CVE-2017-11079
CRITICALAndroid - Exposure of Sensitive Information via Uninitialized Heap Memory in Sparse Image Processing
Title source: llmDescription
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing sparse image, uninitialized heap memory can potentially be flashed due to the lack of validation of sparse image block header size.
References (1)
Core 1
Core References
Patch, Vendor Advisory x_refsource_confirm
https://source.android.com/security/bulletin/pixel/2018-01-01
Scores
CVSS v3
9.8
EPSS
0.0044
EPSS Percentile
35.4%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-200
Status
published
Products (1)
google/android
Published
Jan 10, 2018
Tracked Since
Feb 18, 2026