CVE-2016-3746
Severity CVSS v4.0:
Pending analysis
Type:
Unavailable / Other
Publication date:
11/07/2016
Last modified:
12/04/2025
Description
Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27890802.
Impact
Base Score 3.x
7.80
Severity 3.x
HIGH
Base Score 2.0
7.50
Severity 2.0
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:google:android:4.0:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.0.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.0.2:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.0.3:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.0.4:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.1.2:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.2:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.2.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.2.2:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.3:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.4:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.4.1:*:*:*:*:*:*:* | ||
cpe:2.3:o:google:android:4.4.2:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://source.android.com/security/bulletin/2016-07-01.html
- https://android.googlesource.com/platform/hardware/qcom/media/+/5b82f4f90c3d531313714df4b936f92fb0ff15cf
- http://source.android.com/security/bulletin/2016-07-01.html
- https://android.googlesource.com/platform/hardware/qcom/media/+/5b82f4f90c3d531313714df4b936f92fb0ff15cf