Remote code execution vulnerability in Mediaserver

CVE-2017-0470

(json)

CVE numbers: CVE-2017-0470 [Bulletin-CVE-2017-0470]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33818500. [NIST-CVE-2017-0470]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0470] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0470]
Fixed on: 2015-12-18 [A-33818500]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0470]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-3742

(json)

CVE numbers: CVE-2016-3742 [Bulletin-CVE-2016-3742]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165659. [NIST-CVE-2016-3742]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-3742]
Fixed on: 2016-04-20 [A-28165659]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3742] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3742]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3742]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3743

(json)

CVE numbers: CVE-2016-3743 [Bulletin-CVE-2016-3743]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 27907656. [NIST-CVE-2016-3743]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-3743]
Fixed on: 2016-04-21 [A-27907656]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3743] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3743]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3743]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2505

(json)

CVE numbers: CVE-2016-2505 [Bulletin-CVE-2016-2505]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: mpeg2ts/ATSParser.cpp in libstagefright in mediaserver in Android 6.x before 2016-07-01 does not validate a certain section length, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28333006. [NIST-CVE-2016-2505]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-2505]
Fixed on: 2016-04-28 [A-28333006]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-2505] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-2505]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-2505]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2507

(json)

CVE numbers: CVE-2016-2507 [Bulletin-CVE-2016-2507]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28532266. [NIST-CVE-2016-2507]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-2507]
Fixed on: 2016-05-11 [A-28532266]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2507] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-2507]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2507]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2506

(json)

CVE numbers: CVE-2016-2506 [Bulletin-CVE-2016-2506]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate a certain offset value, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28175045. [NIST-CVE-2016-2506]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-2506]
Fixed on: 2016-05-13 [A-28175045]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2506] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-2506]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2506]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3741

(json)

CVE numbers: CVE-2016-3741 [Bulletin-CVE-2016-3741]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165661. [NIST-CVE-2016-3741]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-3741]
Fixed on: 2016-05-24 [2]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3741] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3741]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3741]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3820

(json)

CVE numbers: CVE-2016-3820 [Bulletin-CVE-2016-3820]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28673410. [NIST-CVE-2016-3820]
Discovered by: on: Unknown
Reported on: 2016-08-01 [Bulletin-CVE-2016-3820]
Fixed on: 2016-06-01 [A-28673410]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3820] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3820]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-3820]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2017-0587

(json)

CVE numbers: CVE-2017-0587 [Bulletin-CVE-2017-0587]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35219737. [NIST-CVE-2017-0587]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0587] on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0587]
Fixed on: 2016-06-01 [A-35219737]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0587] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0587]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0587]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-3819

(json)

CVE numbers: CVE-2016-3819 [Bulletin-CVE-2016-3819]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562. [NIST-CVE-2016-3819]
Discovered by: on: Unknown
Reported on: 2016-08-01 [Bulletin-CVE-2016-3819]
Fixed on: 2016-06-07 [A-28533562]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3819] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3819]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3819]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3821

(json)

CVE numbers: CVE-2016-3821 [Bulletin-CVE-2016-3821]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file, aka internal bug 28166152. [NIST-CVE-2016-3821]
Discovered by: on: Unknown
Reported on: 2016-08-01 [Bulletin-CVE-2016-3821]
Fixed on: 2016-06-07 [A-28166152]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3821] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3821]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3821]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2508

(json)

CVE numbers: CVE-2016-2508 [Bulletin-CVE-2016-2508]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate certain track data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28799341. [NIST-CVE-2016-2508]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2016-2508]
Fixed on: 2016-06-14 [2]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2508] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-2508]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2508]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3862

(json)

CVE numbers: CVE-2016-3862 [Bulletin-CVE-2016-3862]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjhead_jni, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 29270469. [NIST-CVE-2016-3862]
Discovered by: on: Unknown
Reported on: 2016-09-01 [Bulletin-CVE-2016-3862]
Fixed on: 2016-07-13 [A-29270469]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3862] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3862]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3862]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-6699

(json)

CVE numbers: CVE-2016-6699 [Bulletin-CVE-2016-6699]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Android ID: A-31373622. [NIST-CVE-2016-6699]
Discovered by: on: Unknown
Reported on: 2016-11-01 [Bulletin-CVE-2016-6699]
Fixed on: 2016-09-13 [A-31373622]
Fix released on: Unknown
Affected versions: 7.0 [Bulletin-CVE-2016-6699] regex: (7.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-6699]
Fixed versions: 7.0 [Bulletin-CVE-2016-6699]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2017-0592

(json)

CVE numbers: CVE-2017-0592 [Bulletin-CVE-2017-0592]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34970788. [NIST-CVE-2017-0592]
Discovered by: on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0592]
Fixed on: 2016-10-24 [A-34970788]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0592]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0406

(json)

CVE numbers: CVE-2017-0406 [Bulletin-CVE-2017-0406]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32915871. [NIST-CVE-2017-0406]
Discovered by: Zhixin Li of NSFocus [Discovery-CVE-2017-0406] on: Unknown
Reported on: 2017-02-01 [Bulletin-CVE-2017-0406]
Fixed on: 2016-11-18 [2]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0406] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0406]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0406]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0407

(json)

