CVE-2017-13206 - Vulnerability Details

Vendors	Products
Google	Android

Link	Providers
http://www.securityfocus.com/bid/102523
https://source.android.com/security/bulletin/pixel/2018-01-01

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "Android", "vendor": "Google Inc.", "versions": [{"status": "affected", "version": "5.1.1"}, {"status": "affected", "version": "6.0"}, {"status": "affected", "version": "6.0.1"}, {"status": "affected", "version": "7.0"}, {"status": "affected", "version": "7.1.1"}, {"status": "affected", "version": "7.1.2"}, {"status": "affected", "version": "8.0"}, {"status": "affected", "version": "8.1"}]}], "datePublic": "2018-01-02T00:00:00", "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048."}], "problemTypes": [{"descriptions": [{"description": "Information disclosure", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-17T10:57:01", "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6", "shortName": "google_android"}, "references": [{"name": "102523", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/102523"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://source.android.com/security/bulletin/pixel/2018-01-01"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security@android.com", "DATE_PUBLIC": "2018-01-02T00:00:00", "ID": "CVE-2017-13206", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Android", "version": {"version_data": [{"version_value": "5.1.1"}, {"version_value": "6.0"}, {"version_value": "6.0.1"}, {"version_value": "7.0"}, {"version_value": "7.1.1"}, {"version_value": "7.1.2"}, {"version_value": "8.0"}, {"version_value": "8.1"}]}}]}, "vendor_name": "Google Inc."}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Information disclosure"}]}]}, "references": {"reference_data": [{"name": "102523", "refsource": "BID", "url": "http://www.securityfocus.com/bid/102523"}, {"name": "https://source.android.com/security/bulletin/pixel/2018-01-01", "refsource": "CONFIRM", "url": "https://source.android.com/security/bulletin/pixel/2018-01-01"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:58:12.619Z"}, "title": "CVE Program Container", "references": [{"name": "102523", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/102523"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://source.android.com/security/bulletin/pixel/2018-01-01"}]}]}, "cveMetadata": {"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6", "assignerShortName": "google_android", "cveId": "CVE-2017-13206", "datePublished": "2018-01-12T23:00:00Z", "dateReserved": "2017-08-23T00:00:00", "dateUpdated": "2024-09-17T01:36:29.843Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : Android (string)

vendor : Google Inc. (string)

versions : [ »

0 : { »

status : affected (string)

version : 5.1.1 (string)

}

1 : { »

status : affected (string)

version : 6.0 (string)

}

2 : { »

status : affected (string)

version : 6.0.1 (string)

}

3 : { »

status : affected (string)

version : 7.0 (string)

}

4 : { »

status : affected (string)

version : 7.1.1 (string)

}

5 : { »

status : affected (string)

version : 7.1.2 (string)

}

6 : { »

status : affected (string)

version : 8.0 (string)

}

7 : { »

status : affected (string)

version : 8.1 (string)

}

]

}

]

datePublic : 2018-01-02T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Information disclosure (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-01-17T10:57:01 (string)

orgId : baff130e-b8d5-4e15-b3d3-c3cf5d5545c6 (string)

shortName : google_android (string)

}

references : [ »

0 : { »

name : 102523 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/102523 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : security@android.com (string)

DATE_PUBLIC : 2018-01-02T00:00:00 (string)

ID : CVE-2017-13206 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : Android (string)

version : { »

version_data : [ »

0 : { »

version_value : 5.1.1 (string)

}

1 : { »

version_value : 6.0 (string)

}

2 : { »

version_value : 6.0.1 (string)

}

3 : { »

version_value : 7.0 (string)

}

4 : { »

version_value : 7.1.1 (string)

}

5 : { »

version_value : 7.1.2 (string)

}

6 : { »

version_value : 8.0 (string)

}

7 : { »

version_value : 8.1 (string)

}

]

}

]

}

vendor_name : Google Inc. (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : Information disclosure (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : 102523 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/102523 (string)

}

1 : { »

name : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

refsource : CONFIRM (string)

url : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T18:58:12.619Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : 102523 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/102523 (string)

}

1 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : baff130e-b8d5-4e15-b3d3-c3cf5d5545c6 (string)

assignerShortName : google_android (string)

cveId : CVE-2017-13206 (string)

datePublished : 2018-01-12T23:00:00Z (string)

dateReserved : 2017-08-23T00:00:00 (string)

dateUpdated : 2024-09-17T01:36:29.843Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "B1D94CDD-DE7B-444E-A3AE-AE9C9A779374", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*", "matchCriteriaId": "E70C6D8D-C9C3-4D92-8DFC-71F59E068295", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*", "matchCriteriaId": "691FA41B-C2CE-413F-ABB1-0B22CB322807", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*", "matchCriteriaId": "09E6085C-A61E-4A89-BF80-EDD9A7DF1E47", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "D835D592-2423-44C6-804A-3AD010112E7C", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "568E2561-A068-46A2-B331-BBA91FC96F0C", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:*", "matchCriteriaId": "B578E383-0D77-4AC7-9C81-3F0B8C18E033", "vulnerable": true}, {"criteria": "cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:*", "matchCriteriaId": "B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048."}, {"lang": "es", "value": "Existe una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en el media framework de Android (aacdec). Producto: Android. Versiones: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048."}], "id": "CVE-2017-13206", "lastModified": "2024-11-21T03:11:09.520", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.0"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-01-12T23:29:01.500", "references": [{"source": "security@android.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102523"}, {"source": "security@android.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://source.android.com/security/bulletin/pixel/2018-01-01"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/102523"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://source.android.com/security/bulletin/pixel/2018-01-01"}], "sourceIdentifier": "security@android.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:google:android:5.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : B1D94CDD-DE7B-444E-A3AE-AE9C9A779374 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* (string)

matchCriteriaId : E70C6D8D-C9C3-4D92-8DFC-71F59E068295 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:* (string)

matchCriteriaId : 691FA41B-C2CE-413F-ABB1-0B22CB322807 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:* (string)

matchCriteriaId : 09E6085C-A61E-4A89-BF80-EDD9A7DF1E47 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:* (string)

matchCriteriaId : D835D592-2423-44C6-804A-3AD010112E7C (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:* (string)

matchCriteriaId : 568E2561-A068-46A2-B331-BBA91FC96F0C (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* (string)

matchCriteriaId : B578E383-0D77-4AC7-9C81-3F0B8C18E033 (string)

vulnerable : true (boolean)

}

7 : { »

criteria : cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* (string)

matchCriteriaId : B06BE74B-83F4-41A3-8AD3-2E6248F7B0B2 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048. (string)

}

1 : { »

lang : es (string)

value : Existe una vulnerabilidad de revelación de información en el media framework de Android (aacdec). Producto: Android. Versiones: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65025048. (string)

}

]

id : CVE-2017-13206 (string)

lastModified : 2024-11-21T03:11:09.520 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : LOW (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : NONE (string)

baseScore : 5 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : NONE (string)

vectorString : AV:N/AC:L/Au:N/C:P/I:N/A:N (string)

version : 2.0 (string)

}

exploitabilityScore : 10 (number)

impactScore : 2.9 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.0 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2018-01-12T23:29:01.500 (string)

references : [ »

0 : { »

source : security@android.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/102523 (string)

}

1 : { »

source : security@android.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/102523 (string)

}

3 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://source.android.com/security/bulletin/pixel/2018-01-01 (string)

}

]

sourceIdentifier : security@android.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-200 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object