Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-6704: Android Mediaserver may let apps gain privileged access

CVE-2016-6704 · published 9 years ago

Summary

Versions of Android that use the Mediaserver component before certain updates can be tricked by a malicious app to run code with higher system privileges. This could let the app do things it normally cannot, such as accessing restricted data or controlling the device. Update Android to the latest version or apply the vendor’s security patch to close the gap.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
google	android	>= 4.0, < 4.4.4 >= 5.0, < 5.0.2 >= 5.1, < 5.1.1 >= 6.0, <= 6.0.1 7.0 `cpe:2.3:o:google:android::::::::`

Original advisory text

An elevation of privilege vulnerability in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Android ID: A-30229821.

References

http://www.securityfocus.com/bid/94134 Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2016-11-01.html Vendor Advisory
https://source.android.com/security/bulletin/2016-12-01.html Vendor Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.8 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published25 Nov 2016

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-6704 · NVD

Track software like this

Free during beta