CVE-2017-0420

MEDIUM

Android 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 - Information Disclosure in AOSP Mail

Title source: llm
STIX 2.1

Description

An information disclosure vulnerability in AOSP Mail could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32615212.

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96093
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1037798

Scores

CVSS v3 5.5
EPSS 0.0010
EPSS Percentile 26.7%
Attack Vector LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE
CWE-200
Status published
Products (35)
google/android 4.0
google/android 4.0.1
google/android 4.0.2
google/android 4.0.3
google/android 4.0.4
google/android 4.1
google/android 4.1.2
google/android 4.2
google/android 4.2.1
google/android 4.2.2
... and 25 more
Published Feb 08, 2017
Tracked Since Feb 18, 2026