SB2014121504 - Security restrictins bypass in Google Android 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2014121504

SB2014121504 - Security restrictins bypass in Google Android

Published: December 15, 2014 Updated: October 5, 2020

Security Bulletin ID SB2014121504
Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2014-7911)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.


Remediation

Install update from vendor's website.

References