CVE-2016-6706: Critical severity Google Android vulnerability
An elevation of privilege vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-31385713.
Affected Software
Remediation
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Devices running Android 7.0 before the 2016-11-01 security update are affected. Exploitation requires a malicious application to run locally on the device.
What could an attacker gain by exploiting it?
A local malicious application could execute arbitrary code in the context of the privileged Mediaserver process. This could give it access to elevated capabilities that are not normally available to third-party applications.
Is user interaction required?
Yes. The supplied CVSS vector indicates that user interaction is required, although the specific interaction is not described.
How can this issue be remediated?
Apply the available Android security patch associated with the 2016-11-01 update. The issue is tracked as Android ID A-31385713.