VulnerabilityModified
CVE-2020-0007
In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data.
MEDIUM 5.5EPSS 0.17%
Does this matter?
Lower severity and a low EPSS score (0.17%). Track it; it rarely justifies an emergency change on its own.
Description
In flattenString8 of Sensor.cpp, there is a possible information disclosure of heap memory due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0, Android-8.1, Android-9, and Android-10 Android ID: A-141890807
- CVSS 3.1
- 5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 0.17% probability · 6th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-908
- Affected
- google/android
- Source
- security@android.com
References
- https://source.android.com/security/bulletin/2020-01-01Vendor Advisory
- https://source.android.com/security/bulletin/2020-01-01Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.