Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2016-0803

libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794.

Published

2016-02-07T01:59:02.067

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv3.0: 9.8 (CRITICAL)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access Vector: NETWORK
Access Complexity: LOW
Authentication: NONE
Confidentiality Impact: COMPLETE
Integrity Impact: COMPLETE
Availability Impact: COMPLETE

Exploitability Score

10.0

Impact Score

10.0

Weaknesses

Type: Primary
CWE-119

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Operating System	google	android	4.0	Yes
Operating System	google	android	4.0.1	Yes
Operating System	google	android	4.0.2	Yes
Operating System	google	android	4.0.3	Yes
Operating System	google	android	4.0.4	Yes
Operating System	google	android	4.1	Yes
Operating System	google	android	4.1.2	Yes
Operating System	google	android	4.2	Yes
Operating System	google	android	4.2.1	Yes
Operating System	google	android	4.2.2	Yes
Operating System	google	android	4.3	Yes
Operating System	google	android	4.3.1	Yes
Operating System	google	android	4.4	Yes
Operating System	google	android	4.4.1	Yes
Operating System	google	android	4.4.2	Yes
Operating System	google	android	4.4.3	Yes
Operating System	google	android	4.4.4	Yes
Operating System	google	android	5.0	Yes
Operating System	google	android	5.0.1	Yes
Operating System	google	android	5.0.2	Yes
Operating System	google	android	5.1	Yes
Operating System	google	android	5.1.0	Yes
Operating System	google	android	5.1.1	Yes
Operating System	google	android	6.0	Yes
Operating System	google	android	6.0.1	Yes

References

http://source.android.com/security/bulletin/2016-02-01.html ([email protected])
https://android.googlesource.com/platform%2Fframeworks%2Fav/+/50270d98e26fa18b20ca88216c3526667b724ba7 Vendor Advisory ([email protected])
http://source.android.com/security/bulletin/2016-02-01.html (af854a3a-2127-422b-91ae-364da2661108)
https://android.googlesource.com/platform%2Fframeworks%2Fav/+/50270d98e26fa18b20ca88216c3526667b724ba7 Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)