CVE-2016-2413
HighSummary
The IOMX.cpp file in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, does not initialize a handle pointer, allowing attackers to gain privileges via a crafted application.
Risk Assessment
Attackers can obtain Signature or SignatureOrSystem access, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update the Android system to the latest version to eliminate this vulnerability and minimize the risk of unauthorized access.
Other vulnerabilities in media/libmedia/IOMX.cpp
See all- CVE-2016-2418Critical
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
- CVE-2016-2417Critical
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
Original NVD description (English source)
media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627.