2460 lines
74 KiB
HTML
2460 lines
74 KiB
HTML
<html devsite>
|
||
<head>
|
||
<title>Android Security Bulletin—August 2016</title>
|
||
<meta name="project_path" value="/_project.yaml" />
|
||
<meta name="book_path" value="/_book.yaml" />
|
||
</head>
|
||
<body>
|
||
<!--
|
||
Copyright 2017 The Android Open Source Project
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
-->
|
||
|
||
|
||
<p><em>Published August 01, 2016 | Updated October 21, 2016</em></p>
|
||
<p>
|
||
The Android Security Bulletin contains details of security vulnerabilities
|
||
affecting Android devices. Alongside the bulletin, we have released a security
|
||
update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware
|
||
images have also been released to the <a
|
||
href="https://developers.google.com/android/nexus/images">Google Developer
|
||
site</a>. Security Patch Levels of August 05, 2016 or later address these
|
||
issues. Refer to the <a
|
||
href="https://support.google.com/nexus/answer/4457705#nexus_devices">documentation</a>
|
||
to learn how to check the security patch level.
|
||
</p>
|
||
<p>
|
||
Partners were notified about the issues described in the bulletin on July 06,
|
||
2016 or earlier. Where applicable, source code patches for these issues have
|
||
been released to the Android Open Source Project (AOSP) repository. This
|
||
bulletin also includes links to patches outside of AOSP.
|
||
</p>
|
||
<p>
|
||
The most severe of these issues is a Critical security vulnerability that could
|
||
enable remote code execution on an affected device through multiple methods such
|
||
as email, web browsing, and MMS when processing media files. The
|
||
<a href="/security/overview/updates-resources.html#severity">severity
|
||
assessment</a> is based on the effect that exploiting the vulnerability would
|
||
possibly have on an affected device, assuming the platform and service
|
||
mitigations are disabled for development purposes or if successfully bypassed.
|
||
</p>
|
||
<p>
|
||
We have had no reports of active customer exploitation or abuse of these newly
|
||
reported issues. Refer to the
|
||
<a href="#mitigations">Android and Google service mitigations</a>
|
||
section for details on the
|
||
<a href="/security/enhancements/index.html">Android
|
||
security platform protections</a> and service protections such as SafetyNet,
|
||
which improve the security of the Android platform.
|
||
</p>
|
||
<p>
|
||
We encourage all customers to accept these updates to their devices.
|
||
</p>
|
||
<h2 id="announcements">Announcements</h2>
|
||
<ul>
|
||
<li>Bulletin revised to correct CVE-2016-3856 to CVE-2016-2060.</li>
|
||
<li>This bulletin has two security patch level strings to provide Android
|
||
partners with the flexibility to move more quickly to fix a subset of
|
||
vulnerabilities that are similar across all Android devices. See <a
|
||
href="#common-questions-and-answers">Common questions and answers</a> for
|
||
additional information:
|
||
<ul>
|
||
<li><strong>2016-08-01</strong>: Partial security patch level string. This
|
||
security patch level string indicates that all issues associated with 2016-08-01
|
||
(and all previous security patch level strings) are addressed.</li>
|
||
<li><strong>2016-08-05</strong>: Complete security patch level string. This
|
||
security patch level string indicates that all issues associated with 2016-08-01
|
||
and 2016-08-05 (and all previous security patch level strings) are addressed.</li>
|
||
</ul>
|
||
</li>
|
||
<li>Supported Nexus devices will receive a single OTA update with the August 05,
|
||
2016 security patch level.</li>
|
||
</ul>
|
||
<h2 id="mitigations">Android and Google service mitigations</h2>
|
||
<p>
|
||
This is a summary of the mitigations provided by the <a
|
||
href="/security/enhancements/index.html">Android
|
||
security platform</a> and service protections such as SafetyNet. These
|
||
capabilities reduce the likelihood that security vulnerabilities could be
|
||
successfully exploited on Android.
