CVE-2016-2463: Buffer Overflow

Published Jun 6, 2016

Updated

Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419.

Affected Software

23 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Google Android

Event History

Jun 6, 2016

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Jun 13, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2463?

CVE-2016-2463 has a high severity rating due to its potential for remote code execution and denial of service.

How do I fix CVE-2016-2463?

To fix CVE-2016-2463, update to the latest version of Android that is patched against this vulnerability.

What versions of Android are affected by CVE-2016-2463?

CVE-2016-2463 affects Android 4.x through 6.x versions up to June 1, 2016.

What type of vulnerability is CVE-2016-2463?

CVE-2016-2463 is an integer overflow vulnerability in the h264dec component of libstagefright.

How can attackers exploit CVE-2016-2463?

Attackers can exploit CVE-2016-2463 by sending a crafted media file to the vulnerable Android device.