CVE-2016-3861
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2016-3861
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Description
LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Android LibUtils 远程代码执行漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Android是美国谷歌（Google）公司和开放手持设备联盟（简称OHA）共同开发的一套以Linux为基础的开源操作系统。Libutils是Android的一个底层库。 Android LibUtils中存在远程代码执行漏洞，该漏洞源于程序没有正确处理Unicode字符编码与不同编码宽度的转换。远程攻击者可通过特制的文件利用该漏洞执行任意代码，或造成拒绝服务（基于堆的缓冲区溢出）。以下版本受到影响：Android 4.4.4之前的4.x版本，5.0.2之前的5.0.x版本，5.1.1之前的5.1.x版本
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
II. Public POCs for CVE-2016-3861
| # | POC Description | Source Link | Shenlong Link |
|---|---|---|---|
| 1 | my extended take on Mark Brand's CVE 2016-3861 libutils bug | https://github.com/zeroshotkevin/CVE-2016-3861 | POC Details |
| 2 | my extended take on Mark Brand's CVE 2016-3861 libutils bug | https://github.com/zxkevn/CVE-2016-3861 | POC Details |
| 3 | my extended take on Mark Brand's CVE 2016-3861 libutils bug | https://github.com/kswzzl/CVE-2016-3861 | POC Details |
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2016-3861
请登录查看更多情报信息。
- http://source.android.com/security/bulletin/2016-09-01.htmlx_refsource_CONFIRM
- Google Android - libutils UTF16 to UTF8 Conversion Heap Buffer Overflow - Android remote Exploitexploitx_refsource_EXPLOIT-DB
- https://nvd.nist.gov/vuln/detail/CVE-2016-3861
Same Patch Batch · n/a · 2016-09-11 · 61 CVEs total
| CVE-2016-5149 | Google Chrome扩展脚本注入漏洞 | |
| CVE-2016-5167 | Google Chrome 安全漏洞 | |
| CVE-2016-5164 | Google Chrome 跨站脚本漏洞 | |
| CVE-2016-5163 | Google Chrome 地址栏伪造漏洞 | |
| CVE-2016-5162 | Google Chrome 安全漏洞 | |
| CVE-2016-5165 | Google Chrome 脚本注入漏洞 | |
| CVE-2016-5153 | Google Chrome Blink 安全漏洞 | |
| CVE-2016-5152 | Google Chrome PDFium 基于堆的缓冲区溢出漏洞 | |
| CVE-2016-5151 | Google Chrome PDFium 释放后重用漏洞 | |
| CVE-2016-5150 | Google Chrome Blink 释放后重用漏洞 | |
| CVE-2016-5154 | Google Chrome PDFium 基于堆的缓冲区溢出漏洞 | |
| CVE-2016-5148 | Google Chrome Blink 跨站脚本漏洞 | |
| CVE-2016-5147 | Google Chrome Blink 跨站脚本漏洞 | |
| CVE-2016-3899 | Android Mediaserver 拒绝服务漏洞 | |
| CVE-2016-3898 | Android Telephony 拒绝服务漏洞 | |
| CVE-2016-3897 | Android 信息泄露漏洞 | |
| CVE-2016-3896 | Android AOSP Mail 信息泄露漏洞 | |
| CVE-2016-3895 | Android Mediaserver 整数溢出漏洞 | |
| CVE-2016-3894 | Android Qualcomm DMA组件信息泄露漏洞 | |
| CVE-2016-3893 | Android Qualcomm声音编码器信息泄露漏洞 |
Showing top 20 of 61 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2016-3861
No comments yet