Android OS vulnerable to arbitrary Java method execution


Android OS contains a vulnerability where an arbitrary Java method may be executed.

Tamami Eguchi reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
CVSS Severity (What is CVSS?)

CVSS V2 Severity:
Base Metrics 6.8 (Medium) [IPA Score]
  • Access Vector: Network
  • Access Complexity: Medium
  • Authentication: None
  • Confidentiality Impact: Partial
  • Integrity Impact: Partial
  • Availability Impact: Partial
Affected Products

  • Android OS version 3.0 through 4.1.x


When viewing a specially crafted page using the standard Android browser or an other application that uses the WebView class, Android OS may be rebooted or arbitrary code may be executed without intent from the user.

[Apply an Update]
Update your device according to the information provided by the provider or developer.
Vendor Information

KDDI eAccess Ltd. SoftBank Disney Mobile on SoftBank NTT DOCOMO, INC.
CWE (What is CWE?)

  1. No Mapping(CWE-DesignError) [IPA Evaluation]
CVE (What is CVE?)

  1. CVE-2013-4710

  1. JVN : JVN#53768697
  2. National Vulnerability Database (NVD) : CVE-2013-4710
Revision History

  • [2013/12/17]
      Web page was published
      References : Content was added