CVE-2016-6713: Medium severity Google Android vulnerability
A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-30822755.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Android Mediaserverto a version that resolves this vulnerability.Patch A-30822755
Event History
Frequently Asked Questions
Which Android devices are affected?
Devices running Android 6.x or Android 7.0 are affected if they do not include the 2016-11-01 security updates. The affected component is Mediaserver.
What must an attacker do to trigger the issue?
An attacker needs to cause the device to process a specially crafted file. User interaction is required according to the CVSS vector, while the attacker does not need prior privileges on the device.
What is the practical impact?
Successful exploitation can hang or reboot the device, resulting in denial of service. The provided information does not indicate confidentiality or integrity impact.
How can I determine whether a device is remediated?
Check whether the device has the Android security update dated 2016-11-01 or later. Devices on the affected Android releases without that update should be treated as vulnerable.