CVE-2017-0554
Last modified
CVE-2017-0554 is a vulnerability of currently unknown severity. An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to access capabilities outside of its permission levels. This issue is rated as Moderate because it could be used to gain access to elevated capabilities, which are not normally accessible to a third-party application. EPSS estimates a 1.01% chance of exploitation in the next 30 days.
Description
An elevation of privilege vulnerability in the Telephony component could enable a local malicious application to access capabilities outside of its permission levels. This issue is rated as Moderate because it could be used to gain access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33815946.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 4.0 | |
| Android | 4.0.1 | |
| Android | 4.0.2 | |
| Android | 4.0.3 | |
| Android | 4.0.4 | |
| Android | 4.1 | |
| Android | 4.1.2 | |
| Android | 4.2 | |
| Android | 4.2.1 | |
| Android | 4.2.2 | |
| Android | 4.3 | |
| Android | 4.3.1 | |
| Android | 4.4 | |
| Android | 4.4.1 | |
| Android | 4.4.2 | |
| Android | 4.4.3 | |
| Android | 4.4.4 | |
| Android | 5.0 | |
| Android | 5.0.1 | |
| Android | 5.0.2 | |
| Android | 5.1 | |
| Android | 5.1.0 | |
| Android | 5.1.1 | |
| Android | 6.0 | |
| Android | 6.0.1 | |
| Android | 7.0 | |
| Android | 7.1.0 | |
| Android | 7.1.1 |
References
- http://www.securityfocus.com/bid/97343Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2017-04-01Vendor Advisory
- http://www.securityfocus.com/bid/97343Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2017-04-01Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2017-0554?
How severe is CVE-2017-0554?
How do I fix CVE-2017-0554?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2017
- CVE-2017-0548A remote denial of service vulnerability in libskia could en…
- CVE-2017-0549A remote denial of service vulnerability in libavc in Medias…
- CVE-2017-0550A remote denial of service vulnerability in libavc in Medias…
- CVE-2017-0551A remote denial of service vulnerability in libavc in Medias…
- CVE-2017-0552A remote denial of service vulnerability in libavc in Medias…
- CVE-2017-0553An elevation of privilege vulnerability in libnl could enabl…
- CVE-2017-0555An information disclosure vulnerability in libavc in Mediase…
- CVE-2017-0556An information disclosure vulnerability in libmpeg2 in Media…
- CVE-2017-0557An information disclosure vulnerability in libmpeg2 in Media…
- CVE-2017-0558An information disclosure vulnerability in Mediaserver could…
- CVE-2017-0559An information disclosure vulnerability in libskia could ena…
- CVE-2017-0560An information disclosure vulnerability in the factory reset…
Are you affected by CVE-2017-0554?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST