CVE-2016-0842
HighSummary
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Risk Assessment
This vulnerability could lead to remote code execution, posing a serious security threat to devices and user data. It may also result in system crashes.
Recommendation
It is recommended to update the Android system to a version after 2016-04-01 to mitigate this vulnerability. Additionally, avoid opening unknown media files.
Other vulnerabilities in libstagefright
See all- CVE-2017-0409High
CVE-2017-0409 is a vulnerability in the libstagefright library that allows an attacker to execute arbitrary code remotely using a specially crafted file in the context of an unprivileged process. This issue is rated as High due to the potential for remote code execution in applications using this library.
- CVE-2016-3872High
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
- CVE-2016-3863High
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
- CVE-2016-3824High
The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2507High
Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
- CVE-2016-2485High
libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and before June 1, 2016, does not validate OMX buffer sizes for GSM and G711 codecs. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2451High
In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2814High
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
- CVE-2015-6620High
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
- CVE-2015-6610High
The vulnerability in libstagefright in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.
Original NVD description (English source)
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142.