CVE-2016-3879
Last modified
CVE-2016-3879 is a vulnerability of currently unknown severity. arm-wt-22k/lib_src/eas_mdls.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows remote attackers to cause a denial of service (NULL pointer dereference, and device hang or reboot) via a crafted media file, aka internal bug 29770686.. EPSS estimates a 0.71% chance of exploitation in the next 30 days.
Description
arm-wt-22k/lib_src/eas_mdls.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows remote attackers to cause a denial of service (NULL pointer dereference, and device hang or reboot) via a crafted media file, aka internal bug 29770686.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Android | 4.0 | |
| Android | 4.0.1 | |
| Android | 4.0.2 | |
| Android | 4.0.3 | |
| Android | 4.0.4 | |
| Android | 4.1 | |
| Android | 4.1.2 | |
| Android | 4.2 | |
| Android | 4.2.1 | |
| Android | 4.2.2 | |
| Android | 4.3 | |
| Android | 4.3.1 | |
| Android | 4.4 | |
| Android | 4.4.1 | |
| Android | 4.4.2 | |
| Android | 4.4.3 | |
| Android | 5.0 | |
| Android | 5.0.1 | |
| Android | 5.1 | |
| Android | 5.1.0 | |
| Android | 6.0 | |
| Android | 6.0.1 |
References
- http://source.android.com/security/bulletin/2016-09-01.htmlVendor Advisory
- http://source.android.com/security/bulletin/2016-09-01.htmlVendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2016-3879?
How severe is CVE-2016-3879?
How do I fix CVE-2016-3879?
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2016
- CVE-2016-3873The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 de…
- CVE-2016-3874CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in…
- CVE-2016-3875server/wm/WindowManagerService.java in Android 6.x before 20…
- CVE-2016-3876providers/settings/SettingsProvider.java in Android 6.x befo…
- CVE-2016-3877Unspecified vulnerability in Android before 2016-09-01 has u…
- CVE-2016-3878decoder/ih264d_api.c in mediaserver in Android 6.x before 20…
- CVE-2016-3880Multiple buffer overflows in rtsp/ASessionDescription.cpp in…
- CVE-2016-3881The decoder_peek_si_internal function in vp9/vp9_dx_iface.c …
- CVE-2016-3882Off-by-one error in server/wifi/anqp/VenueNameElement.java i…
- CVE-2016-3883internal/telephony/SMSDispatcher.java in Telephony in Androi…
- CVE-2016-3884server/notification/NotificationManagerService.java in the N…
- CVE-2016-3885debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before…
Are you affected by CVE-2016-3879?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST