CVE-2017-13257

MEDIUM

Android 5.1.1-8.1 - Use-After-Free in bta_pan_data_buf_ind_cback

Title source: llm

Description

In bta_pan_data_buf_ind_cback of bta_pan_act.cc there is a use after free that can result in an out of bounds read of memory allocated via malloc. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67110692.

References (2)

Core 2

Core References

Vendor Advisory x_refsource_confirm

https://source.android.com/security/bulletin/2018-03-01

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/103253

Scores

CVSS v3 6.5

EPSS 0.0076

EPSS Percentile 50.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Details

CWE

CWE-416

Status published

Products (8)

google/android 5.1.1

google/android 6.0

google/android 6.0.1

google/android 7.0

google/android 7.1.1

google/android 7.1.2

google/android 8.0

google/android 8.1

Published Apr 04, 2018

Tracked Since Feb 18, 2026