CVE-2014-7911 in Google Android
Sumário (Inglês)
luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.
Reservar
06/10/2014
Divulgação
15/12/2014
Inscrições
VulDB provides additional information and datapoints for this CVE:
| ID | Vulnerabilidade | CWE | Exp | Con | CVE |
|---|---|---|---|---|---|
| 68250 | Google Android ObjectInputStream Elevação de Privilégios | 264 | Prova de conceito | Correção oficial | CVE-2014-7911 |