Android OS vulnerable to arbitrary Java method execution


Android OS contains a vulnerability where an arbitrary Java method may be executed.

Tamami Eguchi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

Base Metrics: 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial

Affected Products

  • Android OS version 3.0 through 4.1.x


When viewing a specially crafted page using the standard Android browser or an other application that uses the WebView class, Android OS may be rebooted or arbitrary code may be executed without intent from the user.

[Apply an Update]
Update your device according to the information provided by the provider or developer.
Vendor Information

KDDI eAccess Ltd. SoftBank Disney Mobile on SoftBank NTT DOCOMO, INC.
CWE (What is CWE?)

  1. No Mapping(CWE-DesignError) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-4710

  1. JVN : JVN#53768697
  2. National Vulnerability Database (NVD) : CVE-2013-4710
Revision History

  Web page was published
  References : Content was added