CVE-2016-2439: Buffer Overflow
Published May 2, 2016
·Updated
Buffer overflow in btif/src/btifdm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.
Affected Software
23 affected components
Google Android=4.0
Google Android=4.0.1
Google Android=4.0.2
Google Android=4.0.3
Google Android=4.0.4
Google Android=4.1
Google Android=4.1.2
Google Android=4.2
Google Android=4.2.1
Google Android=4.2.2
Google Android=4.3
Google Android=4.3.1
Google Android=4.4
Google Android=4.4.1
Google Android=4.4.2
Google Android=4.4.3
Google Android=5.0
Google Android=5.0.1
Google Android=5.1
Google Android=5.1.0
Google Android=6.0
Google Android=6.0.1
Google Android
Event History
May 2, 2016
CVE Published
via Android·12:00 AM
Data Sourced
via Android·12:00 AM
SeverityAffected Software
May 9, 2016
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-2439?
CVE-2016-2439 has been classified as a critical vulnerability due to the potential for remote code execution.
2
How do I fix CVE-2016-2439?
To fix CVE-2016-2439, update your Android device to a version released after May 1, 2016.
3
What versions of Android are affected by CVE-2016-2439?
CVE-2016-2439 affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before May 1, 2016.
4
What type of attack does CVE-2016-2439 facilitate?
CVE-2016-2439 allows remote attackers to execute arbitrary code via a long PIN value.
5
Is there a specific component of Android that CVE-2016-2439 targets?
CVE-2016-2439 targets the Bluetooth component of Android, specifically the btif/src/btif_dm.c file.