CVE-2017-0542: Buffer Overflow
A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33934721.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which Android devices and components are affected?
Devices running Android 6.0, 6.0.1, 7.0, or 7.1.1 are identified as affected. The vulnerable component runs in the Mediaserver process during media file and data processing.
What does an attacker need to exploit this issue?
An attacker needs to induce processing of a specially crafted media file or data. User interaction is required according to the CVSS vector, while no privileges are required.
What is the potential impact of successful exploitation?
Successful exploitation can cause memory corruption and may enable remote code execution in the context of the Mediaserver process. The reported impacts include high confidentiality, integrity, and availability effects.
What should be done to remediate the vulnerability?
A patch is available. Apply the applicable Android security update containing the fix for Android ID A-33934721.