libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792.
{ "availability": "No subscription required", "ubuntu_priority": "high", "binaries": [ { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "android" }, { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "android-copyright" }, { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "android-emulator" }, { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "ubuntu-emulator-images" }, { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "ubuntu-emulator-runtime" }, { "binary_version": "20160307-0742-0ubuntu3", "binary_name": "ubuntu-emulator-runtime-dbgsym" } ] }