CVE-2017-0478 PoC — Android Framesequence库安全漏洞

Source

https://github.com/likekabin/CVE-2017-0478

Associated Vulnerability

Title:Android Framesequence库安全漏洞 (CVE-2017-0478)
Description:A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the context of an unprivileged process. This issue is rated as High due to the possibility of remote code execution in an application that uses the Framesequence library. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33718716.

Readme

# CVE-2017-0478
poc of CVE-2017-0478

The file of FrameSequence_webp.cpp is not compiled  in AOSP currently,  so when you compile libframesequence.so  with webp, 
you need compile with FRAMESEQUENCE_INCLUDE_WEBP(like this:  FRAMESEQUENCE_INCLUDE_WEBP=true mm -B)

File Snapshot


 [4.0K]  /data/pocs/beeb475dc2f4da92c48b968ad55b4853e7652ce4
├── [4.0K]  poc
│   ├── [ 863]  AndroidManifest.xml
│   ├── [1.3K]  Android.mk
│   ├── [4.0K]  build.xml
│   ├── [  51]  proguard.flags
│   ├── [ 563]  project.properties
│   ├── [4.0K]  res
│   │   ├── [4.0K]  drawable-hdpi
│   │   │   └── [9.2K]  ic_launcher.png
│   │   ├── [4.0K]  drawable-mdpi
│   │   │   └── [5.1K]  ic_launcher.png
│   │   ├── [4.0K]  drawable-xhdpi
│   │   │   └── [ 14K]  ic_launcher.png
│   │   ├── [4.0K]  layout
│   │   │   └── [1.4K]  basic_test_activity.xml
│   │   ├── [4.0K]  raw
│   │   │   ├── [ 34K]  animated_gif.gif
│   │   │   └── [372K]  animated_webp.webp
│   │   └── [4.0K]  values
│   │       ├── [ 598]  strings.xml
│   │       └── [ 148]  styles.xml
│   └── [4.0K]  src
│       └── [4.0K]  com
│           └── [4.0K]  android
│               └── [4.0K]  framesequence
│                   └── [4.0K]  samples
│                       ├── [4.1K]  FrameSequenceTest.java
│                       └── [2.4K]  SamplesList.java
└── [ 263]  README.md

13 directories, 16 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!