CVE numbers: CVE-2017-0407 [Bulletin-CVE-2017-0407]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32873375. [NIST-CVE-2017-0407]
Discovered by: Weichao Sun (@sunblate) of Alibaba Inc. [Discovery-CVE-2017-0407] on: Unknown
Reported on: 2017-02-01 [Bulletin-CVE-2017-0407]
Fixed on: 2016-11-25 [A-32873375]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0407] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0407]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0407]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0474

(json)

CVE numbers: CVE-2017-0474 [Bulletin-CVE-2017-0474]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-32589224. [NIST-CVE-2017-0474]
Discovered by: on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0474]
Fixed on: 2016-11-29 [A-32589224]
Fix released on: Unknown
Affected versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0474] regex: (7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0474]
Fixed versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0474]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0543

(json)

CVE numbers: CVE-2017-0543 [Bulletin-CVE-2017-0543]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097866. [NIST-CVE-2017-0543]
Discovered by: on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2017-0543]
Fixed on: 2016-12-15 [A-34097866]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0543] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0543]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0543]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0591

(json)

CVE numbers: CVE-2017-0591 [Bulletin-CVE-2017-0591]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34097672. [NIST-CVE-2017-0591]
Discovered by: on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0591]
Fixed on: 2016-12-15 [A-34097672]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0591] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0591]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0591]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0466

(json)

CVE numbers: CVE-2017-0466 [Bulletin-CVE-2017-0466]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33139050. [NIST-CVE-2017-0466]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0466] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0466]
Fixed on: 2016-12-20 [A-33139050]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0466] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0466]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0466]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0467

(json)

CVE numbers: CVE-2017-0467 [Bulletin-CVE-2017-0467]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33250932. [NIST-CVE-2017-0467]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0467] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0467]
Fixed on: 2016-12-20 [A-33250932]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0467] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0467]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0467]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0468

(json)

CVE numbers: CVE-2017-0468 [Bulletin-CVE-2017-0468]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33351708. [NIST-CVE-2017-0468]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0468] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0468]
Fixed on: 2016-12-20 [A-33351708]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0468] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0468]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0468]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0542

(json)

CVE numbers: CVE-2017-0542 [Bulletin-CVE-2017-0542]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33934721. [NIST-CVE-2017-0542]
Discovered by: on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2017-0542]
Fixed on: 2016-12-23 [A-33934721]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0542] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0542]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0542]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0469

(json)

CVE numbers: CVE-2017-0469 [Bulletin-CVE-2017-0469]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33450635. [NIST-CVE-2017-0469]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0469] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0469]
Fixed on: 2016-12-27 [A-33450635]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0469] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0469]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0469]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0538

(json)

CVE numbers: CVE-2017-0538 [Bulletin-CVE-2017-0538]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33641588. [NIST-CVE-2017-0538]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0538] on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2017-0538]
Fixed on: 2017-01-05 [A-33641588]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0538] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0538]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0538]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0471

(json)

CVE numbers: CVE-2017-0471 [Bulletin-CVE-2017-0471]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33816782. [NIST-CVE-2017-0471]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0471] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0471]
Fixed on: 2017-01-13 [A-33816782]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0471] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0471]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0471]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0472

(json)

CVE numbers: CVE-2017-0472 [Bulletin-CVE-2017-0472]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33862021. [NIST-CVE-2017-0472]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0472] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0472]
Fixed on: 2017-01-13 [A-33862021]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0472] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0472]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0472]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0539

(json)

CVE numbers: CVE-2017-0539 [Bulletin-CVE-2017-0539]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33864300. [NIST-CVE-2017-0539]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0539] on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2017-0539]
Fixed on: 2017-01-13 [A-33864300]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0539] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0539]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0539]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0590

(json)

CVE numbers: CVE-2017-0590 [Bulletin-CVE-2017-0590]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35039946. [NIST-CVE-2017-0590]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0590] on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0590]
Fixed on: 2017-01-13 [A-35039946]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0590] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0590]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0590]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0473

(json)

CVE numbers: CVE-2017-0473 [Bulletin-CVE-2017-0473]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33982658. [NIST-CVE-2017-0473]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0473] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0473]
Fixed on: 2017-01-16 [A-33982658]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0473] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0473]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0473]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0541

(json)

CVE numbers: CVE-2017-0541 [Bulletin-CVE-2017-0541]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018. [NIST-CVE-2017-0541]
Discovered by: Jianjun Dai (@Jioun_dai) of Qihoo 360 Skyeye Labs [Discovery-CVE-2017-0541] on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2017-0541]
Fixed on: 2017-02-07 [A-34031018]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0541]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0589

(json)

CVE numbers: CVE-2017-0589 [Bulletin-CVE-2017-0589]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34897036. [NIST-CVE-2017-0589]
Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0589] on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0589]
Fixed on: 2017-03-06 [A-34897036]
Fix released on: Unknown
Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0589] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0589]
Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0589]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0588

(json)

CVE numbers: CVE-2017-0588 [Bulletin-CVE-2017-0588]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607. [NIST-CVE-2017-0588]
Discovered by: Yong Wang (王勇) (@ThomasKing2014) of Alibaba Inc. [Discovery-CVE-2017-0588] on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0588]
Fixed on: 2017-03-10 [A-34618607]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0588]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588]
Submission: by: Daniel Carter, on: 2019-07-26