CVE-2016-2417: Critical severity android vulnerability

Published Apr 18, 2016

Updated

media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Event History

Apr 18, 2016

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2417?

CVE-2016-2417 is classified as a high severity vulnerability due to its potential to allow attackers to access sensitive information from process memory.

How do I fix CVE-2016-2417?

To fix CVE-2016-2417, upgrade your Android version to 4.4.4, 5.0.2, 5.1.1, or later versions that include security patches.

What versions of Android are affected by CVE-2016-2417?

CVE-2016-2417 affects Android versions prior to 4.4.4, 5.0.2, 5.1.1, and 6.0.1.

What does CVE-2016-2417 exploit in Android?

CVE-2016-2417 exploits an uninitialized parameter in the IOMX.cpp file in mediaserver, leading to potential sensitive information disclosure.

Is CVE-2016-2417 a remote attack vulnerability?

CVE-2016-2417 is not classified as a remote attack vulnerability, as it requires local access to exploit the memory vulnerability.