|
||
</p>
|
||
<ul>
|
||
<li>Exploitation for many issues on Android is made more difficult by
|
||
enhancements in newer versions of the Android platform. We encourage all users
|
||
to update to the latest version of Android where possible.</li>
|
||
<li>The Android Security team actively monitors for abuse with <a
|
||
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
|
||
Apps and SafetyNet</a>, which are designed to warn users about <a
|
||
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
|
||
Harmful Applications</a>. Verify Apps is enabled by default on devices with <a
|
||
href="http://www.android.com/gms">Google Mobile Services</a>, and is especially
|
||
important for users who install applications from outside of Google Play. Device
|
||
rooting tools are prohibited within Google Play, but Verify Apps warns users
|
||
when they attempt to install a detected rooting application—no matter where it
|
||
comes from. Additionally, Verify Apps attempts to identify and block
|
||
installation of known malicious applications that exploit a privilege escalation
|
||
vulnerability. If such an application has already been installed, Verify Apps
|
||
will notify the user and attempt to remove the detected application.</li>
|
||
<li>As appropriate, Google Hangouts and Messenger applications do not
|
||
automatically pass media to processes such as Mediaserver.</li>
|
||
</ul>
|
||
<h2 id="acknowledgements">Acknowledgements</h2>
|
||
<p>
|
||
We would like to thank these researchers for their contributions:
|
||
</p>
|
||
<ul>
|
||
<li>Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security
|
||
Team: CVE-2016-3821, CVE-2016-3837</li>
|
||
<li>Adam Donenfeld et al. of Check Point Software Technologies Ltd.:
|
||
CVE-2016-2504</li>
|
||
<li>Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>),
|
||
Mingjian Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
|
||
and Xuxian Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3844</li>
|
||
<li>Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>),
|
||
Yuan-Tsung Lo (<a
|
||
href="mailto:computernik@gmail.com">computernik@gmail.com)</a>, and Xuxian Jiang
|
||
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3857</li>
|
||
<li>David Benjamin and Kenny Root of Google: CVE-2016-3840</li>
|
||
<li>Dawei Peng (<a href="http://weibo.com/u/5622360291">Vinc3nt4H</a>) of <a
|
||
href="http://jaq.alibaba.com">Alibaba Mobile Security Team</a>: CVE-2016-3822</li>
|
||
<li>Di Shen (<a href="https://twitter.com/returnsme">@returnsme</a>) of KeenLab
|
||
(<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2016-3842</li>
|
||
<li>Dianne Hackborn of Google: CVE-2016-2497</li>
|
||
<li>Dmitry Vyukov of Google Dynamic Tools team: CVE-2016-3841</li>
|
||
<li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>),
|
||
pjf (<a href="http://weibo.com/jfpan">weibo.com/jfpan</a>) of IceSword Lab, <a
|
||
href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-3852</li>
|
||
<li>Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>)
|
||
of Alpha Team, <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.:
|
||
CVE-2016-3834</li>
|
||
<li>Kai Lu (<a href="https://twitter.com/K3vinLuSec">@K3vinLuSec</a>) of
|
||
Fortinet's FortiGuard Labs: CVE-2016-3820</li>
|
||
<li>Kandala Shivaram reddy, DS, and Uppi: CVE-2016-3826</li>
|
||
<li>Mingjian Zhou (<a
|
||
href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu (<a
|
||
href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a
|
||
href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3823, CVE-2016-3835,
|
||
CVE-2016-3824, CVE-2016-3825</li>
|
||
<li>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>) of
|
||
Tesla Motors Product Security Team: CVE-2016-3847, CVE-2016-3848</li>
|
||
<li>Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang song of Alibaba
|
||
Mobile Security Group: CVE-2016-3845</li>
|
||
<li>Peter Pi (<a href="https://twitter.com/heisecode">@heisecode</a>) of Trend
|
||
Micro: CVE-2016-3849</li>
|
||
<li>Qianwei Hu (<a href="mailto:rayxcp@gmail.com">rayxcp@gmail.com</a>) of <a
|
||
href="http://www.wooyun.org/">WooYun TangLab</a>: CVE-2016-3846</li>
|
||
<li>Qidan He (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) of
|
||
KeenLab (<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent:
|
||
CVE-2016-3832</li>
|
||
<li>Sharvil Nanavati of Google: CVE-2016-3839</li>
|
||
<li>Shinjo Park (<a href="https://twitter.com/ad_ili_rai">@ad_ili_rai</a>) and
|
||
Altaf Shaik of <a
|
||
href="http://www.isti.tu-berlin.de/security_in_telecommunications">Security in
|
||
Telecommunications</a>: CVE-2016-3831</li>
|
||
<li>Tom Rootjunky: CVE-2016-3853</li>
|
||
<li>Vasily Vasiliev: CVE-2016-3819</li>
|
||
<li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of
|
||
Alibaba Inc.: CVE-2016-3827, CVE-2016-3828, CVE-2016-3829</li>
