CNVD-2015-05561

Vulnerability from cnvd - Published: 2015-09-29
VLAI Severity ?
Title
小米生活安卓最新版App存在本地拒绝服务漏洞
Description
小米生活安卓最新版App（V3.1.550）存在本地拒绝服务漏洞 由于外部恶意程序调用com.xiaomi.o2o.activity.InternalSingleWebActivity组件，允许攻击者利用漏洞使小米生活安卓端全局崩溃。
Severity
低
Patch Name
小米生活安卓最新版App存在本地拒绝服务漏洞
Patch Description
CNVD确认所述情况，已由CNVD通过网站管理方公开联系渠道向其邮件通报，由其后续提供解决方案并协调相关用户单位处置。
Formal description

修复建议：注册的组件请严格校验输入参数，注意空值判定和类型转换判断，防止由于异常输入导致的应用崩溃。

Impacted products
Name
北京小米科技有限责任公司 小米生活安卓最新版 3.1.550
Show details on source website
To clipboard 

{
  "description": "\u5c0f\u7c73\u751f\u6d3b\u5b89\u5353\u6700\u65b0\u7248App\uff08V3.1.550\uff09\u5b58\u5728\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e \r\n\r\n\u7531\u4e8e\u5916\u90e8\u6076\u610f\u7a0b\u5e8f\u8c03\u7528com.xiaomi.o2o.activity.InternalSingleWebActivity\u7ec4\u4ef6\uff0c\u5141\u8bb8\u653b\u51fb\u8005\u5229\u7528\u6f0f\u6d1e\u4f7f\u5c0f\u7c73\u751f\u6d3b\u5b89\u5353\u7aef\u5168\u5c40\u5d29\u6e83\u3002",
  "discovererName": "\u5b89\u7136\u610f\u5883",
  "formalWay": "\u4fee\u590d\u5efa\u8bae\uff1a\u6ce8\u518c\u7684\u7ec4\u4ef6\u8bf7\u4e25\u683c\u6821\u9a8c\u8f93\u5165\u53c2\u6570\uff0c\u6ce8\u610f\u7a7a\u503c\u5224\u5b9a\u548c\u7c7b\u578b\u8f6c\u6362\u5224\u65ad\uff0c\u9632\u6b62\u7531\u4e8e\u5f02\u5e38\u8f93\u5165\u5bfc\u81f4\u7684\u5e94\u7528\u5d29\u6e83\u3002",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2015-05561",
  "openTime": "2015-09-29",
  "patchDescription": "CNVD\u786e\u8ba4\u6240\u8ff0\u60c5\u51b5\uff0c\u5df2\u7531CNVD\u901a\u8fc7\u7f51\u7ad9\u7ba1\u7406\u65b9\u516c\u5f00\u8054\u7cfb\u6e20\u9053\u5411\u5176\u90ae\u4ef6\u901a\u62a5\uff0c\u7531\u5176\u540e\u7eed\u63d0\u4f9b\u89e3\u51b3\u65b9\u6848\u5e76\u534f\u8c03\u76f8\u5173\u7528\u6237\u5355\u4f4d\u5904\u7f6e\u3002",
  "patchName": "\u5c0f\u7c73\u751f\u6d3b\u5b89\u5353\u6700\u65b0\u7248App\u5b58\u5728\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e",
  "products": {
    "product": "\u5317\u4eac\u5c0f\u7c73\u79d1\u6280\u6709\u9650\u8d23\u4efb\u516c\u53f8 \u5c0f\u7c73\u751f\u6d3b\u5b89\u5353\u6700\u65b0\u7248 3.1.550"
  },
  "serverity": "\u4f4e",
  "submitTime": "2015-08-14",
  "title": "\u5c0f\u7c73\u751f\u6d3b\u5b89\u5353\u6700\u65b0\u7248App\u5b58\u5728\u672c\u5730\u62d2\u7edd\u670d\u52a1\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.