CVE-2016-2448

media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.

Affected Software

Name	Vendor	Start Version	End Version
Android	Google	4.0 (including)	4.0 (including)
Android	Google	4.0.1 (including)	4.0.1 (including)
Android	Google	4.0.2 (including)	4.0.2 (including)
Android	Google	4.0.3 (including)	4.0.3 (including)
Android	Google	4.0.4 (including)	4.0.4 (including)
Android	Google	4.1 (including)	4.1 (including)
Android	Google	4.1.2 (including)	4.1.2 (including)
Android	Google	4.2 (including)	4.2 (including)
Android	Google	4.2.1 (including)	4.2.1 (including)
Android	Google	4.2.2 (including)	4.2.2 (including)
Android	Google	4.3 (including)	4.3 (including)
Android	Google	4.3.1 (including)	4.3.1 (including)
Android	Google	4.4 (including)	4.4 (including)
Android	Google	4.4.1 (including)	4.4.1 (including)
Android	Google	4.4.2 (including)	4.4.2 (including)
Android	Google	4.4.3 (including)	4.4.3 (including)
Android	Google	5.0 (including)	5.0 (including)
Android	Google	5.0.1 (including)	5.0.1 (including)
Android	Google	5.1 (including)	5.1 (including)
Android	Google	5.1.0 (including)	5.1.0 (including)
Android	Google	6.0 (including)	6.0 (including)
Android	Google	6.0.1 (including)	6.0.1 (including)
Android	Ubuntu	esm-apps/xenial	*
Android	Ubuntu	trusty	*
Android	Ubuntu	vivid/stable-phone-overlay	*
Android	Ubuntu	wily	*
Android	Ubuntu	xenial	*
Android	Ubuntu	yakkety	*
Android	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-2448
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References