CVE-2016-3745: Buffer Overflow

Published Jul 11, 2016

Updated

Multiple buffer overflows in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides an AudioEffect reply, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 28173666.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Event History

Jul 11, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3745?

CVE-2016-3745 has a high severity due to multiple buffer overflows that allow privilege escalation.

How do I fix CVE-2016-3745?

To fix CVE-2016-3745, update your Android device to a version later than 6.0.1 or apply the relevant security patches.

What systems are affected by CVE-2016-3745?

CVE-2016-3745 affects Android versions 4.x through 6.x, specifically versions before the July 2016 security update.

What type of vulnerability is CVE-2016-3745?

CVE-2016-3745 is categorized as a buffer overflow vulnerability impacting the mediaserver component of Android.

What can be exploited through CVE-2016-3745?

CVE-2016-3745 can be exploited by attackers to gain elevated privileges via malicious apps that provide crafted AudioEffect replies.