| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.6 | $5k-$25k | 0.00 |
Summary
A vulnerability identified as problematic has been detected in Google Android. The affected element is an unknown function of the component Qualcomm Audio. The manipulation leads to use after free. This vulnerability is listed as CVE-2018-11962. The attack must be carried out locally. There is no available exploit. It is suggested to install a patch to address this issue.
Details
A vulnerability was found in Google Android (Smartphone Operating System) (affected version not known) and classified as critical. This issue affects some unknown functionality of the component Qualcomm Audio. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability.
The bug was discovered 01/07/2019. The weakness was presented 01/07/2019 as Android Security Bulletin - January 2019 as confirmed security bulletin (Website). The advisory is shared at source.android.com. The identification of this vulnerability is CVE-2018-11962 since 06/07/2018. The exploitation is known to be easy. An attack has to be approached locally. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 07/04/2023). It is expected to see the exploit prices for this product increasing in the near future.
Applying a patch is able to eliminate this problem. A possible mitigation has been published even before and not after the disclosure of the vulnerability.
See VDB-130412, VDB-130413, VDB-130414 and VDB-130415 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Vendor
Name
License
Website
- Vendor: https://www.google.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.8VulDB Meta Temp Score: 7.6
VulDB Base Score: 7.8
VulDB Temp Score: 7.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 7.8
NVD Vector: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Use after freeCWE: CWE-416 / CWE-119
CAPEC: 🔍
ATT&CK: 🔍
Physical: Partially
Local: Yes
Remote: No
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Timeline
06/07/2018 🔍01/05/2019 🔍
01/07/2019 🔍
01/07/2019 🔍
02/04/2019 🔍
07/04/2023 🔍
Sources
Vendor: google.comAdvisory: Android Security Bulletin - January 2019
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2018-11962 (🔍)
GCVE (CVE): GCVE-0-2018-11962
GCVE (VulDB): GCVE-100-130433
SecurityFocus: 106496
scip Labs: https://www.scip.ch/en/?labs.20150917
See also: 🔍
Entry
Created: 02/04/2019 08:45Updated: 07/04/2023 14:20
Changes: 02/04/2019 08:45 (59), 05/07/2020 16:27 (3), 07/04/2023 14:20 (5)
Complete: 🔍
Cache ID: 216::103
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
No comments yet. Languages: en.
Please log in to comment.