CVE-2016-2417
CriticalSummary
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
Risk Assessment
Attackers may bypass an unspecified protection mechanism, potentially leading to the disclosure of confidential data such as access to Signature or SignatureOrSystem.
Recommendation
It is recommended to update the Android system to the latest version to mitigate this vulnerability and protect sensitive data.
Original NVD description (English source)
media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.