CVE-2011-1001

Published: Jul 8, 2011Modified: Apr 29, 2026

4.3

Vector

AV:N/AC:M/Au:N/C:N/I:N/A:P

Exploitability: 8.6 / Impact: 2.9

Source: NVD

Description

dexdump in Android SDK before 2.3 does not properly perform structural verification, which allows user-assisted remote attackers to cause a denial of service (dexdump crash) and possibly execute arbitrary code via a malformed APK or dex file that calls a method using more arguments than the number of register that have been declared for that method.

Affected (7)

Products: Google: Android Sdk

Google

1 product

Android Sdk

Configuration A

7 vulnerable

Vulnerable Software	Affected Versions
Google Android Sdk	Up to 2.2
Google Android Sdk	Version 1.1
Google Android Sdk	Version 1.5
Google Android Sdk	Version 1.6
Google Android Sdk	Version 2.0.1
Google Android Sdk	Version 2.0
Google Android Sdk	Version 2.1

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (4)

http://android.git.kernel.org/?p=platform/dalvik.git%3Ba=commit%3Bh=4b0750e8df91220690bb417f45d7ae8b7851b220

Source: secalert@redhat.com

http://seclists.org/fulldisclosure/2011/Mar/329

Source: secalert@redhat.com

http://android.git.kernel.org/?p=platform/dalvik.git%3Ba=commit%3Bh=4b0750e8df91220690bb417f45d7ae8b7851b220

Source: af854a3a-2127-422b-91ae-364da2661108

http://seclists.org/fulldisclosure/2011/Mar/329

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.