Unrated severityNVD Advisory· Published Mar 31, 2014· Updated Jun 17, 2026

CVE-2013-6774

Description

Untrusted search path vulnerability in the ChainsDD Superuser package 3.1.3 for Android 4.2.x and earlier, CyanogenMod/ClockWorkMod/Koush Superuser package 1.0.2.1 for Android 4.2.x and earlier, and Chainfire SuperSU package before 1.69 for Android 4.2.x and earlier allows attackers to load an arbitrary .jar file and gain privileges via a crafted BOOTCLASSPATH environment variable for a /system/xbin/su process. NOTE: another researcher was unable to reproduce this with ChainsDD Superuser.

Affected products

Androidsu/Chainsdd Superuser
cpe:2.3:a:androidsu:chainsdd_superuser:3.1.3:*:*:*:*:android:*:*
Chainfire/Supersu2 versions
cpe:2.3:a:chainfire:supersu:1.69:*:*:*:*:android:*:*+ 1 more
- cpe:2.3:a:chainfire:supersu:1.69:*:*:*:*:android:*:*
- (no CPE)range: <1.69
Koushik Dutta/Superuser
cpe:2.3:a:koushik_dutta:superuser:1.0.2.1:*:*:*:*:*:*:*
ChainsDD/Superuserllm-create
Range: =3.1.3
Cyanogenmod/Superuserllm-fuzzy
Range: =1.0.2.1

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2013-6774

Description

Affected products

Patches

Vulnerability mechanics

References

News mentions