PT-2016-1584 · Google · Android+1

Anestis Bechtsoudis + 1 · Published 2016-03-12 · Updated 2016-11-28 · CVE-2016-0824

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Android 6.x before 2016-03-01

Description The issue allows attackers to obtain sensitive information and bypass an unspecified protection mechanism via crafted Bitstream data. This can be achieved by exploiting errors in security settings, potentially granting access to confidential information or allowing the bypassing of protection mechanisms.

Recommendations For Android 6.x before 2016-03-01, update the system to a version released after 2016-03-01 to resolve the issue. As a temporary workaround, consider restricting the use of libstagefright until a patch is available. Avoid using crafted Bitstream data in the affected system until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-254

CWE-200

Related Identifiers

BDU:2016-00885

CVE-2016-0824

Affected Products

Android

Libstagefright

References · 9

• https://osv.dev/vulnerability/CVE-2016-0824 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0824 · Vendor Advisory
• http://source.android.com/security/bulletin/2016-03-01.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0824 · Security Note
• https://bdu.fstec.ru/vul/2016-00885 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-0824 · Security Note
• https://ubuntu.com/security/CVE-2016-0824 · Vendor Advisory
• https://android.googlesource.com/platform/external/libmpeg2/+/ffab15eb80630dc799eb410855c93525b75233c3 · Note
• http://securityfocus.com/bid/84262 · Note