CVE-2016-2506: Buffer Overflow

Published Jul 11, 2016

Updated

DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate a certain offset value, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28175045.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Event History

Jul 11, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2506?

The severity of CVE-2016-2506 is considered high due to the potential for remote code execution or denial of service.

How do I fix CVE-2016-2506?

To fix CVE-2016-2506, update your Android device to a version that includes the security patch released on or after July 1, 2016.

What versions of Android are affected by CVE-2016-2506?

CVE-2016-2506 affects Android versions 4.x up to 6.0.1 before the July 2016 patch.

What type of attack is possible with CVE-2016-2506?

An attacker can exploit CVE-2016-2506 to execute arbitrary code remotely or cause memory corruption leading to a denial of service.

Is there a workaround for CVE-2016-2506?

There are no specific workarounds for CVE-2016-2506; the best approach is to apply the available security updates.