CVE-2016-3747: Use After Free

Published Jul 11, 2016

Updated

Use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27903498.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Event History

Jul 11, 2016

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3747?

CVE-2016-3747 has a high severity rating due to its potential to allow attackers to gain elevated privileges.

How do I fix CVE-2016-3747?

To fix CVE-2016-3747, it is recommended to update your Android device to the latest version that includes security patches.

Which versions of Android are affected by CVE-2016-3747?

CVE-2016-3747 affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016.

What type of attack can exploit CVE-2016-3747?

CVE-2016-3747 can be exploited through a crafted application that triggers a use-after-free vulnerability in the mediaserver.

Is there a workaround for CVE-2016-3747?

There is no official workaround for CVE-2016-3747; updating to a patched version is the best course of action.