Vulnerability Details : CVE-2016-2419
media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455.
Published
2016-04-18 00:59:26
Updated
2016-04-25 12:47:12
Products affected by CVE-2016-2419
- cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
- cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-2419
0.10%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 41 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-2419
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
9.8
|
CRITICAL | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2016-2419
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-2419
-
https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9ae06b9255befcdcd34
5a856f2092f7086aa0fea9ae06b9255befcdcd34 - platform/frameworks/av - Git at Google
-
http://source.android.com/security/bulletin/2016-04-02.html
Nexus Security Bulletin—April 2016 | Android Open Source ProjectVendor Advisory
Jump to