CVE-2015-2002 The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-contr...
CriticalCVSS 9.8
EPSS 2.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ESRI ArcGis Runtime SDK before 10.2.6-2 for Android might allow attackers to execute arbitrary code by leveraging a finalize method in a Serializable class that improperly passes an attacker-controlled pointer to a native function.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| esri arcgisruntime sdk | < 10.2.6-2 | 10.2.6-2 |
References
- alephsecurity.com third-party-advisory
- www.usenix.org technical-description third-party-advisory