CVE-2017-0663

HIGH

Android 4.4.4 5.0.2 5.1.1 6.0 6.0.1 7.0 7.1.1 7.1.2 - Remote Code Execution via libxml2 Out-of-bounds Write

Title source: llm

Description

A remote code execution vulnerability in libxml2 could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses this library. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37104170.

References (7)

Core 7

Core References

Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2017-06-01

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2017/dsa-3952

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/98877

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201711-01

Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack

http://www.securitytracker.com/id/1038623

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Mailing List mailing-list x_refsource_mlist

https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

Scores

CVSS v3 7.8

EPSS 0.0089

EPSS Percentile 75.8%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-787

Status published

Products (9)

google/android 4.4.4

google/android 5.0.2

google/android 5.1.1

google/android 6.0

google/android 6.0.1

google/android 7.0

google/android 7.1.1

google/android 7.1.2

Google Inc./Android Android-4.4.4 Android-5.0.2 Android-5.1.1 Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Androi

Published Jun 14, 2017

Tracked Since Feb 18, 2026