What is CVE-2011-3874?

CVE-2011-3874 is a vulnerability in Google Android, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2012-01-27.

Is CVE-2011-3874 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Buffer overflow in Google Android

CVE-2011-3874

Stack-based buffer overflow in libsysutils in Android 2.2.x through 2.2.2 and 2.3.x through 2.3.6 allows user-assisted remote attackers to execute arbitrary code via an application that calls the FrameworkListener::dispatchCommand method with the wrong number of arguments, as demonstrated by zergRush to trigger a use-after-free error.

Vulnerability class: Buffer Overflow

EPSS: 0.115 (95.6th percentile) — read the EPSS interpretation.

Affected products

Google Android — versions 2.2, 2.2.1, 2.2.2
N/a — versions n/a

Weakness classification (CWE)

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer

Public proof-of-concept exploits

References

chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST)
chrome-cve-admin@google.com (x_refsource_MISC)
chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST)
chrome-cve-admin@google.com (x_refsource_CONFIRM)
chrome-cve-admin@google.com (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2011-3874?: CVE-2011-3874 is a vulnerability in Google Android, classified under Improper Restriction of Operations within the Bounds of a Memory Buffer. Published 2012-01-27.
Is CVE-2011-3874 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.