description: DexLoader function get_stringidx_fromdex() in Redex prior to commit 3b44c64 can load an out of bound address when loading the string index table, potentially allowing remote code execution during processing of a 3rd party Android APK file.
problem types: CWE-125: Out-of-bounds Read, CWE-822: Untrusted Pointer Dereference
affected:
{
vendor: Facebook
product: Redex
versions:
version: unspecified, lessThan: 3b44c64, status: affected, versionType: custom
}