Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2017-0593: Android lets malicious app gain extra permissions
CVE-2017-0593 · published 9 years ago
Summary
On Android versions 6.0 through 7.1.2, a flaw in the system’s core code can let a locally installed app increase its privileges and access permissions it should not have. This could let the app read or change data from other apps, bypassing the normal security barrier. Update your devices to the latest security patches or install a version of Android that includes the fix.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| android |
6.0 6.0.1 7.0 7.1.0 7.1.1 7.1.2 cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:* |
Original advisory text
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissions. This issue is rated as High because it is a general ...
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to obtain access to custom permissions. This issue is rated as High because it is a general bypass for operating system protections that isolate application data from other applications. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34114230.
References
- http://www.securityfocus.com/bid/98126 Third Party Advisory VDB Entry
- https://source.android.com/security/bulletin/2017-05-01 Patch Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-732Incorrect Permission Assignment for Critical Resource
Timeline
Published12 May 2017
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-0593 · NVD
Track software like this
Free during beta