CVE-2018-9350: 
NixOS vulnerability analysis and mitigation

In ih264d_assign_pic_num of ih264d_utils.c there is a possible out of bound read due to missing bounds check. This vulnerability (CVE-2018-9350) affects Android versions 7.0, 7.1.1, 7.1.2, 8.0, and 8.1. The issue was disclosed in June 2018 as part of the Android Security Bulletin (Android Bulletin).

The vulnerability is classified as an Information Disclosure (ID) issue with Moderate severity for Android versions 7.0 and above, and as a Denial of Service (DoS) with High severity for Android 6.0/6.0.1. The vulnerability exists in the media framework component and stems from a missing bounds check in the ih264d_assign_pic_num function within ih264d_utils.c (NVD).

If exploited, this vulnerability could lead to a denial of service with no additional execution privileges needed. User interaction is required for exploitation. The vulnerability has different severity ratings depending on the Android version - rated as High severity DoS for Android 6.0/6.0.1 and Moderate severity information disclosure for later versions (Android Bulletin).

Google released patches for this vulnerability as part of the June 2018 Android Security Bulletin. Users should update their Android devices to a security patch level of 2018-06-05 or later to address this vulnerability (Android Bulletin).