Google Android SDK vulnerabilities

3 CVEs affecting Google Android SDK, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2011-1001, published 2011-07-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2008-0986, published 2008-03-06. High severity, CVSS 7.5. EPSS: 4.9% chance of exploitation in the next 30 days. Integer overflow in the BMP::readFromStream method in the libsgl.so library in Google Android SDK m3-rc37a and earlier, and m5-rc14, allows remote attackers to execute arbitrary code via a crafted…
CVE-2008-0985, published 2008-03-06. Medium severity, CVSS 6.8. EPSS: 4.6% chance of exploitation in the next 30 days. Heap-based buffer overflow in the GIF library in the WebKit framework for Google Android SDK m3-rc37a and earlier allows remote attackers to execute arbitrary code via a crafted GIF file whose…
CVE-2011-1001, published 2011-07-08. Medium severity, CVSS 4.3. EPSS: 1.2% chance of exploitation in the next 30 days. dexdump in Android SDK before 2.3 does not properly perform structural verification, which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute…