21, 2020 | Aug 20, 2019 |
| Ubuntu | — | Upgrade libvpx5Upgrade godot3Upgrade libvpx3Upgrade godot3 (Ubuntu Pro)Upgrade godot3-runner (Ubuntu Pro)Upgrade godot3-runner | Nov 26, 2019 | Aug 20, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub