CVE-2016-1503

Critical

Published: 18/04/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

dhcpcd versions before 6.10.0, used in Android 4.x to 6.x, mismanage option lengths, allowing remote attackers to execute arbitrary code or cause a denial of service via a malformed DHCP response.

Risk Assessment

Organizations may be exposed to remote attacks that could lead to system takeover or disruption of service.

Recommendation

It is recommended to update dhcpcd to version 6.10.0 or later to mitigate this vulnerability.

Original NVD description (English source)

dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.