Integer Overflow in Google Android SDK Allows Remote Code Execution
CVE-2008-0986

Currently unrated

Key Information:

Vendor

Google
Status
Android Sdk
Vendor
CVE Published:
6 March 2008

What is CVE-2008-0986?

The Google Android SDK has a vulnerability in the BMP::readFromStream method within the libsgl.so library. This issue permits remote attackers to execute arbitrary code by leveraging a specially crafted BMP file containing a header with a negative offset field. This vulnerability impacts versions m3-rc37a and earlier, as well as m5-rc14 of the Android SDK, potentially allowing attackers to gain control over affected systems.

References

http://securityreason.com/securityalert/3727
third-party-advisoryx_refsource_SREASON
http://www.coresecurity.com/?action=item&id=2148
x_refsource_MISC
https://exchange.xforce.ibmcloud.com/vulnerabilities/40999
vdb-entryx_refsource_XF

EPSS Score

9% chance of being exploited in the next 30 days.

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.