CVE-2016-0828
HighSummary
The BnGraphicBufferConsumer::onTransact function in mediaserver in Android 5.x before version 5.1.1 LMY49H and 6.x before March 1, 2016, does not initialize a certain slot variable. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism by triggering an ATTACH_BUFFER action.
Risk Assessment
Attackers may gain access to sensitive data, potentially leading to serious security breaches in the Android system. This poses risks to user privacy and system integrity.
Recommendation
It is recommended to update the Android system to version 5.1.1 LMY49H or later to mitigate this vulnerability. Regular software updates are crucial for maintaining security.
Other vulnerabilities in mediaserver in Android
See all- CVE-2016-2478High
The omx_vdec_msm8974.cpp file in mediaserver in Android has a pointer mishandling issue that may allow attackers to gain privileges via a crafted application.
- CVE-2016-2477High
The omx_vdec_msm8974.cpp file in mediaserver in Android has a pointer mishandling issue that allows attackers to gain privileges via a crafted application.
- CVE-2016-0840High
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2016-0804Critical
The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
Original NVD description (English source)
The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.