PT-2016-1763 · Google · Android+1

Anestisb · Publicado 2016-04-18 · Atualizado 2016-04-20 · CVE-2016-0842

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android 6.x versions prior to 2016-04-01

Description The issue exists due to the incorrect handling of Memory Management Control Operation (MMCO) data by the H.264 decoder in the libstagefright library of the Android operating system. This can be exploited by a remote attacker using a specially crafted media file, potentially allowing the execution of arbitrary code or causing a denial of service due to memory corruption.

Recommendations For Android 6.x versions prior to 2016-04-01, update the operating system to a version released after 2016-04-01 to resolve the issue. As a temporary workaround, consider avoiding the use of the H.264 decoder in libstagefright until a patch is available. Restrict access to media files from untrusted sources to minimize the risk of exploitation.

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-01089

CVE-2016-0842

Produtos afetados

Android

Libstagefright

Referências · 8

• http://source.android.com/security/bulletin/2016-04-02.html · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-0842 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-0842 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-01089 · Nota de Segurança
• https://android.googlesource.com/platform/external/libavc/+/943323f1d9d3dd5c2634deb26cbe72343ca6b3db · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-0842 · Nota de Segurança
• https://ubuntu.com/security/CVE-2016-0842 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0842 · Aviso do Fabricante