CVE-2016-3920 : id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.

id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 30744884.

Published 2016-10-10 10:59:24

Updated 2016-11-28 20:13:56

Source Android (associated with Google Inc. or Open Handset Alliance)

View at NVD, CVE.org

Vulnerability category: Input validationDenial of service

Products affected by CVE-2016-3920

Google » Android » Version: 6.0.1
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 6.0
cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 5.0
cpe:2.3:o:google:android:5.0:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 5.0.1
cpe:2.3:o:google:android:5.0.1:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 5.1
cpe:2.3:o:google:android:5.1:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 5.1.0
cpe:2.3:o:google:android:5.1.0:*:*:*:*:*:*:*
Matching versions
Google » Android » Version: 7.0
cpe:2.3:o:google:android:7.0:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2016-3920

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 61 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-3920

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.1	HIGH	AV:N/AC:M/Au:N/C:N/I:N/A:C	8.6	6.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2016-3920

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3920

https://android.googlesource.com/platform/frameworks/av/+/6d0249be2275fd4086783f259f4e2c54722a7c55

6d0249be2275fd4086783f259f4e2c54722a7c55 - platform/frameworks/av - Git at Google
Issue Tracking;Patch
http://source.android.com/security/bulletin/2016-10-01.html

Android Security Bulletin—October 2016 | Android Open Source Project
Vendor Advisory

CVEs referencing this url
http://www.securityfocus.com/bid/93292

Google Android Mediaserver CVE-2016-3920 Denial of Service Vulnerability

Jump to

Vulnerability Details : CVE-2016-3920

Products affected by CVE-2016-3920

Exploit prediction scoring system (EPSS) score for CVE-2016-3920

CVSS scores for CVE-2016-3920

CWE ids for CVE-2016-3920

References for CVE-2016-3920