CVE-2016-5348 EXPLOIT
5.9
MEDIUM · CVSS 3.0 · EPSS 4.3% (pctl 91)
Patch early
A public exploit exists.
Description
The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service (memory consumption, and device hang or reboot) via a large xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 29555864.
Scoring
| CVSS | 5.9 (MEDIUM, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H |
| EPSS | 4.32% — more likely to be exploited than 91% of all CVEs |
| Weakness | CWE-399 |
| On CISA KEV | no |
| Public exploit | yes |
| Published | 2016-10-10 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| android |
Public exploits
| Source | Title | Date |
|---|---|---|
| exploit-db | Google Android - 'gpsOneXtra' Data Files Denial of Service | 2016-10-11 |
References
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93293
- https://android.googlesource.com/platform/frameworks/base/+/218b813d5bc2d7d3952ea1861c38b4aa944ac59b
- https://code.google.com/p/android/issues/detail?id=213747
- https://source.android.com/security/bulletin/2018-04-01
- https://www.exploit-db.com/exploits/40502/
- https://wwws.nightwatchcybersecurity.com/2016/10/04/advisory-cve-2016-5348-2/
- http://source.android.com/security/bulletin/2016-10-01.html
- http://www.securityfocus.com/bid/93293
- https://android.googlesource.com/platform/frameworks/base/+/218b813d5bc2d7d3952ea1861c38b4aa944ac59b
- https://code.google.com/p/android/issues/detail?id=213747
- https://source.android.com/security/bulletin/2018-04-01
- https://www.exploit-db.com/exploits/40502/
- https://wwws.nightwatchcybersecurity.com/2016/10/04/advisory-cve-2016-5348-2/
→ the Explorer · watch your stack · NVD