Vlc For Android
Monthly
File overwrite in VLC for Android before 3.7.2 lets a co-installed app with no permissions send a crafted VIEW intent to the exported StartActivity and have VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. The flaw is local-only and requires the attacker app to spoof the com.fsck.k9.attachmentprovider or gmail-ls authority; overwriting other apps' files additionally depends on VLC holding All files access, which is non-default. Impact is limited to integrity, no public exploit was identified at time of analysis, and the vendor fixed it in 3.7.2.
File overwrite in VLC for Android before 3.7.2 lets a co-installed app with no permissions send a crafted VIEW intent to the exported StartActivity and have VLC write attacker-chosen content under an attacker-chosen name in the shared Download directory. The flaw is local-only and requires the attacker app to spoof the com.fsck.k9.attachmentprovider or gmail-ls authority; overwriting other apps' files additionally depends on VLC holding All files access, which is non-default. Impact is limited to integrity, no public exploit was identified at time of analysis, and the vendor fixed it in 3.7.2.