CVE-2016-0826: Critical severity android vulnerability

Published Mar 12, 2016

Updated

libcameraservice in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 does not require use of the ICameraService::dump method for a camera service dump, which allows attackers to gain privileges via a crafted application that directly dumps, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26265403.

Affected Software

24 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Event History

Mar 12, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0826?

CVE-2016-0826 is considered a high severity vulnerability due to potential privilege escalation through crafted applications.

How do I fix CVE-2016-0826?

To fix CVE-2016-0826, update your Android version to 4.4.4, 5.1.1 LMY49H, or later, as these versions include security patches.

What impact does CVE-2016-0826 have on Android devices?

CVE-2016-0826 allows attackers to gain elevated privileges on affected Android devices by leveraging a flaw in the camera service.

Which versions of Android are affected by CVE-2016-0826?

CVE-2016-0826 affects Android versions 4.x before 4.4.4, 5.x before 5.1.1, and 6.x before March 1, 2016.

Is there an exploit available for CVE-2016-0826?

Yes, CVE-2016-0826 can be exploited through a crafted application that triggers the vulnerability in the camera service.