Skip to content

CVE-2016-3861 LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different...

HighCVSS 7.8 EPSS 8.3% Public exploit
Published
Updated
Exploit status
Public exploit available
Sign in for asset impact Search another CVE

Description

LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.

Affected products

ProductAffected versionsFixed in
debian/android-platform-system-core(Debian:11) < 1:7.0.0+r1-4 1:7.0.0+r1-4
Google Android = 4.0 No fix listed
Google Android = 4.0.1 No fix listed
Google Android = 4.0.2 No fix listed
Google Android = 4.0.3 No fix listed
Google Android = 4.0.4 No fix listed
Google Android = 4.1 No fix listed
Google Android = 4.1.2 No fix listed
Google Android = 4.2 No fix listed
Google Android = 4.2.1 No fix listed
Google Android = 4.2.2 No fix listed
Google Android = 4.3 No fix listed
Google Android = 4.3.1 No fix listed
Google Android = 4.4 No fix listed
Google Android = 4.4.1 No fix listed
Google Android = 4.4.2 No fix listed
Google Android = 4.4.3 No fix listed
Google Android = 5.0 No fix listed
Google Android = 5.0.1 No fix listed
Google Android = 5.1 No fix listed
Google Android = 5.1.0 No fix listed
Google Android = 6.0 No fix listed
Google Android = 6.0.1 No fix listed
Google Android = 7.0 No fix listed

References