CVE-2016-6714: Medium severity Google Android vulnerability
A remote denial of service vulnerability in Mediaserver in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Android ID: A-31092462.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Android Mediaserverto a version that resolves this vulnerability.Patch 2016-11-01
Event History
Frequently Asked Questions
Which Android devices are affected?
Devices running Android 6.x or Android 7.0 are affected if they had not received the 2016-11-01 security updates.
What does an attacker need to exploit this issue?
An attacker needs to get a user to process a specially crafted file. The CVSS vector indicates no privileges are required, but user interaction is required.
What is the expected impact of successful exploitation?
Successful exploitation can cause the device to hang or reboot, resulting in a denial of service. The provided CVSS vector indicates no confidentiality or integrity impact.
What should be done to remediate the issue?
Apply the Android security updates dated 2016-11-01 or later for the affected Android release. The issue is tracked as Android ID A-31092462.