V.E.O

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.13.1 **Description** The issue involves the `fsck msdos` component and allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app. This is due to a buffer overflow in the `fsck msdos` component, which can be exploited by a remote attacker to achieve the aforementioned outcomes. **Recommendations** For macOS versions prior to 10.13.1, update to version 10.13.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the `fsck msdos` component until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** The issue is related to an elevation of privilege vulnerability in the Upstream Linux file system, affecting the Android product. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.2 **Description** The issue is related to insufficient access control in the Android operating system, which can be exploited by a remote attacker to execute arbitrary code. It is a remote code execution vulnerability in the Android media framework. **Recommendations** For Android versions 6.0 through 7.1.2, update to a version that contains a fix for this issue to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 **Description** A denial of service issue exists in the Android media framework. **Recommendations** For Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.2 **Description** The issue is related to insufficient access control in the Android operating system, which can be exploited by a remote attacker to execute arbitrary code. It is a remote code execution vulnerability in the Android media framework. **Recommendations** For Android versions 6.0 through 7.1.2, update to a version that contains a fix for this issue to prevent remote code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0.1, 7.0, 7.1.1, 7.1.2 **Description** The issue is related to a remote code execution vulnerability in the Android media framework. It is also associated with insufficient access control in the Android operating system. Exploitation of this issue may allow a remote attacker to execute arbitrary code. **Recommendations** For Android versions 6.0.1, 7.0, 7.1.1, 7.1.2, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.1 **Description** A remote denial of service issue in Mediaserver could allow an attacker to cause a device hang or reboot using a specially crafted file. This issue is rated as High severity due to the possibility of remote denial of service. The vulnerability is related to insufficient access control in the Mediaserver service of the Android operating system, which can be exploited by a remote attacker to cause a denial of service or device reboot using a specially crafted file. **Recommendations** For Android versions 6.0 through 7.1.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions prior to 4.12.4 **Description** The issue is related to the `sanity check ckpt` function in `fs/f2fs/super.c` of the Linux kernel, which incorrectly checks the indexing of the `blkoff` and `segno` arrays. This can be exploited by a local attacker to gain privileges through unspecified vectors. **Recommendations** For Linux kernel versions prior to 4.12.4, update to version 4.12.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the `sanity check ckpt` function in `fs/f2fs/super.c` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2 through 7.1.2 **Description** The issue is caused by a buffer overflow in the libhevc service of the Mediaserver application in the Android operating system. This can allow a remote attacker to cause memory corruption by using a specially crafted file, potentially leading to a denial of service. The vulnerability is related to media file and data processing. **Recommendations** For versions 5.0.2 through 7.1.2, update to a version that includes the fix for this issue to prevent potential memory corruption and denial of service attacks.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 **Description** A remote code execution issue in the libhevc component of Mediaserver could allow an attacker to cause memory corruption during media file and data processing using a specially crafted file. This could enable remote code execution within the context of the Mediaserver process. The issue is related to a buffer overflow in memory. **Recommendations** For versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, at the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.1 **Description** A remote code execution issue in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. **Recommendations** For Android versions 6.0 through 7.1.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to the fixed version **Description** The issue is related to an information disclosure vulnerability in the NVIDIA GPU driver, which could allow a local malicious application to access data outside of its permission levels. This could be used to access sensitive data without explicit user permission. The vulnerability is rated as High. **Recommendations** For Android versions prior to the fixed version, update to a version that includes the fix for this issue to prevent potential data access without permission. As a temporary workaround, consider restricting access to sensitive data until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Android versions 6.0 through 7.1.1 **Description** An information disclosure issue in AOSP Messaging could allow a remote attacker using a specially crafted file to access data outside of its permission levels. This issue is considered moderate as it bypasses user-level defense in depth or exploit mitigation technology in a privileged process. **Recommendations** For Android versions 6.0 through 7.1.1, update to a version that includes the fix for this issue to prevent potential data access outside of permission levels.

**Name of the Vulnerable Software and Affected Versions** Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1 **Description** An information disclosure issue in the libopus Mediaserver could allow a local malicious application to access data outside of its permission levels. This could be used to access sensitive data without permission. The issue is caused by a buffer overflow in the silk/NLSF stabilize.c function. **Recommendations** For versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1, update to a version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.