CVE-2016-3746

Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27890802.

Affected Software

Name	Vendor	Start Version	End Version
Android	Google	4.0 (including)	4.0 (including)
Android	Google	4.0.1 (including)	4.0.1 (including)
Android	Google	4.0.2 (including)	4.0.2 (including)
Android	Google	4.0.3 (including)	4.0.3 (including)
Android	Google	4.0.4 (including)	4.0.4 (including)
Android	Google	4.1 (including)	4.1 (including)
Android	Google	4.1.2 (including)	4.1.2 (including)
Android	Google	4.2 (including)	4.2 (including)
Android	Google	4.2.1 (including)	4.2.1 (including)
Android	Google	4.2.2 (including)	4.2.2 (including)
Android	Google	4.3 (including)	4.3 (including)
Android	Google	4.3.1 (including)	4.3.1 (including)
Android	Google	4.4 (including)	4.4 (including)
Android	Google	4.4.1 (including)	4.4.1 (including)
Android	Google	4.4.2 (including)	4.4.2 (including)
Android	Google	4.4.3 (including)	4.4.3 (including)
Android	Google	5.0 (including)	5.0 (including)
Android	Google	5.0.1 (including)	5.0.1 (including)
Android	Google	5.1 (including)	5.1 (including)
Android	Google	5.1.0 (including)	5.1.0 (including)
Android	Google	6.0 (including)	6.0 (including)
Android	Google	6.0.1 (including)	6.0.1 (including)
Android	Ubuntu	esm-apps/xenial	*
Android	Ubuntu	trusty	*
Android	Ubuntu	vivid/stable-phone-overlay	*
Android	Ubuntu	wily	*
Android	Ubuntu	xenial	*
Android	Ubuntu	yakkety	*
Android	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-3746
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References