|
||
<li>Wish Wu (<a href="http://weibo.com/wishlinux">吴潍浠</a>) (<a
|
||
href="https://twitter.com/wish_wu">@wish_wu</a>) of <a
|
||
href="http://blog.trendmicro.com/trendlabs-security-intelligence/author/wishwu/">Trend
|
||
Micro Inc</a>.: CVE-2016-3843</li>
|
||
<li>Yongke Wang (<a href="https://twitter.com/rudykewang">@Rudykewang</a>) of
|
||
Tencent's Xuanwu LAB: CVE-2016-3836</li>
|
||
</ul>
|
||
<p>
|
||
We would like to thank Daniel Micay of Copperhead Security, Jeff Vander Stoep,
|
||
and Yabin Cui of Google for their contribution of platform level updates to
|
||
mitigate a class of vulnerabilities such as CVE-2016-3843. This mitigation is
|
||
based on work by Brad Spengler of Grsecurity.
|
||
</p>
|
||
<h2
|
||
id="2016-08-01-details">
|
||
2016-08-01 security patch level—Security vulnerability details</h2>
|
||
<p>
|
||
In the sections below, we provide details for each of the security
|
||
vulnerabilities that apply to the 2016-08-01 patch level. There is a description of
|
||
the issue, a severity rationale, and a table with the CVE, associated
|
||
references, severity, updated Nexus devices, updated AOSP versions (where
|
||
applicable), and date reported. When available, we will link the public change
|
||
that addressed the issue to the bug ID, such as the AOSP change list. When
|
||
multiple changes relate to a single bug, additional references are linked to
|
||
numbers following the bug ID.
|
||
</p>
|
||
|
||
<h3 id="remote-code-execution-vulnerability-in-mediaserver">
|
||
Remote code execution vulnerability in Mediaserver</h3>
|
||
<p>
|
||
A remote code execution vulnerability in Mediaserver could enable an attacker
|
||
using a specially crafted file to cause memory corruption during media file and
|
||
data processing. This issue is rated as Critical due to the possibility of
|
||
remote code execution within the context of the Mediaserver process. The
|
||
Mediaserver process has access to audio and video streams, as well as access to
|
||
privileges that third-party apps could not normally access.
|
||
</p>
|
||
<p>
|
||
The affected functionality is provided as a core part of the operating system
|
||
and there are multiple applications that allow it to be reached with remote
|
||
content, most notably MMS and browser playback of media.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3819</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/590d1729883f700ab905cdc9ad850f3ddd7e1f56">
|
||
A-28533562</a></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 2, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3820</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/libavc/+/a78887bcffbc2995cf9ed72e0697acf560875e9e">
|
||
A-28673410</a></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>May 6, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3821</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/42a25c46b844518ff0d0b920c20c519e1417be69">
|
||
A-28166152</a></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="remote-code-execution-vulnerability-in-libjhead">
|
||
Remote code execution vulnerability in libjhead</h3>
|
||
<p>
|
||
A remote code execution vulnerability in libjhead could enable an attacker using
|
||
a specially crafted file to execute arbitrary code in the context of an
|
||
unprivileged process. This issue is rated as High due to the possibility of
|
||
remote code execution in applications that use this library.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3822</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/jhead/+/bae671597d47b9e5955c4cb742e468cebfd7ca6b">
|
||
A-28868315</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-mediaserver">
|
||
Elevation of privilege vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Mediaserver could enable a local
|
||
malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3823</td>
|
||
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95">
|
||
A-28815329</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3824</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b351eabb428c7ca85a34513c64601f437923d576">
|
||
A-28816827</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3825</td>
|
||
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/d575ecf607056d8e3328ef2eb56c52e98f81e87d">
|
||
A-28816964</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3826</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/9cd8c3289c91254b3955bd7347cf605d6fa032c6">
|
||
A-29251553</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Jun 9, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="denial-of-service-vulnerability-in-mediaserver">
|
||
Denial of service vulnerability in Mediaserver</h3>
|
||
<p>
|
||
A denial of service vulnerability in Mediaserver could enable an attacker using
|
||
