Android is starting 2017 much the same way it ended 2016, with a large security patch update. Google released the first Android patch update of 2017 on Jan. 4, providing fixes for 90 identified vulnerabilities. Of those, 29 are rated as being critical, 41 as high and 20 are ranked as having moderate severity.
The January update is an increase in patch volume from the December Android update which patched 74 vulnerabilities and significantly larger than the first Android update of 2016, which only patched 12 vulnerabilities.
While the January 2017 update is large, on a positive note, Google stated that it has had no reports of active customer exploitation or abuse of these newly reported issues.
Among the 29 critical issues is one in Google’s much maligned mediaserver component. Since the first of Google’s monthly Android security updates that began in August 2015, there have been monthly patches for mediaserver-related flaws including the stagefright media library. The new CVE-2017-0381 vulnerability is a remote code execution vulnerability in mediaserver that was reported to Google by Trend Micro.
“A remote code execution vulnerability in mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing,” Google warns in its advisory.
Thera are also seven additional non-critical flaws in mediaserver that Google is patching in the January update. Among them are four Denial of Service vulnerabilities (CVE-2017-0390, CVE-2017-0391, CVE-2017-0392 and CVE-2017-0393), two information disclosure vulnerabilities (CVE-2017-0396 and CVE-2017-0397) and a single privilege escalation flaw (CVE-2017-0387).
As has been the case in recent Android updates, Qualcomm components are also well represented in the list of critical vulnerabilities. In total, there are 24 different Qualcomm vulnerabilities patched in the January update. Of those 13 are rated as critical, seven are rated as high and four have moderate severity.
NVIDIA drivers are once again on the list of critical flaws being patched. This month Google is providing patches for 12 critical vulnerabilities in NVIDIA Android driver components, which is double the six critical NVIDA flaws that were patched in the December Android update.
Google’s January Android security update also deals with older vulnerabilities that have already been patched in the upstream Linux kernel. Among them is the critical CVE-2015-3288 kernel privilege escalation vulnerability that was was first patched in the Linux kernel back on Jul. 9, 2015. Another older Linux flaw that is now being patched in Android is the critical CVE-2015-5706 privilege vulnerability in the kernel filesystem, which was first patched in the upstream Linux kernel on May 9, 2015.
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.