CVE-2016-2451
HighSummary
In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.
Risk Assessment
Attackers can gain access to sensitive privileges, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update the Android system to the latest version to eliminate this vulnerability and ensure proper validation of output buffers.
Other vulnerabilities in libstagefright
See all- CVE-2017-0409High
CVE-2017-0409 is a vulnerability in the libstagefright library that allows an attacker to execute arbitrary code remotely using a specially crafted file in the context of an unprivileged process. This issue is rated as High due to the potential for remote code execution in applications using this library.
- CVE-2016-3872High
Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.
- CVE-2016-3863High
Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.
- CVE-2016-3824High
The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.
- CVE-2016-2507High
Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.
- CVE-2016-2485High
libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and before June 1, 2016, does not validate OMX buffer sizes for GSM and G711 codecs. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2814High
A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.
- CVE-2016-0842High
The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2015-6620High
libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
- CVE-2015-6610High
The vulnerability in libstagefright in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.
Original NVD description (English source)
codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27597103.