libstagefright vulnerabilities

CVE-2017-0409 is a vulnerability in the libstagefright library that allows an attacker to execute arbitrary code remotely using a specially crafted file in the context of an unprivileged process. This issue is rated as High due to the potential for remote code execution in applications using this library.

Buffer overflow in SoftVPX.cpp in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, 2016-09-01 for 6.x, and 2016-09-01 for 7.0 allows attackers to gain privileges via a crafted application.

Multiple stack-based buffer overflows in the AVCC reassembly implementation in libstagefright in Android allow remote attackers to execute arbitrary code via a crafted media file.

The OMXNodeInstance.cpp file in libstagefright in mediaserver in Android versions before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, allowing attackers to gain privileges via a crafted application.

Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

libstagefright in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and before June 1, 2016, does not validate OMX buffer sizes for GSM and G711 codecs. This allows attackers to gain privileges via a crafted application.

In libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before May 1, 2016, VPX output buffer sizes are not validated, allowing attackers to gain privileges via a crafted application.

A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 46.0, Firefox ESR 38.x before 38.8, and Firefox ESR 45.x before 45.1 allows remote attackers to execute arbitrary code via crafted CENC offsets that lead to mismanagement of the sizes table.

The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before 5.1.1 LMY48Z and 6.0 before December 1, 2015, allows attackers to gain privileges via a crafted application. This can lead to obtaining Signature or SignatureOrSystem access.

The vulnerability in libstagefright in Android before version 5.1.1 LMY48X and 6.0 before November 1, 2015, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application.

libstagefright in Android 5.x before 5.1.1 LMY48T has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

The vulnerability in libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

The vulnerability in libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

The vulnerability in libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

The libstagefright library in Android before version 5.1.1 LMY48T has a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

Libstagefright in Android before version 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

A vulnerability in libstagefright in Android through version 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.

In SampleTable.cpp in libstagefright in Android before version 5.1.1 LMY48I, integer promotion is not properly considered, allowing remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data.

CVE-2015-3864 involves an integer underflow in the MPEG4Extractor::parseChunk function in libstagefright, allowing remote attackers to execute arbitrary code via crafted MPEG-4 data. This issue exists due to an incomplete fix for CVE-2015-3824.

Buffer overflow in the OMXNodeInstance::emptyBuffer function in libstagefright in Android before version 5.1.1 LMY48I allows attackers to execute arbitrary code via a crafted application.

Multiple integer overflows in the BnHDCP::onTransact function in IHDCP.cpp in libstagefright in Android before version 5.1.1 LMY48I may allow attackers to execute arbitrary code via a crafted application using HDCP encryption, leading to a heap-based buffer overflow.

Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before version 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data.

Off-by-one error in the MPEG4Extractor::parseChunk function in libstagefright in Android before version 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX.

The MPEG4Extractor::parse3GPPMetaData function in libstagefright in Android before version 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM). This allows remote attackers to execute arbitrary code or cause a denial of service via crafted 3GPP metadata.

The MPEG4Extractor::parseChunk function in libstagefright in Android before version 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, allowing remote attackers to execute arbitrary code or cause a denial of service.

The MPEG4Extractor::parseChunk function in libstagefright in Android before version 5.1.1 LMY48I does not properly restrict size addition, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted MPEG-4 tx3g atom.

Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before version 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms.

Integer overflow in the SampleTable::setSampleToChunkParams function in libstagefright in Android before version 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication.

Integer overflow in SampleTable.cpp in libstagefright in Android before version 5.0.0 may lead to unspecified impact and attack vectors.

Integer overflow in SampleTable.cpp in libstagefright in Android before 5.0.0 has unspecified impact and attack vectors.

Integer overflow in SampleTable.cpp in libstagefright in Android before version 5.0.0 may lead to unspecified impacts and attack vectors.

Multiple integer overflows in libstagefright in Mozilla Firefox before version 38.0 allow remote attackers to execute arbitrary code via crafted sample metadata in an MPEG-4 video file.

A heap-based buffer overflow in the libstagefright library in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 allows remote attackers to execute arbitrary code via an invalid size field in an esds chunk in MPEG-4 video data.

Multiple integer overflows in libstagefright in Mozilla Firefox before version 40.0 and Firefox ESR 38.x before version 38.2 allow remote attackers to execute arbitrary code via a crafted saio chunk in MPEG-4 video data.

Integer overflow in h264bsd_dpb.c in libstagefright in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

The MPEG4Source::fragmentedRead function in libstagefright in Android before version 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before March 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.

The MoofParser::Metadata function in libstagefright in Mozilla Firefox before version 44.0 does not limit the size of read operations, which may allow remote attackers to cause a denial of service (integer overflow and buffer overflow) or possibly have unspecified other impact via crafted metadata.