{"cve":"CVE-2013-4787","nvd":{"published":"2013-07-09T17:55:01.153","modified":"2026-06-16T23:57:53.733","status":"Modified","description":"Android 1.6 Donut through 4.2 Jelly Bean does not properly check cryptographic signatures for applications, which allows attackers to execute arbitrary code via an application package file (APK) that is modified in a way that does not violate the cryptographic signature, probably involving multiple entries in a Zip file with the same name in which one entry is validated but the other entry is installed, aka Android security bug 8219321 and the \"Master Key\" vulnerability.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-310"],"references":["http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/","http://review.cyanogenmod.org/#/c/45251/","http://www.osvdb.org/94773","http://www.securityfocus.com/bid/60952","http://www.zdnet.com/google-releases-fix-to-oems-for-blue-security-android-security-hole-7000017782/"],"products":["google:android"],"source":"nvd","synced_at":"2026-10-19T20:29:16.037019470+00:00"},"epss":{"cve":"CVE-2013-4787","score":0.13527,"percentile":0.96454,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}