CVE-2015-6616: Buffer Overflow
Published Dec 7, 2015
·Updated
mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and 23882800, a different vulnerability than CVE-2015-8505, CVE-2015-8506, and CVE-2015-8507.
Affected Software
3 affected components
Google Android>=5.0<5.1.1
Google Android=6.0
Google Android
Event History
Dec 7, 2015
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityAffected Software
Dec 8, 2015
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
Which Android releases are affected?
Android versions before 5.1.1 build LMY48Z and Android 6.0 versions before the 2015-12-01 security update are affected.
2
What does an attacker need to exploit this issue?
An attacker needs to provide a crafted media file. The vulnerability can be exploited remotely and does not require authentication.
3
What is the potential impact?
Successful exploitation can cause memory corruption, which may allow arbitrary code execution or a denial of service with confidentiality, integrity, and availability impact.