Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2016-2396 State: PUBLISHED Published: 2016-02-17T15:00:00 Last Updated: 2024-08-05T23:24:49.299Z Vendors: n/a Products: n/a Problem Types: Other Description: The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input. Additional Analyst Notes: - CVE Program Container: References: - http://www.securitytracker.com/id/1035015 - http://www.zerodayinitiative.com/advisories/ZDI-16-164 - https://support.software.dell.com/product-notification/185943
CVE ID: CVE-2016-2397 State: PUBLISHED Published: 2016-02-17T15:00:00 Last Updated: 2024-08-05T23:24:49.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data. Additional Analyst Notes: - CVE Program Container: References: - http://www.zerodayinitiative.com/advisories/ZDI-16-163 - http://www.securitytracker.com/id/1035015 - https://support.software.dell.com/product-notification/185943
CVE ID: CVE-2016-2398 State: PUBLISHED Published: 2016-02-17T16:00:00Z Last Updated: 2024-09-16T17:23:32.807Z Vendors: n/a Products: n/a Problem Types: n/a Description: Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions. Additional Analyst Notes: - CVE Program Container: References: - http://www.wired.com/2016/01/xfinitys-security-system-flaws-open-homes-to-thieves/ - https://community.rapid7.com/community/infosec/blog/2016/01/05/r7-2015-23-comcast-xfinity-home-security-system-insecure-fail-open - http://www.kb.cert.org/vuls/id/4
ec/blog/2016/01/05/r7-2015-23-comcast-xfinity-home-security-system-insecure-fail-open - http://www.kb.cert.org/vuls/id/418072
CVE ID: CVE-2016-2399 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-05T23:24:49.276Z Vendors: n/a Products: n/a Problem Types: n/a Description: Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom. Additional Analyst Notes: - CVE Program Container: References: - http://www.debian.org/security/2017/dsa-3800 - https://www.exploit-db.com/exploits/39487/ - http://www.nemux.org/2016/02/23/libquicktime-1-2-4/ - http://www.securityfocus.com/bid/95880 - https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Int
me-1-2-4/ - http://www.securityfocus.com/bid/95880 - https://packetstormsecurity.com/files/135899/libquicktime-1.2.4-Integer-Overflow.html
CVE ID: CVE-2016-2402 State: PUBLISHED Published: 2017-01-30T22:00:00 Last Updated: 2024-08-05T23:24:49.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate. Additional Analyst Notes: - CVE Program Container: References: - https://koz.io/pinning-cve-2016-2402/ - https://publicobject.com/2016/02/11/okhttp-certificate-pinning-vulnerability/ - http://www.openwall.com/lists/oss-security/2016/02/10/8 - http://www.openwall.com/lists/oss-security/2016/02/18/7 - https://lists.apac
nwall.com/lists/oss-security/2016/02/10/8 - http://www.openwall.com/lists/oss-security/2016/02/18/7 - https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E
CVE ID: CVE-2016-2403 State: PUBLISHED Published: 2017-02-07T17:00:00 Last Updated: 2024-08-05T23:24:49.284Z Vendors: n/a Products: n/a Problem Types: n/a Description: Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind. Additional Analyst Notes: - CVE Program Container: References: - http://symfony.com/blog/cve-2016-2403-unauthorized-access-on-a-misconfigured-ldap-server-when-using-an-empty-password - https://www.debian.org/security/2018/dsa-4262 - http://www.securityfocus.com/bid/96137
CVE ID: CVE-2016-2404 State: PUBLISHED Published: 2017-04-02T20:00:00 Last Updated: 2024-08-05T23:24:49.290Z Vendors: n/a Products: S5700, S6700, S7700, S9700,S12700,ACU2,, S5700, S6700, S7700, S9700 V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R006C00,,S12700 V200R005C00SPC500, V200R006C00,,ACU2 V200R005C00SPC500, V200R006C00, Problem Types: Permission Control Description: Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R006C00; S12700 with software V200R005C00SPC500, V200R006C00; ACU2 with software V200R005C00SPC500, V200R006C00 have a permission control vulnerability
200R005C00SPC500, V200R006C00; ACU2 with software V200R005C00SPC500, V200R006C00 have a permission control vulnerability. If a switch enables Authentication, Authorization, and Accounting (AAA) for permission control and user permissions are not appropriate, AAA users may obtain the virtual type terminal (VTY) access permission, resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160217-01-switch-en
CVE ID: CVE-2016-2405 State: PUBLISHED Published: 2016-04-12T17:00:00 Last Updated: 2024-08-05T23:24:49.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160217-01-policycenter-en
