PT-2016-1718 · Google · Android

Heisecode + 1 · Published 2016-04-18 · Updated 2016-04-21 · CVE-2016-2414

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Android versions 5.0.0 through 5.0.1 Android versions 5.1.0 through 5.1.0 Android versions 6.0.0 through 2016-03-31

Description The issue exists due to the lack of validation for negative font property values in the Minikin library of the Android operating system. Exploitation of this issue can allow a local attacker to cause a denial of service (memory corruption) using a specially crafted font. Remote attackers can also cause a denial of service (memory corruption and reboot loop) via a crafted font.

Recommendations For Android versions 5.0.0 through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.0 through 5.1.0, update to version 5.1.1 or later. For Android versions 6.0.0 through 2016-03-31, apply the patch available as of 2016-04-01.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01044

CVE-2016-2414

Affected Products

Android

References · 10

• https://osv.dev/vulnerability/UBUNTU-CVE-2016-2414 · Vendor Advisory
• http://source.android.com/security/bulletin/2016-04-02.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-2414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2414 · Security Note
• https://bdu.fstec.ru/vul/2016-01044 · Security Note
• https://cve.org/CVERecord?id=CVE-2016-2414 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2414 · Vendor Advisory
• https://android.googlesource.com/platform/frameworks/minikin/+/ca8ac8acdad662230ae37998c6c4091bb39402b6 · Note
• https://android.googlesource.com/platform/frameworks/minikin/+/f4785aa1947b8d22d5b19559ef1ca526d98e0e73 · Note
• https://code.google.com/p/android/issues/detail?id=192618 · Note