a specially crafted file to cause a device hang or reboot. This issue is rated
|
||
as High due to the possibility of a temporary remote denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3827</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/a4567c66f4764442c6cb7b5c1858810194480fb5">
|
||
A-28816956</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0.1</td>
|
||
<td>May 16, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3828</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/libavc/+/7554755536019e439433c515eeb44e701fb3bfb2">
|
||
A-28835995</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>May 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3829</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/libavc/+/326fe991a4b7971e8aeaf4ac775491dd8abd85bb">
|
||
A-29023649</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>May 27, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3830</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/8e438e153f661e9df8db0ac41d587e940352df06">
|
||
A-29153599</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="denial-of-service-vulnerability-in-system-clock">
|
||
Denial of service vulnerability in system clock</h3>
|
||
<p>
|
||
A denial of service vulnerability in the system clock could enable a remote
|
||
attacker to crash the device. This issue is rated as High due to the possibility
|
||
of a temporary remote denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3831</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/opt/telephony/+/f47bc301ccbc5e6d8110afab5a1e9bac1d4ef058">
|
||
A-29083635</a></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 31, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-framework-apis">
|
||
Elevation of privilege vulnerability in framework APIs</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the framework APIs could enable a
|
||
local malicious application to bypass operating system protections that isolate
|
||
application data from other applications. This issue is rated as Moderate
|
||
because it could be used to gain access to data that is outside of the
|
||
application’s permission levels.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3832</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/e7cf91a198de995c7440b3b64352effd2e309906">
|
||
A-28795098</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 15, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-shell">
|
||
Elevation of privilege vulnerability in Shell</h3>
|
||
<p>
|
||
An elevation of privilege in the Shell could enable a local malicious
|
||
application to bypass device constraints such as user restrictions. This issue
|
||
is rated as Moderate because it is a local bypass of user permissions.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="18%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3833</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/01875b0274e74f97edf6b0d5c92de822e0555d03">
|
||
A-29189712</a>
|
||
[<a href="https://android.googlesource.com/platform/frameworks/base/+/4e4743a354e26467318b437892a9980eb9b8328a">2</a>]</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-openssl">
|
||
Information disclosure vulnerability in OpenSSL</h3>
|
||
<p>
|
||
An information disclosure vulnerability in OpenSSL could allow a local malicious
|
||
application to access data outside of its permission levels. This issue is rated
|
||
as Moderate because it could be used to access sensitive data without
|
||
permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2842</td>
|
||
<td>A-29060514</td>
|
||
<td>None*</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1</td>
|
||
<td>Mar 29, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* Supported Nexus devices that have installed all available updates are not
|
||
affected by this vulnerability</p>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-camera-apis">
|
||
Information disclosure vulnerability in camera APIs</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the camera APIs could allow a local
|
||
malicious application to access data structures outside of its permission levels. This
|
||
issue is rated as Moderate because it could be used to access sensitive data
|
||
without permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3834</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc">
|
||
A-28466701</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Apr 28, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-mediaserver">
|
||
Information disclosure vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in Mediaserver could allow a local
|
||
malicious application to access data outside of its permission levels. This
|
||
issue is rated as Moderate because it could be used to access sensitive data
|
||
without permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3835</td>
|
||
