CVE-2016-0815: Input Validation

Published Mar 12, 2016

Updated

The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.

Affected Software

24 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Event History

Mar 12, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0815?

CVE-2016-0815 has a high severity due to its potential to allow remote code execution and denial of service.

What software versions are affected by CVE-2016-0815?

CVE-2016-0815 affects Android versions 4.x before 4.4.4, 5.x before 5.1.1, and 6.x before 2016-03-01.

How do I fix CVE-2016-0815?

To fix CVE-2016-0815, users should update their devices to the latest Android version released by Google.

What impact does CVE-2016-0815 have on Android devices?

CVE-2016-0815 can cause memory corruption, allowing attackers to execute arbitrary code remotely.

Is there a workaround for CVE-2016-0815?

There are no specific workarounds for CVE-2016-0815 other than updating to a secure version of Android.