VDB
CVE-2016-2417
CVE-2016-2417
PUBLISHED
media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.
EPSS 13.16% · 94.2th percentile
Risk Scores
EPSS Score
13.16%
94.2th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | android | 0, 20150818-1500-0ubuntu2, 20150818-1500-0ubuntu3 |
Timeline
- Apr 5, 2016 CVE Published
- Apr 11, 2016 PoC Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Sep 3, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 17, 2022 EPSS Score
- Feb 8, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 1, 2023 EPSS Score
- Jul 15, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-2417 third-party-advisory
- https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84 third-party-advisory
- http://source.android.com/security/bulletin/2016-04-02.html third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-2417 third-party-advisory