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95">
|
||
A-28920116</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 23, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-surfaceflinger">
|
||
Information disclosure vulnerability in SurfaceFlinger</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the SurfaceFlinger service could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as Moderate because it could be used to access
|
||
sensitive data without explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3836</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/3bcf0caa8cca9143443814b36676b3bae33a4368">
|
||
A-28592402</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>May 4, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-wi-fi">
|
||
Information disclosure vulnerability in Wi-Fi</h3>
|
||
<p>
|
||
An information disclosure vulnerability in Wi-Fi could allow a local malicious
|
||
application to to access data outside of its permission levels. This issue is
|
||
rated Moderate because it could be used to access sensitive data without
|
||
permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3837</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/a209ff12ba9617c10550678ff93d01fb72a33399">
|
||
A-28164077</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="denial-of-service-vulnerability-in-system-ui">
|
||
Denial of service vulnerability in system UI</h3>
|
||
<p>
|
||
A denial of service vulnerability in the system UI could enable a local
|
||
malicious application to prevent 911 calls from a locked screen. This issue is
|
||
rated as Moderate due to the possibility of a denial of service on a critical
|
||
function.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3838</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/468651c86a8adb7aa56c708d2348e99022088af3">
|
||
A-28761672</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="denial-of-service-vulnerability-in-bluetooth">
|
||
Denial of service vulnerability in Bluetooth</h3>
|
||
<p>
|
||
A denial of service vulnerability in Bluetooth could enable a local malicious
|
||
application to prevent 911 calls from a Bluetooth device. This issue is rated as
|
||
Moderate due to the possibility of a denial of service on a critical function.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3839</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/bt/+/472271b153c5dc53c28beac55480a8d8434b2d5c">
|
||
A-28885210</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<h2 id="2016-08-05-details">
|
||
2016-08-05 security patch level—Vulnerability details</h2>
|
||
<p>
|
||
In the sections below, we provide details for each of the security
|
||
vulnerabilities that apply to the 2016-08-05 patch level. There is a description of
|
||
the issue, a severity rationale, and a table with the CVE, associated
|
||
references, severity, updated Nexus devices, updated AOSP versions (where
|
||
applicable), and date reported. When available, we will link the public change
|
||
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
||
changes relate to a single bug, additional references are linked to numbers
|
||
following the bug ID.
|
||
</p>
|
||
|
||
<h3 id="remote-code-execution-vulnerability-in-qualcomm-wi-fi-driver">
|
||
Remote code execution vulnerability in Qualcomm Wi-Fi driver</h3>
|
||
<p>
|
||
A remote code execution vulnerability in the Qualcomm Wi-Fi driver could enable
|
||
a remote attacker to execute arbitrary code within the context of the kernel.
|
||
This issue is rated as Critical due to the possibility of a local permanent
|
||
device compromise.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9902</td>
|
||
<td>A-28668638
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50">
|
||
QC-CR#553937</a><br />
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50">
|
||
QC-CR#553941</a>
|
||
</p>
|
||
</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="remote-code-execution-vulnerability-in-conscrypt">Remote code execution
|
||
vulnerability in Conscrypt</h3>
|
||
<p>
|
||
A remote code execution vulnerability in Conscrypt could enable a remote
|
||
attacker to execute arbitrary code within the context of a privileged process.
|
||
This issue is rated as Critical due to the possibility of remote code execution.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3840</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/conscrypt/+/5af5e93463f4333187e7e35f3bd2b846654aa214">
|
||
A-28751153</a></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-components">
|
||
Elevation of privilege vulnerability in Qualcomm components</h3>
|
||
<p>
|
||
The table below contains security vulnerabilities affecting Qualcomm components,
|
||
potentially including the bootloader, camera driver, character drive,
|
||
networking, sound driver, and video driver.
