7.2
HIGH
CVE-2014-7911
Description

luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

INFO

Published Date :

Dec. 15, 2014, 6:59 p.m.

Last Modified :

Nov. 7, 2023, 2:21 a.m.

Source :

[email protected]

Remotely Exploitable :

No

Impact Score :

10.0

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2014-7911 has a 24 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2014-7911 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Google android
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2014-7911.

URL Resource
http://seclists.org/fulldisclosure/2014/Nov/51
https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
CVEDB/awesome-cve-repo

None

Shell

Updated: 1 week, 1 day ago
2 stars 1 fork 1 watcher
Born at : March 23, 2023, 4:32 a.m. This repo has been linked 264 different CVEs too.
Profile Photo
CVEDB/top

None

Shell

Updated: 1 week, 1 day ago
1 stars 0 fork 0 watcher
Born at : March 19, 2023, 1:53 a.m. This repo has been linked 264 different CVEs too.
Profile Photo
weeka10/-hktalent-TOP

None

Shell

Updated: 1 year, 3 months ago
2 stars 0 fork 0 watcher
Born at : Nov. 16, 2022, 9:38 a.m. This repo has been linked 256 different CVEs too.
Profile Photo
cyberanand1337x/bug-bounty-2022

None

Updated: 1 year, 6 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 30, 2022, 6:29 p.m. This repo has been linked 253 different CVEs too.
Profile Photo
jbmihoub/all-poc

None

Shell

Updated: 1 year, 10 months ago
0 stars 1 fork 1 watcher
Born at : Aug. 25, 2022, 12:16 a.m. This repo has been linked 250 different CVEs too.
Profile Photo
ambynotcoder/C-libraries

None

Updated: 2 years, 3 months ago
1 stars 0 fork 0 watcher
Born at : Feb. 15, 2022, 12:40 p.m. This repo has been linked 19 different CVEs too.
Profile Photo
PalindromeLabs/Java-Deserialization-CVEs

Compiled dataset of Java deserialization CVEs

java-deserialization deserialization cve security

Updated: 1 month, 3 weeks ago
60 stars 4 fork 4 watcher
Born at : July 22, 2020, 1:10 p.m. This repo has been linked 308 different CVEs too.
Profile Photo
404notf0und/Security-Data-Analysis-and-Visualization

2018-2020青年安全圈-活跃技术博主/博客

TSQL

Updated: 1 week, 1 day ago
771 stars 137 fork 137 watcher
Born at : April 17, 2019, 11:05 a.m. This repo has been linked 4 different CVEs too.
Profile Photo
tangsilian/android-vuln

安卓内核提权漏洞分析

Makefile C Shell Assembly PLpgSQL C++ Java Batchfile Objective-C Perl

Updated: 2 weeks, 6 days ago
469 stars 114 fork 114 watcher
Born at : Dec. 18, 2018, 5:16 p.m. This repo has been linked 34 different CVEs too.
Profile Photo
CytQ/CVE-2014-7911_poc

None

Java

Updated: 5 years, 9 months ago
0 stars 0 fork 0 watcher
Born at : Sept. 28, 2018, 7:45 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
JuZhu1978/AboutMe

None

Updated: 2 years, 10 months ago
0 stars 0 fork 0 watcher
Born at : Aug. 13, 2018, 11:18 a.m. This repo has been linked 8 different CVEs too.
Profile Photo
mabin004/cve-2014-7911

exp for cve-2014-7911 which can get system privillage

Java

Updated: 6 years, 6 months ago
1 stars 2 fork 2 watcher
Born at : Sept. 28, 2016, 7:56 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
koozxcv/CVE-2014-7911-CVE-2014-4322_get_root_privilege

CVE-2014-7911 vulnerability and CVE-2014-4322 vulnerability to get root privilege！

Java

Updated: 5 months, 2 weeks ago
2 stars 2 fork 2 watcher
Born at : March 23, 2016, 3:21 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
koozxcv/CVE-2014-7911

vulnerabilities‘ Poc and Exploit

Java

Updated: 6 years, 6 months ago
1 stars 1 fork 1 watcher
Born at : March 22, 2016, 2:02 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
VERFLY/SecurityScanner

None

Java

Updated: 8 years, 3 months ago
1 stars 1 fork 1 watcher
Born at : March 15, 2016, 3:01 a.m. This repo has been linked 3 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following table lists the changes that have been made to the CVE-2014-7911 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by [email protected]

    May. 14, 2024

    Action Type Old Value New Value
  • CVE Source Update by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Changed Source Google Inc. Chrome
  • CVE Modified by [email protected]

    Nov. 07, 2023

    Action Type Old Value New Value
    Added Reference Chrome https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2 [No types assigned]
    Added Reference Chrome http://seclists.org/fulldisclosure/2014/Nov/51 [No types assigned]
    Removed Reference Google Inc. http://seclists.org/fulldisclosure/2014/Nov/51
    Removed Reference Google Inc. https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2
  • Modified Analysis by [email protected]

    Dec. 16, 2014

    Action Type Old Value New Value
    Added CPE Configuration Configuration 1 OR *cpe:2.3:o:google:android:1.0:*:*:*:*:*:*:* *cpe:2.3:o:google:android:1.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:1.5:*:*:*:*:*:*:* *cpe:2.3:o:google:android:1.6:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.0:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.0.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.2:rev1:*:*:*:*:*:* *cpe:2.3:o:google:android:2.2.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.2.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.2.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3:rev1:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.4:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.5:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.6:*:*:*:*:*:*:* *cpe:2.3:o:google:android:2.3.7:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.0:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.2.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.2.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.2.4:*:*:*:*:*:*:* *cpe:2.3:o:google:android:3.2.6:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.4.3:*:*:*:*:*:*:* *cpe:2.3:o:google:android:4.4.4:*:*:*:*:*:*:* (and previous)
    Added CVSS V2 (AV:L/AC:L/Au:N/C:C/I:C/A:C)
    Changed Reference Type https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2 No Types Assigned https://android.googlesource.com/platform/libcore/+/738c833d38d41f8f76eb7e77ab39add82b1ae1e2 Advisory
    Changed Reference Type http://seclists.org/fulldisclosure/2014/Nov/51 No Types Assigned http://seclists.org/fulldisclosure/2014/Nov/51 Exploit
    Added CWE CWE-264
  • Initial Analysis by [email protected]

    Dec. 16, 2014

    Action Type Old Value New Value
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2014-7911 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2014-7911 weaknesses.

Exploit Prediction

EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days.

0.06 }} 0.00%

score

0.23741

percentile

CVSS2 - Vulnerability Scoring System
Access Vector
Access Complexity
Authentication
Confidentiality
Integrity
Availability
: