CVE-2017-0381
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could...
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
CVE-2017-0381- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 9.3 High
AV:N/AC:M/Au:N/C:C/I:C/A:C - Weakness
- CWE-190
- Updated
- 2026-11-02
CVE List No score
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
CVE-2017-0381- Updated
- 2026-11-02
EUVDEUVD-2017-0735 No score
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
EUVD-2017-0735- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-28h8-v6gp-mwgv
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could...
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
GHSA-28h8-v6gp-mwgv- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-190
- Updated
- 2026-11-02
OSV
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
CVE-2017-0381- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-0381
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
DEBIAN-CVE-2017-0381- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVUBUNTU-CVE-2017-0381
An information disclosure vulnerability in silk/NLSF_stabilize.c in libopus in Mediaserver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it could be used to access sensitive data without permission. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1. Android ID: A-31607432.
- Record
UBUNTU-CVE-2017-0381- CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0029 No score
Updated opus packages fix security vulnerability
A remote code execution vulnerability in silk/NLSF_stabilize.c in libopus could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing (CVE-2017-0381).
- Record
MGASA-2017-0029- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11132-1 No score
libopus-devel-1.3.1-3.8 on GA media
These are all security issues fixed in the libopus-devel-1.3.1-3.8 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11132-1- Updated
- 2026-11-02
OSVSUSE-SU-2017:0436-1 No score
Security update for opus
This update for opus fixes the following issues:
- CVE-2017-0381: Fixed a remote code execution vulnerability in silk/NLSF_stabilize.c when playing certain media files (bsc#1020102)
- Record
SUSE-SU-2017:0436-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
opusDebian:12 |
before 1.2~alpha2-1 | 1.2~alpha2-1 |
opusDebian:13 |
before 1.2~alpha2-1 | 1.2~alpha2-1 |
opusDebian:14 |
before 1.2~alpha2-1 | 1.2~alpha2-1 |
opusDebian:7 |
before 0.9.14+20120615-1+nmu1+deb7u1, plus listed versions 0.9.14+20120615-1+nmu1 |
0.9.14+20120615-1+nmu1+deb7u1 |
opusMageia:5 |
before 1.1-3.1.mga5 | 1.1-3.1.mga5 |
opusSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Desktop 12 SP2 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Software Development Kit 12 SP2 |
before 1.1-3.1 | 1.1-3.1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
opusSUSE:Linux Enterprise Server 12 SP1 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Server 12 SP2 |
before 1.1-3.1 | 1.1-3.1 |
opusSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.1-3.1 | 1.1-3.1 |
androidUbuntu:16.04:LTS |
All versions, plus listed versions 20150818-1500-0ubuntu220150818-1500-0ubuntu320160307-0742-0ubuntu320160330-0939-0ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-0381 is a high vulnerability (CVSS 7.8) in Google Android, published January 12, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in opus 1.2~alpha2-1.
References
source.android.com/security/bulletin/2017-01-01.html
security.gentoo.org/glsa/201702-21
support.apple.com/HT208144
android.googlesource.com/platform/external/libopus/+/0d052d64480a30e83fcdda80f4774624e044beb7
securityfocus.com/bid/95248
securitytracker.com/id/1039427
Show 14 moreShow less
nvd.nist.gov/vuln/detail/CVE-2017-0381
github.com/advisories/GHSA-28h8-v6gp-mwgv
security-tracker.debian.org/tracker/CVE-2017-0381
advisories.mageia.org/MGASA-2017-0029.html
bugs.mageia.org/show_bug.cgi?id=20157
lists.fedoraproject.org/archives/list/[email protected]/thread/ZKHZKWBC6F5SBYVTHQOQ5ZQURSZSNQ36
suse.com/support/update/announcement/2017/suse-su-20170436-1
bugzilla.suse.com/1020102
ubuntu.com/security/CVE-2017-0381
cve.org/CVERecord?id=CVE-2017-0381