CVE-2016-0840
HighSummary
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Risk Assessment
This vulnerability may lead to remote code execution, posing a serious security risk to the system and user data. It may also result in service outages, affecting application availability.
Recommendation
It is recommended to update the Android system to a version after 2016-04-01 to mitigate this vulnerability. Additionally, avoid opening unknown or suspicious media files.
Other vulnerabilities in mediaserver in Android 6.x
See all- CVE-2016-2478High
The omx_vdec_msm8974.cpp file in mediaserver in Android has a pointer mishandling issue that may allow attackers to gain privileges via a crafted application.
- CVE-2016-2477High
The omx_vdec_msm8974.cpp file in mediaserver in Android has a pointer mishandling issue that allows attackers to gain privileges via a crafted application.
- CVE-2016-0828High
The BnGraphicBufferConsumer::onTransact function in mediaserver in Android 5.x before version 5.1.1 LMY49H and 6.x before March 1, 2016, does not initialize a certain slot variable. This allows attackers to obtain sensitive information and bypass an unspecified protection mechanism by triggering an ATTACH_BUFFER action.
- CVE-2016-0804Critical
The NuPlayer::GenericSource::notifyPreparedAndCleanup function in mediaserver in Android 5.x before version 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects. This allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
Original NVD description (English source)
Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26399350.