PT-2016-1763 · Google · Android+1

Anestisb · Published 2016-04-18 · Updated 2016-04-20 · CVE-2016-0842

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Android 6.x versions prior to 2016-04-01

Description The issue exists due to the incorrect handling of Memory Management Control Operation (MMCO) data by the H.264 decoder in the libstagefright library of the Android operating system. This can be exploited by a remote attacker using a specially crafted media file, potentially allowing the execution of arbitrary code or causing a denial of service due to memory corruption.

Recommendations For Android 6.x versions prior to 2016-04-01, update the operating system to a version released after 2016-04-01 to resolve the issue. As a temporary workaround, consider avoiding the use of the H.264 decoder in libstagefright until a patch is available. Restrict access to media files from untrusted sources to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2016-01089

CVE-2016-0842

Affected Products

Android

Libstagefright

References · 8

• http://source.android.com/security/bulletin/2016-04-02.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-0842 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0842 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01089 · Security Note
• https://android.googlesource.com/platform/external/libavc/+/943323f1d9d3dd5c2634deb26cbe72343ca6b3db · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-0842 · Security Note
• https://ubuntu.com/security/CVE-2016-0842 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-0842 · Vendor Advisory