CVE-2017-0381 — opus: Memory corruption during media file and data processing

Back Back to CVE browser

HIGH

opus: Memory corruption during media file and data processing

Published Jan 12, 2017

7.8

HIGH

CVSS 3.0

EPSS 1.06%

Description

An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.

Affected products

Vendor Google Inc. Product Android Default
n/a
- Version
  Android-5.0.2
  Status
  affected
  Constraints
  -
- Version
  Android-5.1.1
  Status
  affected
  Constraints
  -
- Version
  Android-6.0
  Status
  affected
  Constraints
  -
- Version
  Android-6.0.1
  Status
  affected
  Constraints
  -
- Version
  Android-7.0
  Status
  affected
  Constraints
  -
- Version
  Android-7.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Google Inc.

Android

n/a

Version	Status	Constraints
Android-5.0.2	affected	-
Android-5.1.1	affected	-
Android-6.0	affected	-
Android-6.0.1	affected	-
Android-7.0	affected	-
Android-7.1	affected	-

Red Hat Enterprise Linux 5

firefox

Will not fix
Red Hat Enterprise Linux 5

thunderbird

Will not fix
Red Hat Enterprise Linux 6

firefox

Will not fix
Red Hat Enterprise Linux 6

thunderbird

Will not fix
Red Hat Enterprise Linux 7

firefox

Will not fix
Red Hat Enterprise Linux 7

opus

Will not fix
Red Hat Enterprise Linux 7

thunderbird

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 5	firefox	Will not fix	n/a
Red Hat Enterprise Linux 5	thunderbird	Will not fix	n/a
Red Hat Enterprise Linux 6	firefox	Will not fix	n/a
Red Hat Enterprise Linux 6	thunderbird	Will not fix	n/a
Red Hat Enterprise Linux 7	firefox	Will not fix	n/a
Red Hat Enterprise Linux 7	opus	Will not fix	n/a
Red Hat Enterprise Linux 7	thunderbird	Will not fix	n/a

Remediation

No remediation recorded yet.

Metrics

1.06% 0.01059

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01059

Score over time

2021–2026

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Percentile over time

EPSS v1
EPSS v5
EPSS v2
EPSS v3

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.06% (0.01059)	63.27th	v5 (v2026.06.15)
Aug 23, 2026	1.88% (0.01875)	77.50th	v5 (v2026.06.15)
Jul 20, 2024	0.16% (0.00162)	53.19th	v3 (v2023.03.01)
Jun 28, 2024	0.16% (0.00162)	53.00th	v3 (v2023.03.01)
Mar 7, 2023	0.16% (0.00162)	50.98th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 4, 2022	1.54% (0.01537)	51.33th	v2 (v2022.01.01)
Feb 3, 2022	0.86% (0.00861)	24.98th	v5 (v2026.06.15)
Apr 14, 2021	0.86% (0.00861)	0.00th	v1

Weaknesses (1)

CWE-190

Integer Overflow

References (13)

http://www.securityfocus.com/bid/95248
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039427
vdb-entryx_refsource_SECTRACK
https://access.redhat.com/security/cve/CVE-2017-0381
Vendor Advisory
https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7
x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1413604
Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-0381
https://security.gentoo.org/glsa/201702-21
vendor-advisoryx_refsource_GENTOO
https://source.android.com/security/bulletin/2017-01-01.html
x_refsource_CONFIRMVendor Advisory
https://support.apple.com/HT208112
x_refsource_CONFIRM
https://support.apple.com/HT208113
x_refsource_CONFIRM
https://support.apple.com/HT208115
x_refsource_CONFIRM
https://support.apple.com/HT208144
x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2017-0381

Link	Providers	Tags
http://www.securityfocus.com/bid/95248		vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039427		vdb-entryx_refsource_SECTRACK
https://access.redhat.com/security/cve/CVE-2017-0381		Vendor Advisory
https://android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7		x_refsource_CONFIRMIssue TrackingPatch
https://bugzilla.redhat.com/show_bug.cgi?id=1413604		Issue Tracking
https://nvd.nist.gov/vuln/detail/CVE-2017-0381
https://security.gentoo.org/glsa/201702-21		vendor-advisoryx_refsource_GENTOO
https://source.android.com/security/bulletin/2017-01-01.html		x_refsource_CONFIRMVendor Advisory
https://support.apple.com/HT208112		x_refsource_CONFIRM
https://support.apple.com/HT208113		x_refsource_CONFIRM
https://support.apple.com/HT208115		x_refsource_CONFIRM
https://support.apple.com/HT208144		x_refsource_CONFIRM
https://www.cve.org/CVERecord?id=CVE-2017-0381