Possible Out-of-Bounds Write in ClearKeyCasPlugin.cpp Could Lead to Remote Arbitrary Code Execution
CVE-2018-9411

8.8HIGH

Key Information:

Vendor

Google
Status
Android
Vendor
CVE Published:
19 November 2024

What is CVE-2018-9411?

An out-of-bounds write vulnerability exists in the ClearKeyCasPlugin.cpp component of the Android Media Framework. The flaw is due to a missing bounds check during the decryption process. This security issue may allow an attacker to execute arbitrary code from a remote location, provided that the user interacts with a malicious entity. The vulnerability underscores the importance of verifying secure coding practices to mitigate potential exploitation risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Android 8

Android 8.1

Android 9

References

https://source.android.com/security/bulletin/2018-07-01

EPSS Score

7% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.