Medium
android-platform-libcore — security advisory
In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Products
- android-platform-libcore
- Affected versions
- 10.0.0+r36-1, 10.0.0+r36-1build1, 6.0.1+r10-1, 6.0.1+r10-2, 7.0.0+r33-1, 8.1.0+r23-2build1, 8.1.0+r23-2~18.04
- Fixed versions
- Not specified
- CVEs
- CVE-2024-40673
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 01:44 UTC · Revision 1
Source evidence
In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
osv:UBUNTU-CVE-2024-40673
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
android-platform-libcore
Fixed versions: Not specified
Complete source record
{
"id": "35c515d73d2eb9e53de3e7e00b49d90c49ef62c107dde2e49f983d9336edc85e",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2024-40673",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2024-40673",
"summary": "In Source of ZipFile.java, there is a possible way for an attacker to execute arbitrary code by manipulating Dynamic Code Loading due to improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.",
"evidence": "osv:UBUNTU-CVE-2024-40673",
"products": [
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "6.0.1+r10-1",
"evidence": "/affected/0/versions"
},
{
"value": "6.0.1+r10-2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "7.0.0+r33-1",
"evidence": "/affected/1/versions"
},
{
"value": "8.1.0+r23-2~18.04",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "8.1.0+r23-2build1",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+r36-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+r36-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+r36-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+r36-1build1",
"evidence": "/affected/6/versions"
}
]
},
{
"name": {
"value": "android-platform-libcore",
"evidence": "/affected/7/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "10.0.0+r36-1",
"evidence": "/affected/7/versions"
},
{
"value": "10.0.0+r36-1build1",
"evidence": "/affected/7/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2024-40673",
"aliases": [
"UBUNTU-CVE-2024-40673"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=xenial",
"ecosystem": "Ubuntu:16.04:LTS"
},
"versions": [
"6.0.1+r10-1",
"6.0.1+r10-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "libandroid-json-java",
"binary_version": "6.0.1+r10-2"
},
{
"binary_name": "libdex-java",
"binary_version": "6.0.1+r10-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"7.0.0+r33-1",
"8.1.0+r23-2~18.04"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "8.1.0+r23-2~18.04"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "8.1.0+r23-2~18.04"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"8.1.0+r23-2build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "8.1.0+r23-2build1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "8.1.0+r23-2build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"10.0.0+r36-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "10.0.0+r36-1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "10.0.0+r36-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"10.0.0+r36-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "10.0.0+r36-1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "10.0.0+r36-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"10.0.0+r36-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "10.0.0+r36-1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "10.0.0+r36-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"10.0.0+r36-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "10.0.0+r36-1build1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "10.0.0+r36-1build1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "android-platform-libcore",
"purl": "pkg:deb/ubuntu/android-platform-libcore?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"10.0.0+r36-1",
"10.0.0+r36-1build1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-40673.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "android-platform-libcore-headers",
"binary_version": "10.0.0+r36-1build1"
},
{
"binary_name": "libandroid-json-java",
"binary_version": "10.0.0+r36-1build1"
}
]
}
}
],
"modified": "2026-10-17T12:57:23.171566978Z",
"provider": "osv",
"upstream": [
"CVE-2024-40673"
],
"references": [
"https://ubuntu.com/security/CVE-2024-40673",
"https://www.cve.org/CVERecord?id=CVE-2024-40673",
"https://android.googlesource.com/platform/libcore/+/b17fd2f8fe468e7d32e713b442f610cd33e4e7a9",
"https://source.android.com/security/bulletin/2024-10-01"
]
},
"related_cves": [
{
"value": "CVE-2024-40673",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 357390,
"published_at": "2025-01-28T20:15:00+00:00"
}