Android Security Bulletin for June Brings More Fixes to Mediaserver Component

Google released the details for June's Android Security Bulletin, and the company fixed 40 security bugs in its mobile OS, of which eight were labeled as Critical, the highest severity rating.

As always, the Mediaserver component received the most security fixes, with patches for one remote code execution issue, twelve fixes for various elevation of privilege vulnerabilities, one fix for an information disclosure issue, and one for a denial of service vulnerability.

This component plays a crucial role in Android devices, being the one tasked with handling multimedia elements on the phone.

Exploitation of security weaknesses in the Mediaserver component is trivial since attackers only need to send an MMS or fool the user into accessing a Web page hosting corrupted media files.

Second to the Mediaserver component, Google also fixed a large number of bugs in Qualcomm components. The Qualcomm Camera, Video, Sound, GPU, and Wi-Fi drivers are received multiple fixes, fifteen in total, taking up a third of the entire security bulletin.

The Broadcom Wi-Fi driver, the MediaTek Power Management driver, and the NVIDIA Camera drivers also received fixes, but none were rated as severe.

Most severe bugs

Of the eight bugs that did warrant a "Critical" rating, six would have led to a permanent device compromise, which Google says could have been fixed only if the user reinstalled his Android operating system.

All these six bugs were in Qualcomm components. Qualcomm bugs should not be underestimated, as proven by a report from two weeks ago when one single Qualcomm bug affected nearly two-thirds of all Android devices.

The other two Critical bugs were in the Mediaserver component, and in the libwebm library, which is also part of the bigger Mediaserver module.

Security updates for Nexus devices were released as over-the-air updates, while OEMs will have to wait for updated OS images for at least two more days before implementing this month's fixes in their own OS update packages.

Thank-yous for this month's security fixes need to be addressed to Android's own security team and Google's Project Zero, but also to companies that submitted bug reports, such as Alibaba, Tencent, CORE Team, Qihoo 360, and a slew of independent researchers. Below is a table detailing all security bugs.