{"id":"ASB-A-309938635","details":"In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-309938635","CVE-2024-40673"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2024-10-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2024-10-01"},{"type":"FIX","url":"https://android.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9"}],"affected":[{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"15-next:0"},{"fixed":"15-next:2024-10-01"}]}],"versions":["15-next"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/libcore/+/549d249b9a83c9d82837799584afb6381e54254e"],"severity":"High","spl":"2024-10-01","types":["RCE"],"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/549d249b9a83c9d82837799584afb6381e54254e","target":{"file":"ojluni/src/main/java/java/util/zip/ZipFile.java","function":"Source"},"deprecated":false,"digest":{"function_hash":"265186814605290407737839737874302637873","length":551},"id":"ASB-A-309938635-a31db784","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["23495861995601514141316889146593097753","274889676424387549901000487365782440055","155143491846463834813941840149343434367","334430171867360418573880791188934951730"],"threshold":0.9},"id":"ASB-A-309938635-cc607abd","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/549d249b9a83c9d82837799584afb6381e54254e","target":{"file":"ojluni/src/main/java/java/util/zip/ZipFile.java"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309938635.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12:0"},{"fixed":"12:2024-10-01"}]}],"versions":["12"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2"],"severity":"High","spl":"2024-10-01","types":["RCE"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["213319749181021306436953120105197013029","144619168489362094828755847561613061452","1585668565002214516594897173974723034","112031080139449826729726846171368003665"],"threshold":0.9},"id":"ASB-A-309938635-993c004d","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"file":"ojluni/src/main/native/zip_util.c"}},{"signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"function":"ZIP_Put_In_Cache0","file":"ojluni/src/main/native/zip_util.c"},"deprecated":false,"digest":{"length":1172,"function_hash":"18739163088761162184710738729650148048"},"id":"ASB-A-309938635-c59e9a70","signature_type":"Function"}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309938635.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12L:0"},{"fixed":"12L:2024-10-01"}]}],"versions":["12L"],"ecosystem_specific":{"vanir_signatures":[{"signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"file":"ojluni/src/main/native/zip_util.c","function":"ZIP_Put_In_Cache0"},"deprecated":false,"digest":{"length":1172,"function_hash":"18739163088761162184710738729650148048"},"id":"ASB-A-309938635-27f10772","signature_type":"Function"},{"digest":{"line_hashes":["213319749181021306436953120105197013029","144619168489362094828755847561613061452","1585668565002214516594897173974723034","112031080139449826729726846171368003665"],"threshold":0.9},"id":"ASB-A-309938635-a7a5df74","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"file":"ojluni/src/main/native/zip_util.c"},"deprecated":false}],"fixes":["https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2"],"severity":"High","spl":"2024-10-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309938635.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13:0"},{"fixed":"13:2024-10-01"}]}],"versions":["13"],"ecosystem_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"18739163088761162184710738729650148048","length":1172},"id":"ASB-A-309938635-2415e591","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"function":"ZIP_Put_In_Cache0","file":"ojluni/src/main/native/zip_util.c"}},{"source":"https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2","target":{"file":"ojluni/src/main/native/zip_util.c"},"deprecated":false,"digest":{"line_hashes":["213319749181021306436953120105197013029","144619168489362094828755847561613061452","1585668565002214516594897173974723034","112031080139449826729726846171368003665"],"threshold":0.9},"id":"ASB-A-309938635-d2d19dbe","signature_type":"Line","signature_version":"v1"}],"fixes":["https://android.googlesource.com/platform/libcore/+/288a44a1817707110cdf5a3a6ef8377c6e10cce2"],"severity":"High","spl":"2024-10-01","types":["RCE"]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309938635.json"}},{"package":{"name":"platform/libcore","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"14:0"},{"fixed":"14:2024-10-01"}]}],"versions":["14"],"ecosystem_specific":{"spl":"2024-10-01","types":["RCE"],"vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/c7b495dc8c466de602cd7b78468864acd6b2f9b3","target":{"file":"ojluni/src/main/native/zip_util.c"},"deprecated":false,"digest":{"line_hashes":["274617653392482763089091782524942958146","150109526257354231252204590097711161397","77919708741881686680554719635739124285","339737767369318751335278101939590377696"],"threshold":0.9},"id":"ASB-A-309938635-91d10b1e","match_only_versions":["14"]},{"id":"ASB-A-309938635-b9eae7c8","match_only_versions":["14"],"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/platform/libcore/+/c7b495dc8c466de602cd7b78468864acd6b2f9b3","target":{"function":"ZIP_Put_In_Cache0","file":"ojluni/src/main/native/zip_util.c"},"deprecated":false,"digest":{"length":1182,"function_hash":"195916573689836405427437824188754930252"}}],"fixes":["https://android.googlesource.com/platform/libcore/+/c7b495dc8c466de602cd7b78468864acd6b2f9b3"],"severity":"High"},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-309938635.json"}}],"schema_version":"1.9.0"}