CVE-2016-0827: Integer Overflow

Published Mar 12, 2016

Updated

Multiple integer overflows in libeffects in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, related to EffectBundle.cpp and EffectReverb.cpp, aka internal bug 26347509.

Affected Software

24 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.0.2

Google Android=5.1

Google Android=5.1.0

Google Android=5.1.1

Google Android=6.0

Google Android=6.0.1

Event History

Mar 12, 2016

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0827?

CVE-2016-0827 is rated as a high severity vulnerability due to potential privilege escalation risks.

How do I fix CVE-2016-0827?

To mitigate CVE-2016-0827, update your Android device to the latest version that addresses this vulnerability.

Which versions of Android are affected by CVE-2016-0827?

CVE-2016-0827 affects Android versions 4.0 through 6.0.1 before the March 2016 security patch.

What types of attacks are possible with CVE-2016-0827?

Exploitation of CVE-2016-0827 could allow an attacker to gain elevated privileges through a crafted application.

Can CVE-2016-0827 be exploited remotely?

CVE-2016-0827 requires a local application to be installed for exploitation, so remote exploitation is not possible.