Google Patches Android For 90 Vulnerabilities In January Update

Android is starting 2017 much the same way it ended 2016, with a large security patch update. Google released the first Android patch update of 2017 on Jan. 4, providing fixes for 90 identified vulnerabilities.

Of those, 29 are rated as being critical, 41 as high and 20 are ranked as having moderate severity.

The January update is an increase in patch volume from the December Android update which patched 74 vulnerabilities and significantly larger than the first Android update of 2016, which only patched 12 vulnerabilities.

While the January 2017 update is large, on a positive note, Google stated that it has had no reports of active customer exploitation or abuse of these newly reported issues.

Google Android

Android security update

Among the 29 critical issues is one in Google’s much maligned mediaserver component. Since the first of Google’s monthly Android security updates that began in August 2015, there have been monthly patches for mediaserver-related flaws including the stagefright media library.

The new CVE-2017-0381 vulnerability is a remote code execution vulnerability in mediaserver that was reported to Google by Trend Micro.

“A remote code execution vulnerability in mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing,” Google warns in its advisory.

Thera are also seven additional non-critical flaws in mediaserver that Google is patching in the January update. Among them are four Denial of Service vulnerabilities (CVE-2017-0390, CVE-2017-0391, CVE-2017-0392 and CVE-2017-0393), two information disclosure vulnerabilities (CVE-2017-0396 and CVE-2017-0397) and a single privilege escalation flaw (CVE-2017-0387).

Component representation

As has been the case in recent Android updates, Qualcomm components are also well represented in the list of critical vulnerabilities.

In total, there are 24 different Qualcomm vulnerabilities patched in the January update. Of those 13 are rated as critical, seven are rated as high and four have moderate severity.

NVIDIA drivers are once again on the list of critical flaws being patched. This month Google is providing patches for 12 critical vulnerabilities in NVIDIA Android driver components, which is double the six critical NVIDA flaws that were patched in the December Android update.

Google’s January Android security update also deals with older vulnerabilities that have already been patched in the upstream Linux kernel.

Among them is the critical CVE-2015-3288 kernel privilege escalation vulnerability that was was first patched in the Linux kernel back on Jul. 9, 2015. Another older Linux flaw that is now being patched in Android is the critical CVE-2015-5706 privilege vulnerability in the kernel filesystem, which was first patched in the upstream Linux kernel on May 9, 2015.

Originally published on eWeek

Quiz: What do you know about Android?

Sean Michael Kerner

Sean Michael Kerner is a senior editor at eWeek and contributor to TechWeek

Recent Posts

Amazon Workers In North Carolina To Vote On Unionisation

E-commerce giant faces another unionisation move, with workers at North Carolina warehouse set to vote…

13 hours ago

Blue Origin Preps New Glenn Rocket For Sunday Launch

Jeff Bozos challenge to SpaceX's Falcon-9 heavy lift rocket, the New Glenn rocket, to make…

17 hours ago

Google Donates $1 Million To Donald Trump Inauguration Fund

Bending the knee continues from the tech industry, as Alphabet's Google becomes latest to make…

2 days ago

Microsoft Confirms Job Cuts Based On Performance

Software and cloud giant Microsoft confirms it is cutting a small percentage of jobs across…

2 days ago