CVE-2016-3819: Buffer Overflow

Published Aug 5, 2016

Updated

Integer overflow in codecs/on2/h264dec/source/h264bsddpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Remediation

Patch Available

https://android.googlesource.com/platform/frameworks/av/+/590d1729883f700ab905cdc9ad850f3ddd7e1f56

Event History

Aug 5, 2016

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3819?

CVE-2016-3819 has been classified as critical due to its potential to allow remote code execution or denial of service.

How do I fix CVE-2016-3819?

To fix CVE-2016-3819, users should update their Android devices to the latest available version, specifically versions 4.4.4, 5.0.2, 5.1.1, or later.

Which versions of Android are affected by CVE-2016-3819?

CVE-2016-3819 affects Android versions prior to 4.4.4, 5.0.2, 5.1.1, and 6.x before August 1, 2016.

What type of attack can exploit CVE-2016-3819?

CVE-2016-3819 can be exploited through crafted media files, potentially leading to memory corruption.

Who can exploit CVE-2016-3819?

Any remote attacker with the ability to send crafted media files to unpatched Android devices can exploit CVE-2016-3819.