CVE-2016-2418
CriticalSummary
The IOMX.cpp file in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, allowing attackers to obtain sensitive information from process memory.
Risk Assessment
Attackers may bypass an unspecified protection mechanism, potentially leading to data exposure such as Signature or SignatureOrSystem access.
Recommendation
It is recommended to update Android to a version after 2016-04-01 to mitigate this vulnerability.
Other vulnerabilities in media/libmedia/IOMX.cpp
See all- CVE-2016-2413High
The IOMX.cpp file in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016, does not initialize a handle pointer, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2417Critical
The IOMX.cpp file in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before April 1, 2016, does not initialize a parameter data structure, allowing attackers to obtain sensitive information from process memory.
Original NVD description (English source)
media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.