CVEvulnerability

CVE-2013-4787

9.3 HIGH Published 2013-07-09 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2013-07-09
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-310

Description

Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the "Master Key" vulnerability.

Affected configurations

• google android 1.6 • google android 2.0 • google android 2.0.1 • google android 2.1 • google android 2.2 • google android 2.2.1 • google android 2.2.2 • google android 2.2.3 • google android 2.3 • google android 2.3.1 • google android 2.3.2 • google android 2.3.3 • google android 2.3.4 • google android 2.3.5 • google android 2.3.6 • google android 2.3.7 • google android 3.0 • google android 3.1 • google android 3.2 • google android 3.2.1 • google android 3.2.2 • google android 3.2.4 • google android 3.2.6 • google android 4.0 • google android 4.0.1 • google android 4.0.2 • google android 4.0.3 • google android 4.0.4 • google android 4.1 • google android 4.1.2 • google android 4.2

Related

Weakness · not in database (1)

Referenced by CWE · observed example (2)

  • CWE-694 Use of Multiple Resources with Duplicate Identifier weakness
  • CWE-99 Improper Control of Resource Identifiers weakness

References