|
||
</p>
|
||
<p>
|
||
The most severe of these issues is rated as Critical due to possibility that a
|
||
local malicious application could execute arbitrary code within the context of
|
||
the kernel leading to a local permanent device compromise, which may require
|
||
reflashing the operating system to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9863</td>
|
||
<td>A-28768146
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=75eac48a48562f819f50eeff8369b296d89102d7">
|
||
QC-CR#549470</a>
|
||
</p>
|
||
</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9864</td>
|
||
<td>A-28747998
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=a1124defc680055e2f2a8c8e3da4a94ca2ec842e">
|
||
QC-CR#561841</a>
|
||
</p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 27, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9865</td>
|
||
<td>A-28748271
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=e65a876a155de945e306f2726f3a557415e6044e">
|
||
QC-CR#550013</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 27, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9866</td>
|
||
<td>A-28747684
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8e6daae70422ad35146a87700e6634a747d1ff5d">
|
||
QC-CR#511358</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9867</td>
|
||
<td>A-28749629
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=322c518689a7f820165ca4c5d6b750b02ac34665">
|
||
QC-CR#514702</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9868</td>
|
||
<td>A-28749721
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=1f274b74c00187ba1c379971503f51944148b22f">
|
||
QC-CR#511976</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9869</td>
|
||
<td>A-28749728
|
||
<p>
|
||
<a
|
||
href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8d1f7531ff379befc129a6447642061e87562bca">
|
||
QC-CR#514711</a>
|
||
[<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=7a26934e4196b4aa61944081989189d59b108768">2</a>]
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9870</td>
|
||
<td>A-28749743
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=4f57652fcd2dce7741f1ac6dc0417e2f265cd1de">
|
||
QC-CR#561044</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9871</td>
|
||
<td>A-28749803
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f615e40c706708f74cd826d5b19c63025f54c041">
|
||
QC-CR#514717</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9872</td>
|
||
<td>A-28750155
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=fc787ebd71fa231cc7dd2a0d5f2208da0527096a">
|
||
QC-CR#590721</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9873</td>
|
||
<td>A-28750726
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ef29ae1d40536fef7fb95e4d5bb5b6b57bdf9420">
|
||
QC-CR#556860</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9874</td>
|
||
<td>A-28751152
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=56ff68b1f93eaf22e5e0284648fd862dc08c9236">
|
||
QC-CR#563086</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6P, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9875</td>
|
||
<td>A-28767589
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=b77c694b88a994d077316c157168c710696f8805">
|
||
QC-CR#483310</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9876</td>
|
||
<td>A-28767796
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=7efd393ca08ac74b2e3d2639b0ad77da139e9139">
|
||
QC-CR#483408</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9877</td>
|
||
<td>A-28768281
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f0c0112a6189747a3f24f20210157f9974477e03">
|
||
QC-CR#547231</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9878</td>
|
||
<td>A-28769208
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=96a62c1de93a44e6ca69514411baf4b3d67f6dee">
|
||
QC-CR#547479</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9879</td>
|
||
<td>A-28769221
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=ecc8116e1befb3a764109f47ba0389434ddabbe4">
|
||
QC-CR#524490</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9880</td>
|
||
<td>A-28769352
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f2a3f5e63e15e97a66e8f5a300457378bcb89d9c">
|
||
QC-CR#556356</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9881</td>
|
||
<td>A-28769368
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ba3f404a10b3bb7e9c20440837df3cd35c5d0c4b">
|
||
QC-CR#539008</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9882</td>
|
||
<td>A-28769546
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=3a4ebaac557a9e3fbcbab4561650abac8298a4d9">
|
||
QC-CR#552329</a>
|
||
[<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=0f6afe815b1b3f920f3502be654c848bdfe5ef38">2</a>]</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9883</td>
|
||
<td>A-28769912
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=cbf79a67348e48557c0d0bb9bc58391b3f84bc46">
|
||
QC-CR#565160</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9884</td>
|
||
<td>A-28769920
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f4948193c46f75e16d4382c4472485ab12b7bd17">
|
||
QC-CR#580740</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9885</td>
|
||
<td>A-28769959
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=a1d5a4cbd5aa8656bc23b40c7cc43941e10f89c3">
|
||
QC-CR#562261</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9886</td>
|
||
<td>A-28815575
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=80be0e249c906704085d13d4ae446f73913fc225">
|
||
