{"id":"ASB-A-205702093","details":"In ih264d_parse_decode_slice of ih264d_parse_slice.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.","aliases":["A-205702093","CVE-2021-39667"],"modified":"2026-09-22T15:22:15.314525410Z","published":"2022-03-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2022-03-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"}],"affected":[{"package":{"name":"platform/external/libavc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10:0"},{"fixed":"10:2022-03-01"}]}],"versions":["10"],"ecosystem_specific":{"spl":"2022-03-01","types":["ID"],"vanir_signatures":[{"target":{"file":"decoder/ih264d_parse_slice.c","function":"ih264d_parse_decode_slice"},"deprecated":false,"digest":{"function_hash":"317260528575866506749585279787370317279","length":16920},"id":"ASB-A-205702093-08e8ee07","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"},{"deprecated":false,"digest":{"line_hashes":["15245093318300955089985553898204632580","308835353278844952969673531834672375556","95251955029296330080774521352240845011","99650299326766410453481779919126340281","267704555538418719670371499903093565584","123171027937763603460906420960114560624","241684536061738258922111159970888426421","157551338934432380582111433535900656235","167833780012589546135021303253715931925","43449764711965098861295696277136669097","117091896254334038032080024831779276181","9262250090995193725041188886001094425","114084723533055295666875146946441971109","329916013161882525599151527348539263851","217832490124622463288395468880593258219","144423301104916578203051904392705524255","171060306154700556947884001024948146443","232837683669595986137331137289761828548"],"threshold":0.9},"id":"ASB-A-205702093-6c5960c2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c"}}],"fixes":["https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-205702093.json"}},{"package":{"name":"platform/external/libavc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11:0"},{"fixed":"11:2022-03-01"}]}],"versions":["11"],"ecosystem_specific":{"spl":"2022-03-01","types":["ID"],"vanir_signatures":[{"id":"ASB-A-205702093-4a322ba5","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c","function":"ih264d_parse_decode_slice"},"deprecated":false,"digest":{"function_hash":"317260528575866506749585279787370317279","length":16920}},{"id":"ASB-A-205702093-c257db62","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c"},"deprecated":false,"digest":{"line_hashes":["15245093318300955089985553898204632580","308835353278844952969673531834672375556","95251955029296330080774521352240845011","99650299326766410453481779919126340281","267704555538418719670371499903093565584","123171027937763603460906420960114560624","241684536061738258922111159970888426421","157551338934432380582111433535900656235","167833780012589546135021303253715931925","43449764711965098861295696277136669097","117091896254334038032080024831779276181","9262250090995193725041188886001094425","114084723533055295666875146946441971109","329916013161882525599151527348539263851","217832490124622463288395468880593258219","144423301104916578203051904392705524255","171060306154700556947884001024948146443","232837683669595986137331137289761828548"],"threshold":0.9}}],"fixes":["https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-205702093.json"}},{"package":{"name":"platform/external/libavc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2022-03-01"}]}],"versions":["12"],"ecosystem_specific":{"spl":"2022-03-01","types":["ID"],"vanir_signatures":[{"source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c","function":"ih264d_parse_decode_slice"},"deprecated":false,"digest":{"length":16920,"function_hash":"317260528575866506749585279787370317279"},"id":"ASB-A-205702093-7aa15fea","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["15245093318300955089985553898204632580","308835353278844952969673531834672375556","95251955029296330080774521352240845011","99650299326766410453481779919126340281","267704555538418719670371499903093565584","123171027937763603460906420960114560624","241684536061738258922111159970888426421","157551338934432380582111433535900656235","167833780012589546135021303253715931925","43449764711965098861295696277136669097","117091896254334038032080024831779276181","9262250090995193725041188886001094425","114084723533055295666875146946441971109","329916013161882525599151527348539263851","217832490124622463288395468880593258219","144423301104916578203051904392705524255","171060306154700556947884001024948146443","232837683669595986137331137289761828548"],"threshold":0.9},"id":"ASB-A-205702093-eb10d9cb","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-205702093.json"}},{"package":{"name":"platform/external/libavc","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2022-03-01"}]}],"versions":["12L"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392"],"severity":"High","spl":"2022-03-01","types":["ID"],"vanir_signatures":[{"deprecated":false,"digest":{"length":16920,"function_hash":"317260528575866506749585279787370317279"},"id":"ASB-A-205702093-260d4e0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c","function":"ih264d_parse_decode_slice"}},{"id":"ASB-A-205702093-4b0e4542","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/external/libavc/+/dc110841d6a3fb2f9c9f1af04b3b71da40fbd392","target":{"file":"decoder/ih264d_parse_slice.c"},"deprecated":false,"digest":{"line_hashes":["15245093318300955089985553898204632580","308835353278844952969673531834672375556","95251955029296330080774521352240845011","99650299326766410453481779919126340281","267704555538418719670371499903093565584","123171027937763603460906420960114560624","241684536061738258922111159970888426421","157551338934432380582111433535900656235","167833780012589546135021303253715931925","43449764711965098861295696277136669097","117091896254334038032080024831779276181","9262250090995193725041188886001094425","114084723533055295666875146946441971109","329916013161882525599151527348539263851","217832490124622463288395468880593258219","144423301104916578203051904392705524255","171060306154700556947884001024948146443","232837683669595986137331137289761828548"],"threshold":0.9}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-205702093.json"}}],"schema_version":"1.9.0"}