CVE-2016-2479

High

Published: 13/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The mm-video-v4l2 vdec component in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before June 1, 2016 mishandles a buffer count, allowing attackers to gain privileges via a crafted application.

Risk Assessment

Attackers can obtain Signature or SignatureOrSystem access, posing a serious threat to system security and user data.

Recommendation

It is recommended to update the Android system to the latest version to mitigate this vulnerability and reduce the risk of attacks.

Other vulnerabilities in mm-video-v4l2 vdec in mediaserver

CVE-2016-3746High
Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows attackers to gain privileges via a crafted application.

Original NVD description (English source)

The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532282.