QC-CR#555030</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9887</td>
|
||
<td>A-28804057
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=b1bc773cf61265e0e3871b2e52bd6b3270ffc6c3">
|
||
QC-CR#636633</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Jul 3, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9888</td>
|
||
<td>A-28803642
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f044936caab337a4384fbfe64a4cbae33c7e22a1">
|
||
QC-CR#642735</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Aug 29, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9889</td>
|
||
<td>A-28803645
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit?id=f4e2f2d4ef58c88340774099dff3324ec8baa24a">
|
||
QC-CR#674712</a>
|
||
</p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Oct 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8937</td>
|
||
<td>A-28803962
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=c66202b9288cc4ab1c38f7c928fa1005c285c170">
|
||
QC-CR#770548</a>
|
||
</p>
|
||
</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 6, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8938</td>
|
||
<td>A-28804030
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=51c39420e3a49d1a7f05a77c64369b7623088238">
|
||
QC-CR#766022</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 6</td>
|
||
<td>Mar 31, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8939</td>
|
||
<td>A-28398884
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=884cff808385788fa620833c7e2160a4b98a21da">
|
||
QC-CR#779021</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8940</td>
|
||
<td>A-28813987
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e13ebd727d161db7003be6756e61283dce85fa3b">
|
||
QC-CR#792367</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 6</td>
|
||
<td>Apr 30, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8941</td>
|
||
<td>A-28814502
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=d4d4d1dd626b21e68e78395bab3382c1eb04877f">
|
||
QC-CR#792473</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 6, Nexus 7 (2013)</td>
|
||
<td>May 29, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8942</td>
|
||
<td>A-28814652
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=9ec380c06bbd79493828fcc3c876d8a53fd3369f">
|
||
QC-CR#803246</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 6</td>
|
||
<td>Jun 30, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8943</td>
|
||
<td>A-28815158
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ad376e4053b87bd58f62f45b6df2c5544bc21aee">
|
||
QC-CR#794217</a></p>
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ad376e4053b87bd58f62f45b6df2c5544bc21aee">
|
||
QC-CR#836226</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Sep 11, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9891</td>
|
||
<td>A-28749283
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=c10f03f191307f7114af89933f2d91b830150094">
|
||
QC-CR#550061</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5</td>
|
||
<td>Mar 13, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9890</td>
|
||
<td>A-28770207
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=14e0c8614d2715589583d8a95e33c422d110eb6f">
|
||
QC-CR#529177</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Jun 2, 2014</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3
|
||
id="elevation-of-privilege-vulnerability-in-kernel-networking-component">
|
||
Elevation of privilege vulnerability in kernel networking component</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel networking component could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Critical due to the possibility of
|
||
a local permanent device compromise, which may require reflashing the operating
|
||
system to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-2686</td>
|
||
<td>A-28759139
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4de930efc23b92ddf88ce91c405ee645fe6e27ea">
|
||
Upstream kernel</a></p></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>Mar 23, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3841</td>
|
||
<td>A-28746669
|
||
<p>
|
||
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=45f6fad84cc305103b28d73482b344d7f5b76f39">
|
||
Upstream kernel</a></p></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>Dec 3, 2015</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-gpu-driver">
|
||
Elevation of privilege vulnerability in Qualcomm GPU driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm GPU driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as Critical due to the possibility of a local
|
||
permanent device compromise, which may require reflashing the operating system
|
||
to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2504</td>
|
||
<td>A-28026365
|
||
<p>QC-CR#1002974</p></td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013)</td>
|
||
<td>Apr 5, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3842</td>
|
||
<td>A-28377352
|
||
<p>
|
||
QC-CR#1002974</p></td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P</td>
|
||
<td>Apr 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-performance-component">
|
||
Elevation of privilege vulnerability in Qualcomm performance component</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm performance component
|
||
could enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Critical due to the possibility of
|
||
a local permanent device compromise, which may require reflashing the operating
|
||
system to repair the device.
