CVE-2016-3861
HighSummary
LibUtils in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, allowing remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file.
Risk Assessment
This vulnerability can lead to serious consequences such as remote code execution or system crashes, posing a threat to the integrity and availability of organizational systems.
Recommendation
It is recommended to update the Android system to the latest version to mitigate this vulnerability and to monitor systems for suspicious activity.
Other vulnerabilities in LibUtils
See all- CVE-2017-0841High
A remote code execution vulnerability exists in the Android system (libutils). Affects Android versions from 5.0.2 to 8.0.
- CVE-2015-6609High
The libutils library in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file.
- CVE-2015-3875High
libutils in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file.
- CVE-2015-6602High
libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.
Original NVD description (English source)
LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.