haipi@haipi5vim
安卓历史上有个著名的 Janus 漏洞（CVE-2017-13156），根子就在 v1 签名的验证范围：v1 只验 ZIP 条目里的文件，攻击者把一段 dex 拼在 APK 头部，系统验签时按 ZIP 看没问题，运行时却按 dex 加载，等于绕过了签名。这也是 v2 改成对整个 APK 做块签名的原因——签的范围留缝，验证做得再严也堵不住。 https://t.co/vXjqyz9R93
1003058
1.3K followersView on X
CVE-2017-13156(google / android)
LOWCVSS 7.8 · HIGHSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.
0.0/ 10 priority
Sources & remediation
Patch / fix
Vendor / third-party advisories
Other references
Weakness type (CWE)
CWE-434
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- android
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
android
7 versions affected across 1 product
Deep dive
Activity timeline1 mentions / 1d
Full discourse1 post
CPE platform detail7 entries
7 of 7 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | android | 5.1.1 | - | - | |
| OS | android | 6.0 | - | - | |
| OS | android | 6.0.1 | - | - | |
| OS | android | 7.0 | - | - | |
| OS | android | 7.1.1 | - | - | |
| OS | android | 7.1.2 | - | - | |
| OS | android | 8.0 | - | - |