CVE-2017-13194: debian debian_linux Improper Input Validation
CVSS: 7.8v2.0HighModified
AliasesMGASA-2018-0112SUSE-SU-2018:0181-1UBUNTU-CVE-2017-13194DEBIAN-CVE-2017-13194DLA-1290-1DSA-4132-1
Published 12-01-2018Last modified 17-09-2024
Vulnerability summary
CVE-2017-13194 is a high (CVSS 7.8) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 1.80% chance of exploitation in the next 30 days, higher than 78.2% of scored vulnerabilities.
CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
1.80%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3 · Related 3Timeline
- 12-01-2018PublishedVulnerability first disclosed.
- 17-09-2024Last modifiedVulnerability information updated.
Description
A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-64710201.
CVSS metrics
4 scores · 3 sources · 2 versionsHigh 7.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
1.80%
Chance of exploitation in the next 30 days
Percentile
78%
Versus all other CVEs
30-day change
0.00 pp
From 1.80% on 20-09-2026
20-09-202620-10-2026
EPSS score1.80%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Suse11 products
- libvpx&distro=SUSE Linux Enterprise Desktop 12 SP2< 1.3.0-3.3.1
- libvpx&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.3.0-3.3.1
- libvpx&distro=SUSE Linux Enterprise Server 12 SP2< 1.3.0-3.3.1
- libvpx&distro=SUSE Linux Enterprise Server 12 SP3< 1.3.0-3.3.1
- libvpx&distro=SUSE Linux Enterprise Server for Raspberry Pi 12 SP2< 1.3.0-3.3.1
Debian2 products
- libvpx< 1.7.0-2 | < 1.3.0-3+deb8u1 | < 1.6.1-3+deb9u1 | < 1.1.0-1+deb7u1
- debian_linuxEOL7.0 | 8.0 | 9.0
Mageia2 products
- libvpx< 1.3.0-3.2.mga5
- libvpx< 1.5.0-3.1.mga6
Google1 product
- androidEOL5.1.1 | 6.0 | 6.0.1 | 7.0 | 7.1.1 | 7.1.2 | 8.0 | 8.1
Google inc.1 product
- android7.0 | 7.1.1 | 7.1.2 | 8.0 | 8.1
Ubuntu1 product
- libvpx< 1.3.0-2ubuntu0.1~esm1 | < 1.5.0-2ubuntu1.1
6 vendors · 18 products
References
17 links- android.googlesource.com/platform/external/libvpx/+/55cd1dd7c8d0a3de907d22e0f12718733f4e41d9X Refsource CONFIRMPatchVendor AdvisoryREPORT
lists.debian.org/debian-lts-announce/2018/02/msg00025.htmlMailing ListX Refsource MLISTThird Party Advisory