NVD

Id
35190  
Name
CVE-2014-7911  
Description
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.  
Reject
 
CVSS Version
2  
CVSS Score
7.2  
Severity
High  
CVSS Base Score
7.2  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-19  
Published
2014-12-15  
Modified Date
2014-12-16  
Seq
2014-7911  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
180096 35190 CVE-2014-7911 20141119 CVE-2014-7911: Android <5.0 Privilege Escalation using ObjectInputStream  View
180097 35190 CVE-2014-7911 https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18350 JVNDB-2014-007225 Android の java.io.ObjectInputStream の実装の luni/src/main/java/java/io/ObjectInputStream.java における任意のコードを実行される脆弱性 Android の java.io.ObjectInputStream の実装の luni/src/main/java/java/io/ObjectInputStream.java は、デシリアライズが、シリアライズするための要件に適合するオブジェクトをもたらすことを検証しないため、任意のコードを実行される脆弱性が存在します。 CVE-2014-7911 75204 CVE-2014-7911 35190 7.2 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007225.html 2014-06-30 2014-12-17 View