CVE-2017-0594
HighSummary
CVE-2017-0594 is a privilege escalation vulnerability in libstagefright in Mediaserver that could allow a local malicious application to execute arbitrary code within the context of a privileged process.
Risk Assessment
This issue could enable malicious applications to gain access to elevated capabilities, posing a risk to the security of the Android system.
Recommendation
It is recommended to update the Android system to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in libstagefright in Mediaserver
See all- CVE-2016-6699High
CVE-2016-6699 is a remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before November 1, 2016. An attacker can exploit a specially crafted file to cause memory corruption during media file processing.
- CVE-2016-3871High
Multiple buffer overflows in SoftMP3.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allow attackers to gain privileges via a crafted application.
- CVE-2016-3870High
The omx/SimpleSoftOMXComponent.cpp file in libstagefright in mediaserver in Android contains a vulnerability that does not prevent input-port changes. This allows attackers to gain privileges via a crafted application.
- CVE-2016-3766High
The MPEG4Extractor.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, does not check if memory allocation succeeds. This allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file.
- CVE-2016-2505High
In libstagefright in mediaserver in Android 6.x before 2016-07-01, a certain section length is not validated, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
- CVE-2016-2487High
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before June 1, 2016, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.
- CVE-2016-2486High
In libstagefright in mediaserver in Android, there is a vulnerability that does not validate the relationship between allocated memory and frame size. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2452High
In libstagefright in mediaserver in Android, there is a vulnerability that does not validate buffer sizes in SoftAMR.cpp. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2450High
In libstagefright in mediaserver in Android, there is a vulnerability that does not validate OMX buffer sizes. This allows attackers to gain privileges via a crafted application.
- CVE-2016-2506Critical
The DRMExtractor.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, does not validate a certain offset value. This allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Original NVD description (English source)
An elevation of privilege vulnerability in codecs/aacenc/SoftAACEncoder2.cpp in libstagefright in Mediaserver could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34617444.