Android Security Update Brings More Fixes to Critical Security Flaws

Google has released the latest security update for the Android OS and its own Nexus devices, regularly scheduled on the first Monday of the month. The update released a batch of patches and dozens of fixes for forty bugs, eight of which were labeled as “high severity”. One of the most serious bugs out of the eight critical flaws addressed in the update is for the Mediaserver component, which plays a crucial role in handling multimedia elements on Android phones, such as taking pictures, reading MP4 files, and recording videos.

Mediaserver received several patches for one remote code execution issue. The bug affects Android versions from 4.4.4 KitKat through Android 6.0.1. “A remote code-execution vulnerability in Mediaserver could enable an attacker using a specially-crafted file to cause memory corruption during media file and data processing,” Google reports. If an attacker exploits this component successfully, they would be able to run their code with the same permissions that Mediaserver already has as part of its normal routines. “An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of an elevated system application. This issue is rated as High because it could be used to gain local access to elevated capabilities, such as Signature or SignatureOrSystem permissions privileges, which are not accessible to a third-party application,” Google adds.

[READ: Mediaserver Bug Leads to Heap Overflow,Too]

In July 2015, a critical security flaw was discovered in one of Android’s media libraries. Labeled as the Stagefright vulnerability, the flaw can be exploited without any interaction, making it different from other attacks as it relies on the user to click on a malicious link or download a poisoned attachment. The bug potentially affects 95% of all Android devices, or an estimated 950 million Android smartphone and tablet users running on versions 2.2 or later.

Google also fixed six bugs present in Qualcomm-powered phones components including The Qualcomm camera, Video, Sound, GPU, and WiFi drivers, receiving a total of fifteen fixes:  two in each of its sound and GPU drivers, and one in each of the components video and WiFi drivers. These six critical bugs allowed installed apps to either enter kernel space and completely hijack the device to steal user credentials and spy on victims. According to the update notes, “an elevation of privilege vulnerability in the Qualcomm components [sic] could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a service that can call the driver.” Updates for Nexus devices were released as over-the-air updates while OEMs have to wait for updated OS images for about two more days before implementing this month’s fixes in their respective OS update packages.

[READ: Android Vulnerabilities Allow for Easy Root Access]