Improper input validation in Google Android
CVE-2015-6783
The FindStartOffsetOfFileInZipFile function in crazy_linker_zip.cpp in crazy_linker (aka Crazy Linker) in Android 5.x and 6.x, as used in Google Chrome before 47.0.2526.73, improperly searches for an EOCD record, which allows attackers to bypass a signature-validation requirement via a crafted ZIP archive.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.012 (65.9th percentile) — read the EPSS interpretation.
Affected products
- Google Android — versions 5.0, 6.0
- Google Chrome
- N/a — versions n/a
Weakness classification (CWE)
References
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_SUSE)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_GENTOO)
- chrome-cve-admin@google.com (vdb-entry, x_refsource_BID)
- chrome-cve-admin@google.com (x_refsource_CONFIRM)
- chrome-cve-admin@google.com (vendor-advisory, x_refsource_SUSE)
- chrome-cve-admin@google.com (vdb-entry, x_refsource_SECTRACK)