PT-2016-1718 · Google · Android

Heisecode + 1 · Publicado 2016-04-18 · Atualizado 2016-04-21 · CVE-2016-2414

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions 5.0.0 through 5.0.1 Android versions 5.1.0 through 5.1.0 Android versions 6.0.0 through 2016-03-31

Description The issue exists due to the lack of validation for negative font property values in the Minikin library of the Android operating system. Exploitation of this issue can allow a local attacker to cause a denial of service (memory corruption) using a specially crafted font. Remote attackers can also cause a denial of service (memory corruption and reboot loop) via a crafted font.

Recommendations For Android versions 5.0.0 through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.0 through 5.1.0, update to version 5.1.1 or later. For Android versions 6.0.0 through 2016-03-31, apply the patch available as of 2016-04-01.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-01044

CVE-2016-2414

Produtos afetados

Android

Referências · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2414 · Aviso do Fabricante
• http://source.android.com/security/bulletin/2016-04-02.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-2414 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-2414 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-01044 · Nota de Segurança
• https://android.googlesource.com/platform/frameworks/minikin/+/ca8ac8acdad662230ae37998c6c4091bb39402b6 · Nota
• https://android.googlesource.com/platform/frameworks/minikin/+/f4785aa1947b8d22d5b19559ef1ca526d98e0e73 · Nota
• https://cve.org/CVERecord?id=CVE-2016-2414 · Nota de Segurança
• https://code.google.com/p/android/issues/detail?id=192618 · Nota
• https://osv.dev/vulnerability/CVE-2016-2414 · Aviso do Fabricante