In the deserialization constructor of NanoAppFilter.java, there is a possible loss of data due to type confusion. This could lead to local escalation of privilege in the system server with no additional execution privileges needed. User interaction is not needed for exploitation.
References
| Link | Resource |
|---|---|
| https://source.android.com/security/bulletin/2018-09-01 | Patch Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
17 Jun 2026, 02:06
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (es) En el constructor de deserialización de NanoAppFilter.java, existe una posible pérdida de datos debido a una confusión de tipos. Esto podría llevar a una escalada local de privilegios en el servidor del sistema sin necesidad de privilegios de ejecución adicionales. No se requiere interacción del usuario para su explotación. |
18 Dec 2024, 16:50
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-843 | |
| CPE | cpe:2.3:o:google:android:8.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.1.1:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:9.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:8.0:*:*:*:*:*:*:* cpe:2.3:o:google:android:7.1.2:*:*:*:*:*:*:* |
|
| First Time |
Google
Google android |
|
| References | () https://source.android.com/security/bulletin/2018-09-01 - Patch, Vendor Advisory | |
| Summary |
|
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
20 Nov 2024, 19:35
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
20 Nov 2024, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-11-20 18:15
Updated : 2026-06-17 02:06
NVD link : CVE-2018-9471
Mitre link : CVE-2018-9471
CVE.ORG link : CVE-2018-9471
JSON object : View
Products Affected
- android