VDB
CVE-2013-4787
CVE-2013-4787
PUBLISHED
CVSS 9.300000190734863 CRITICAL
Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.
EPSS 58.92% · 99.0th percentile
Risk Scores
CVSS 2.0
9.300000190734863
EPSS Score
58.92%
99.0th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
| android | 2.2, 2.2, 2.3 |
Timeline
- Jul 3, 2013 PoC Published
- Jul 9, 2013 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
References
- 60952 vdb
- https://jira.cyanogenmod.org/browse/CYAN-1602 url
- http://www.zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782/ url
- http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/ url
- https://plus.google.com/113331808607528811927/posts/GxDA6111vYy url
- 94773 vdb
- http://review.cyanogenmod.org/#/c/45251/ url
- https://nvd.nist.gov/vuln/detail/CVE-2013-4787 advisory
- http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key url
- http://review.cyanogenmod.org/#/c/45251 url
- http://www.zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782 url