PT-2016-2557 · Google · Android

Publicado 2016-08-05 · Atualizado 2016-11-28 · CVE-2016-3830

Positive Technologies (AI Summary)

CVSS v2.0

7.1

Alta

Vetor base

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4.4 Android versions 5.0.x prior to 5.0.2 Android versions 5.1.x prior to 5.1.1 Android versions 6.x before 2016-08-01

Description The issue exists due to insufficient input validation in the codecs/aacdec/SoftAAC2.cpp method of the libstagefright media server library in the Android operating system. This can be exploited by a remote attacker to cause a denial of service, resulting in device hang or reboot, by using specially crafted ADTS data.

Recommendations For Android versions prior to 4.4.4, update to version 4.4.4 or later. For Android versions 5.0.x prior to 5.0.2, update to version 5.0.2 or later. For Android versions 5.1.x prior to 5.1.1, update to version 5.1.1 or later. For Android versions 6.x before 2016-08-01, update to a version released after 2016-08-01.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2016-01949

CVE-2016-3830

Produtos afetados

Android

Referências · 9

• https://android.googlesource.com/platform/frameworks/av/+/8e438e153f661e9df8db0ac41d587e940352df06 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3830 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2016-3830 · Nota de Segurança
• https://bdu.fstec.ru/vul/2016-01949 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-3830 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-3830 · Nota de Segurança
• http://source.android.com/security/bulletin/2016-08-01.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-3830 · Aviso do Fabricante
• http://securityfocus.com/bid/92221 · Nota