CVE ID: CVE-2016-2406 State: PUBLISHED Published: 2017-03-20T16:00:00 Last Updated: 2024-08-05T23:24:49.293Z Vendors: n/a Products: n/a Problem Types: n/a Description: The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button. Additional Analyst Notes: - CVE Program Container: References: - http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160218-01-dsm-en
CVE ID: CVE-2016-2407 State: REJECTED Published: 2017-05-11T14:01:00 Last Updated: 2017-05-11T13:57:01 Description: No description available.
CVE ID: CVE-2016-2408 State: PUBLISHED Published: 2016-08-02T16:00:00 Last Updated: 2024-08-05T23:24:49.267Z Vendors: n/a Products: n/a Problem Types: n/a Description: Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - http://www.securityfocus.com/bid/92692 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40241 - http://www.securitytracker.com/id/1036474 - https://kb.pulsesecure.net/articles/Pulse_Security_Advisories/SA40241/
CVE ID: CVE-2016-2409 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 25981545. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2410 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.307Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2411 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.332Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages root access, aka internal bug 26866053. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2412 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.290Z Vendors: n/a Products: n/a Problem Types: n/a Description: include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, mishandles certain crashes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26593930. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/external/skia/+/b36c23b3e6b0b316075cc43e466d44c62508fcac - http://source.an
- https://android.googlesource.com/platform/external/skia/+/b36c23b3e6b0b316075cc43e466d44c62508fcac - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2413 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.271Z Vendors: n/a Products: n/a Problem Types: n/a Description: media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/25be9ac20db51044e1b09ca67906355e4f328d48 - http://source.android.com/security/bulletin/2016
com/platform/frameworks/av/+/25be9ac20db51044e1b09ca67906355e4f328d48 - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2414 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/minikin/+/f4785aa1947b8d22d5b19559ef1ca526d98e0e73 - https://android.googlesource.com/platform/frameworks/minikin
eworks/minikin/+/f4785aa1947b8d22d5b19559ef1ca526d98e0e73 - https://android.googlesource.com/platform/frameworks/minikin/+/ca8ac8acdad662230ae37998c6c4091bb39402b6 - http://source.android.com/security/bulletin/2016-04-02.html - https://code.google.com/p/android/issues/detail?id=192618
CVE ID: CVE-2016-2415 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.309Z Vendors: n/a Products: n/a Problem Types: n/a Description: exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, aka internal bug 26488455. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/packages/apps/Exchange/+/0d1a38b1755efe7e
/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/packages/apps/Exchange/+/0d1a38b1755efe7ed4e8d7302a24186616bba9b2
CVE ID: CVE-2016-2416 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.341Z Vendors: n/a Products: n/a Problem Types: n/a Description: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/
nternal bug 27046057. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/native/+/a40b30f5c43726120bfe69d41ff5aeb31fe1d02a - https://android.googlesource.com/platform/frameworks/native/+/85d253fab5e2c01bd90990667c6de25c282fc5cd - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2417 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.354Z Vendors: n/a Products: n/a Problem Types: n/a Description: media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/e
aka internal bug 26914474. Additional Analyst Notes: - CVE Program Container: References: - https://www.exploit-db.com/exploits/39685/ - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84
CVE ID: CVE-2016-2418 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.292Z Vendors: n/a Products: n/a Problem Types: n/a Description: media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/8d87321b704cb3f88e8cae6689
VE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/8d87321b704cb3f88e8cae668937d001fd63d5e3 - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2419 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.286Z Vendors: n/a Products: n/a Problem Types: n/a Description: media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9
- CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/av/+/5a856f2092f7086aa0fea9ae06b9255befcdcd34 - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2420 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.362Z Vendors: n/a Products: n/a Problem Types: n/a Description: rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/system/core/+/669ecc2f5e80ff924fa20ce7445354a7c5bcfd98 - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/system/core/+/81df1cc77722000f8d0025
d.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/system/core/+/81df1cc77722000f8d0025c1ab00ced123aa573c
CVE ID: CVE-2016-2421 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.347Z Vendors: n/a Products: n/a Problem Types: n/a Description: Setup Wizard in Android 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26154410. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2422 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.281Z Vendors: n/a Products: n/a Problem Types: n/a Description: Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324357. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/apps/CertInstaller/+/70dde9870e9450e10418a32206ac1bb30f036b2c - http://source.a
droid.googlesource.com/platform/packages/apps/CertInstaller/+/70dde9870e9450e10418a32206ac1bb30f036b2c - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2423 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.287Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider whether a device is provisioned, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26303187. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com
Container: References: - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/packages/services/Telecomm/+/a06c9a4aef69ae27b951523cf72bf72412bf48fa
CVE ID: CVE-2016-2424 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.340Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mismanages certain authority data, which allows attackers to cause a denial of service (reboot loop) via a crafted application, aka internal bug 26513719. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html - https://android.googlesource.com/platform/frameworks/base/+/d3383d5bfab296ba3adbc121ff8a7b542bde
letin/2016-04-02.html - https://android.googlesource.com/platform/frameworks/base/+/d3383d5bfab296ba3adbc121ff8a7b542bde4afb
CVE ID: CVE-2016-2425 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.343Z Vendors: n/a Products: n/a Problem Types: n/a Description: mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///data attachments, which allows attackers to obtain sensitive information via a crafted application, aka internal bugs 7154234 and 26989185. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/0d9dfd649bae9c181e3afc5d571903f1eb5dc46f - https://code.google.com/p/android/issues/detail?id=199
es/apps/UnifiedEmail/+/0d9dfd649bae9c181e3afc5d571903f1eb5dc46f - https://code.google.com/p/android/issues/detail?id=199888 - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2426 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.351Z Vendors: n/a Products: n/a Problem Types: n/a Description: server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a GET_ACCOUNTS permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 26094635. Additional Analyst Notes: - CVE Program Container: References: - https://android.googlesource.com/platform/frameworks/base/+/63363af721650e426db5b0bdfb8b2d4fe36abdb0 - http://source.android.com/security/bulletin/2016-04-
atform/frameworks/base/+/63363af721650e426db5b0bdfb8b2d4fe36abdb0 - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2427 State: PUBLISHED Published: 2016-04-18T00:00:00 Last Updated: 2024-08-05T23:24:49.369Z Vendors: n/a Products: n/a Problem Types: n/a Description: The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568. NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead
error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-04-02.html
CVE ID: CVE-2016-2428 State: PUBLISHED Published: 2016-05-09T10:00:00 Last Updated: 2024-08-05T23:24:49.371Z Vendors: n/a Products: n/a Problem Types: n/a Description: libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted media file, aka internal bug 26751339. Additional Analyst Notes: - CVE Program Container: References: - http://source.android.com/security/bulletin/2016-05-01.html - https://android.googlesource.com/platform/external/aac/
- http://source.android.com/security/bulletin/2016-05-01.html - https://android.googlesource.com/platform/external/aac/+/5d4405f601fa11a8955fd7611532c982420e4206