First published: Sun Feb 07 2016(Updated: )
libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.
Credit: security@android.com
Affected Software | Affected Version | How to fix |
---|---|---|
Google Android | =4.0 | |
Google Android | =4.0.1 | |
Google Android | =4.0.2 | |
Google Android | =4.0.3 | |
Google Android | =4.0.4 | |
Google Android | =4.1 | |
Google Android | =4.1.2 | |
Google Android | =4.2 | |
Google Android | =4.2.1 | |
Google Android | =4.2.2 | |
Google Android | =4.3 | |
Google Android | =4.3.1 | |
Google Android | =4.4 | |
Google Android | =4.4.1 | |
Google Android | =4.4.2 | |
Google Android | =4.4.3 | |
Google Android | =4.4.4 | |
Google Android | =5.0 | |
Google Android | =5.0.1 | |
Google Android | =5.0.2 | |
Google Android | =5.1 | |
Google Android | =5.1.0 | |
Google Android | =5.1.1 | |
Google Android | =6.0 | |
Google Android | =6.0.1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2016-0803 has a high severity rating due to the potential for remote code execution and denial of service.
To fix CVE-2016-0803, upgrade to the latest version of Android that is not affected by this vulnerability.
Android versions 4.x before 4.4.4, 5.x before 5.1.1, and 6.x before February 1, 2016 are vulnerable to CVE-2016-0803.
CVE-2016-0803 can be exploited through a crafted media file that triggers large memory allocation vulnerabilities.
Users of affected Android versions, especially those running older versions before the fixes were released, are at risk from CVE-2016-0803.