Google Android up to 4.4.3/5.0.1/5.1.0/6.x Mediaserver MetadataRetrieverClient.cpp Pointer input validation

Summaryinfo

A vulnerability was found in Google Android up to 4.4.3/5.0.1/5.1.0/6.x and classified as problematic. This vulnerability affects unknown code in the library media/libmediaplayerservice/MetadataRetrieverClient.cpp of the component Mediaserver. Executing a manipulation can lead to input validation (Pointer). This vulnerability is registered as CVE-2016-3764. The attack needs to be launched locally. No exploit is available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Google Android up to 4.4.3/5.0.1/5.1.0/6.x (Smartphone Operating System) and classified as problematic. This vulnerability affects an unknown code in the library media/libmediaplayerservice/MetadataRetrieverClient.cpp of the component Mediaserver. The manipulation with an unknown input leads to a input validation vulnerability (Pointer). The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. As an impact it is known to affect confidentiality. CVE summarizes:

media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.

The weakness was published 07/06/2016 as Android Security Bulletin - July 2016 as confirmed security bulletin (Website). The advisory is shared for download at source.android.com. This vulnerability was named CVE-2016-3764 since 03/30/2016. The exploitation appears to be easy. The attack needs to be approached locally. A single authentication is needed for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.4.4, 5.0.2, 5.1.1 or 6.0 2016-07-01 eliminates this vulnerability. A possible mitigation has been published immediately after the disclosure of the vulnerability.

Similar entries are available at VDB-88897, VDB-88898, VDB-88899 and VDB-88900. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Smartphone Operating System

Vendor

• Google

Name

• Android

Version

• 1.0
• 1.1
• 1.5
• 1.6
• 2.0
• 2.0.1
• 2.1
• 2.2
• 2.2.1
• 2.2.2
• 2.2.3
• 2.3
• 2.3.1
• 2.3.2
• 2.3.3
• 2.3.4
• 2.3.5
• 2.3.6
• 2.3.7
• 3.0
• 3.1
• 3.2
• 3.2.1
• 3.2.2
• 3.2.3
• 3.2.4
• 3.2.5
• 3.2.6
• 4.0
• 4.0.1
• 4.0.2
• 4.0.3
• 4.0.4
• 4.1
• 4.1.1
• 4.1.2
• 4.2
• 4.2.1
• 4.2.2
• 4.3
• 4.3.1
• 4.4
• 4.4.1
• 4.4.2
• 4.4.3
• 4.4.4
• 5.0
• 5.0.1
• 5.1.0
• 6.x

License

• free

Website

• Vendor: https://www.google.com/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion