Google Patches Android for 90 Vulnerabilities in January Update
Google starts the new year with another large security update for Android, once again patching mediaserver, Qualcomm and Linux kernel vulnerabilities.Android is starting 2017 much the same way it ended 2016, with a large security patch update. Google released the first Android patch update of 2017 on Jan. 4, providing fixes for 90 identified vulnerabilities. Of those, 29 are rated as being critical, 41 as high and 20 are ranked as having moderate severity. The January update is an increase in patch volume from the December Android update which patched 74 vulnerabilities and significantly larger than the first Android update of 2016, which only patched 12 vulnerabilities. While the January 2017 update is large, on a positive note, Google stated that it has had no reports of active customer exploitation or abuse of these newly reported issues. Among the 29 critical issues is one in Google's much maligned mediaserver component. Since the first of Google's monthly Android security updates that began in August 2015, there have been monthly patches for mediaserver-related flaws including the stagefright media library. The new CVE-2017-0381 vulnerability is a remote code execution vulnerability in mediaserver that was reported to Google by Trend Micro.
"A remote code execution vulnerability in mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing," Google warns in its advisory.