« Volver al listado

CVE-2011-1001

Estado: ModificadaMedia (4.3)—

dexdump in Android SDK before 2.3 does not properly perform structural verification, which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute arbitrary code via a malformed APK or dex file that calls a method using more arguments than the number of register that have been declared for that method.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Google — Android SDK

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2011-1001",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2011-07-08T17:55:00.960",
  "references": [
    {
      "url": "http://android.git.kernel.org/?p=platform/dalvik.git%3Ba=commit%3Bh=4b0750e8df91220690bb417f45d7ae8b7851b220",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Mar/329",
      "source": "secalert@redhat.com"
    },
    {
      "url": "http://android.git.kernel.org/?p=platform/dalvik.git%3Ba=commit%3Bh=4b0750e8df91220690bb417f45d7ae8b7851b220",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://seclists.org/fulldisclosure/2011/Mar/329",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "dexdump in Android SDK before 2.3 does not properly perform structural verification, which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute arbitrary code via a malformed APK or dex file that calls a method using more arguments than the number of register that have been declared for that method."
    },
    {
      "lang": "es",
      "value": "dexdump en Android SDK antes de v2.3 no realiza correctamente la verificación estructural, lo que permite a atacantes remotos asistidos por el usuario provocar una denegación de servicio (caída de dexdump) y posiblemente ejecutar código de su elección a través de un archivo APK o dex mal formado que llama a un método usando mas argumentos que el número que ha sido declarado para ese método."
    }
  ],
  "lastModified": "2026-06-16T23:28:31.700",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:google:android_sdk:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "78801896-CCF5-4020-9AF3-F0C46C51BFF9",
              "versionEndIncluding": "2.2"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0DB46A7A-8BA6-43C7-97A6-ECA620D21A1A"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:1.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D4839F4-53B9-4744-8EF1-CECBADCA9916"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89184F6B-3367-4808-B76F-1F95FBC08B38"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "699EC2A8-1CD3-4DFA-86BC-18E2D5533AC2"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:2.0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8DE3392E-FD2A-4081-9D84-7C014E98BEE1"
            },
            {
              "criteria": "cpe:2.3:a:google:android_sdk:2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7D71C1A6-930F-43C3-8B16-77BE5C14BF81"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secalert@redhat.com"
}