CVE-2016-0803: Buffer Overflow

Published Feb 7, 2016

Updated

libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.

Affected Software

25 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=4.4.4

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Event History

Feb 7, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0803?

CVE-2016-0803 has a high severity rating due to the potential for remote code execution and denial of service.

How do I fix CVE-2016-0803?

To fix CVE-2016-0803, upgrade to the latest version of Android that is not affected by this vulnerability.

What versions of Android are vulnerable to CVE-2016-0803?

Android versions 4.x before 4.4.4, 5.x before 5.1.1, and 6.x before February 1, 2016 are vulnerable to CVE-2016-0803.

What kind of exploit is associated with CVE-2016-0803?

CVE-2016-0803 can be exploited through a crafted media file that triggers large memory allocation vulnerabilities.

Who is impacted by CVE-2016-0803?

Users of affected Android versions, especially those running older versions before the fixes were released, are at risk from CVE-2016-0803.