CVE-2016-5348

Summary

CVE	CVE-2016-5348
State	PUBLISHED
Assigner	mitre
Source Priority	CVE Program / NVD first with legacy fallback
Published	2016-10-10 10:59:47 UTC
Updated	2026-05-06 22:30:45 UTC
Description	The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service (memory consumption, and device hang or reboot) via a large xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 29555864.

Primary CVSS: v3.0 5.9 MEDIUM from [email protected]

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.145970000 probability, percentile 0.945070000 (date 2026-05-07)

Problem Types: CWE-399 | n/a

Version	Source	Type	Score	Severity	Vector
3.0	[email protected]	Primary	5.9	MEDIUM	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H`
2.0	[email protected]	Primary	7.1		`AV:N/AC:M/Au:N/C:N/I:N/A:C`

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Access Vector

Network

Access Complexity

Medium

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

AV:N/AC:M/Au:N/C:N/I:N/A:C

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Google	Android	4.0	All	All	All
Operating System	Google	Android	4.0.1	All	All	All
Operating System	Google	Android	4.0.2	All	All	All
Operating System	Google	Android	4.0.3	All	All	All
Operating System	Google	Android	4.0.4	All	All	All
Operating System	Google	Android	4.1	All	All	All
Operating System	Google	Android	4.1.2	All	All	All
Operating System	Google	Android	4.2	All	All	All
Operating System	Google	Android	4.2.1	All	All	All
Operating System	Google	Android	4.2.2	All	All	All
Operating System	Google	Android	4.3	All	All	All
Operating System	Google	Android	4.3.1	All	All	All
Operating System	Google	Android	4.4	All	All	All
Operating System	Google	Android	4.4.1	All	All	All
Operating System	Google	Android	4.4.2	All	All	All
Operating System	Google	Android	4.4.3	All	All	All
Operating System	Google	Android	5.0	All	All	All
Operating System	Google	Android	5.0.1	All	All	All
Operating System	Google	Android	5.1	All	All	All
Operating System	Google	Android	5.1.0	All	All	All
Operating System	Google	Android	6.0	All	All	All
Operating System	Google	Android	6.0.1	All	All	All
Operating System	Google	Android	7.0	All	All	All

Source	Vendor	Product	Version	Platforms
CNA	Na	N/a	affected n/a	Not specified

Reference	Source	Link	Tags
Sign in - Google Accounts	af854a3a-2127-422b-91ae-364da2661108	code.google.com	Permissions Required
Android Security Bulletin—October 2016 \| Android Open Source Project	af854a3a-2127-422b-91ae-364da2661108	source.android.com	Vendor Advisory
Advisory: Crashing Android devices with large Assisted-GPS Data Files [CVE-2016-5348] \| Nightwatch Cybersecurity	af854a3a-2127-422b-91ae-364da2661108	wwws.nightwatchcybersecurity.com	Exploit, Patch, Technical Description, Third Party Advisory
Android Security Bulletin—April 2018 \| Android Open Source Project	af854a3a-2127-422b-91ae-364da2661108	source.android.com
Google Android GPS CVE-2016-5348 Denial of Service Vulnerability	af854a3a-2127-422b-91ae-364da2661108	www.securityfocus.com
Android - 'gpsOneXtra' Data Files Denial of Service	af854a3a-2127-422b-91ae-364da2661108	www.exploit-db.com
218b813d5bc2d7d3952ea1861c38b4aa944ac59b - platform/frameworks/base - Git at Google	af854a3a-2127-422b-91ae-364da2661108	android.googlesource.com	Patch
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

There are currently no legacy QID mappings associated with this CVE.