UBUNTU-CVE-2016-2451

codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining...

UBUNTU-CVE-2016-2429

libFLAC/streamdecoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service heap memory corrupti...

CVE-2016-2450

codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining...

CVE-2016-2459

CVE-2016-2459 affects mediaserver in Android 4.x up to 4.4.3, 5.0.x up to 5.0.1/2, 5.1.x up to 5.1.0/1, and 6.x prior to 2016-05-01. The root cause is that certain data structures are not initialized, enabling an attacker to disclose sensitive information via a crafted application. The vulnerabil...

CVE-2016-2428

libAACdec/src/aacdecdrc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service stack memory corruption via...

CVE-2016-2428

CVE-2016-2428 affects Android mediaserver: libAACdec/src/aacdec_drc.cpp in mediaserver allows a crafted media file to cause memory corruption via inadequate thread limiting, enabling remote code execution or a denial of service. Affected Android releases: 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1...

CVE-2016-2429

libFLAC/streamdecoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service heap memory corrupti...

CVE-2016-2449

CVE-2016-2449 affects Android mediaserver: Camera3Device.cpp in mediaserver allows privilege escalation due to not validating template IDs, enabling a crafted app to gain Signature or SignatureOrSystem access. Affected: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before ...

CVE-2016-2448

media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as...

CVE-2016-2460

mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and...

CVE-2016-2449

services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtainin...

CVE-2016-2459

mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and...

CVE-2016-2451

CVE-2016-2451 affects Android Mediaserver (libstagefright) and its VPX handling in SoftVPX.cpp. The vulnerability arises from not validating VPX output buffer sizes, enabling local privilege escalation to Signature or SignatureOrSystem via a crafted application. Affected Android versions: 4.x bef...

CVE-2016-2450

codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining...

CVE-2016-2448

CVE-2016-2448 affects Android mediaserver’s NuPlayerStreamListener.cpp (NuPlayer in mediaserver). The issue is improper validation of entry data structures, enabling a local attacker to escalate privileges to Signature or SignatureOrSystem via a crafted app. Affected are Android 4.x before 4.4.4,...

CVE-2016-2452

CVE-2016-2452 affects Android mediaserver (libstagefright) — specifically codecs/amrnb/dec/SoftAMR.cpp — where buffer sizes are not properly validated. The issue resides in the AMR-NB decoding path and can allow a local attacker to escalate privileges to Signature or SignatureOrSystem by deliveri...

CVE-2016-2429

CVE-2016-2429 affects libFLAC/stream_decoder.c in mediaserver on Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01. Root cause: free operations on uninitialized memory in mediaserver’s decoder path. Impact: remote code execution or denial of service via a...

CVE-2016-2460

CVE-2016-2460 is an information-disclosure vulnerability in Android’s mediaserver. Affected: Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x prior to 2016-05-01. Root cause: mediaserver fails to initialize certain data structures in the IGraphicBufferConsumer.cpp/IGraphicBu...

Android Mediaserver Information Disclosure Vulnerability (CNVD-2016-02844)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA in the U.S. Mediaserver is one of the multimedia service components. An information disclosure vulnerability exists in Android's Mediaserver, which can be exploited by attackers to...

Android Mediaserver Arbitrary Code Execution Vulnerability (CNVD-2016-02841)

Android is a Linux-based open source operating system developed by Google and the Open Handset Alliance OHA, of which Mediaserver is a multimedia service component. An arbitrary code execution vulnerability exists in Android's Mediaserver, which can be exploited by remote attackers to cause memor...