CVE-2017-0587: Buffer Overflow
A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35219737.
Affected Software
Event History
Frequently Asked Questions
Which Android versions are identified as affected?
The affected versions listed are Android 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
What does an attacker need to exploit this issue?
An attacker needs to get a specially crafted media file or data processed by Mediaserver. The CVSS vector indicates local attack vector, no privileges required, and user interaction required.
What is the likely impact if exploitation succeeds?
Successful exploitation can cause memory corruption and potentially remote code execution in the context of the Mediaserver process. Confidentiality, integrity, and availability impacts are each rated high in the supplied CVSS vector.
How can I identify this vulnerability in tracking or remediation records?
Use Android issue ID A-35219737 or CVE-2017-0587. The issue is a buffer overflow in libmpeg2 used by Mediaserver.