PT-2016-2557 · Google · Android

Published 2016-08-05 · Updated 2016-11-28 · CVE-2016-3830

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Android versions prior to 4.4.4 Android versions 5.0.x prior to 5.0.2 Android versions 5.1.x prior to 5.1.1 Android versions 6.x before 2016-08-01

Description The issue exists due to insufficient input validation in the codecs/aacdec/SoftAAC2.cpp method of the libstagefright media server library in the Android operating system. This can be exploited by a remote attacker to cause a denial of service, resulting in device hang or reboot, by using specially crafted ADTS data.

Recommendations For Android versions prior to 4.4.4, update to version 4.4.4 or later. For Android versions 5.0.x prior to 5.0.2, update to version 5.0.2 or later. For Android versions 5.1.x prior to 5.1.1, update to version 5.1.1 or later. For Android versions 6.x before 2016-08-01, update to a version released after 2016-08-01.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-01949

CVE-2016-3830

Affected Products

Android

References · 9

• https://android.googlesource.com/platform/frameworks/av/+/8e438e153f661e9df8db0ac41d587e940352df06 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3830 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-3830 · Security Note
• https://bdu.fstec.ru/vul/2016-01949 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3830 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3830 · Security Note
• http://source.android.com/security/bulletin/2016-08-01.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-3830 · Vendor Advisory
• http://securityfocus.com/bid/92221 · Note