CVE-2016-0828 Information disclosure in n/a
Attackers can leak sensitive information via uninitialized variables in Android mediaserver, enabling security bypass and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-0828?
CVE-2016-0828 is a high-severity vulnerability in Google Android, published on 12 Mar 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The BnGraphicBufferConsumer::onTransact function in libs/gui/IGraphicBufferConsumer.cpp in mediaserver in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not initialize a certain slot variable, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, by triggering an ATTACH_BUFFER action, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26338113.
Which versions are affected by CVE-2016-0828?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2016-0828?
Apply the vendor's patch.
Is CVE-2016-0828 being exploited?
There is no known exploitation of CVE-2016-0828 in the wild and no public exploit code.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-jj7f-fmcx-8w9m, UBUNTU-CVE-2016-0828.