|
||
</p>
|
||
<p class="note">
|
||
<strong>Note:</strong> There is also a platform-level update in this bulletin
|
||
under A-29119870 that is designed to mitigate this class of vulnerabilities.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3843</td>
|
||
<td>A-28086229*
|
||
<p>
|
||
QC-CR#1011071</p></td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>Apr 7, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-kernel">
|
||
Elevation of privilege vulnerability in kernel</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel could enable a local
|
||
malicious application to execute arbitrary code within the context of the
|
||
kernel. This issue is rated as Critical due to the possibility of a local
|
||
permanent device compromise, which may require reflashing the operating system
|
||
to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3857</td>
|
||
<td>A-28522518*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>May 2, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-kernel-memory-system">
|
||
Elevation of privilege vulnerability in kernel memory system</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel memory system could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1593</td>
|
||
<td>A-29577822
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus Player</td>
|
||
<td>Feb 13, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3672</td>
|
||
<td>A-28763575
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus Player</td>
|
||
<td>Mar 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-kernel-sound-component">
|
||
Elevation of privilege vulnerability in kernel sound component</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel sound component could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2544</td>
|
||
<td>A-28695438
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3567eb6af614dac436c4b16a8d426f9faed639b3">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>Jan 19, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2546</td>
|
||
<td>A-28694392
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af368027a49a751d6ff4ee9e3f9961f35bb4fede">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Pixel C</td>
|
||
<td>Jan 19, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9904</td>
|
||
<td>A-28592007
|
||
<p>
|
||
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player</td>
|
||
<td>May 4, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-kernel-file-system">
|
||
Elevation of privilege vulnerability in kernel file system</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel file system could enable a
|
||
local malicious application to execute arbitrary code within the context of the
|
||
kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2012-6701</td>
|
||
<td>A-28939037
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a70b52ec1aaeaf60f4739edb1b422827cb6f3893">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 2, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-mediaserver">
|
||
Elevation of privilege vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Mediaserver could enable a local
|
||
malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not accessible to a third-party
|
||
application.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3844</td>
|
||
<td>A-28299517*
|
||
<p>
|
||
N-CVE-2016-3844</p></td>
|
||
<td>High</td>
|
||
<td>Nexus 9, Pixel C</td>
|
||
<td>Apr 19, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3>Elevation of privilege vulnerability in kernel video driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel video driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3845</td>
|
||
<td>A-28399876*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Apr 20, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-serial-peripheral-interface-driver">
|
||
Elevation of privilege vulnerability in Serial Peripheral Interface driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Serial Peripheral Interface
|
||
driver could enable a local malicious application to execute arbitrary code
|
||
within the context of the kernel. This issue is rated as High because it first
|
||
requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3846</td>
|
||
<td>A-28817378*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>May 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-nvidia-media-driver">
|
||
Elevation of privilege vulnerability in NVIDIA media driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the NVIDIA media driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3847</td>
|
||
<td>A-28871433*
|
||
<p>
|
||
N-CVE-2016-3847</p></td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>May 19, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3848</td>
|
||
<td>A-28919417*
|
||
<p>
|
||
N-CVE-2016-3848</p></td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>May 19, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-ion-driver">
|
||
Elevation of privilege vulnerability in ION driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the ION driver could enable a local
|
||
malicious application to execute arbitrary code within the context of the
|
||
kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3849</td>
|
||
<td>A-28939740</td>
|
||
<td>High</td>
|
||
<td>Pixel C</td>
|
||
<td>May 24, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-bootloader">Elevation
|
||
of privilege vulnerability in Qualcomm bootloader</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm bootloader could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="26%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3850</td>
|
||
<td>A-27917291
|
||
<p>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=030371d45a9dcda4d0cc3c76647e753a1cc1b782">
|
||
QC-CR#945164</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6P, Nexus 7 (2013)</td>
|
||
<td>Mar 28, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-kernel-performance">
|
||
Elevation of privilege vulnerability in kernel performance subsystem</h3>
|
||
<p>
|
||
Elevation of privilege vulnerabilities in the kernel performance subsystem could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because of the kernel attack
|
||
surface available for attackers to exploit.
|
||
</p>
|
||
<p class="note">
|
||
<strong>Note:</strong> This is a platform level update designed to mitigate a
|
||
class of vulnerabilities such as CVE-2016-3843 (A-28086229).
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3843</td>
|
||
<td>A-29119870*</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* A patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3
|
||
id="elevation-of-privilege-vulnerability-in-lg-electronics-bootloader">
|
||
Elevation of privilege vulnerability in LG Electronics bootloader</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the LG Electronics bootloader could
|
||
enable an attacker to execute arbitrary code within the context of the kernel.
|
||
This issue is rated as High because it first requires compromising a privileged
|
||
process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3851</td>
|
||
<td>A-29189941*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-qualcomm-components">
|
||
Information disclosure vulnerability in Qualcomm components</h3>
|
||
<p>
|
||
The table below contains security vulnerabilities affecting Qualcomm components,
|
||
potentially including the bootloader, camera driver, character driver,
|
||
networking, sound driver and video driver.
|
||
</p>
|
||
<p>
|
||
The most severe of these issues is rated as High due to the possibility that a
|
||
local malicious application could access data outside of its permission levels
|
||
such as sensitive data without explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9892</td>
|
||
<td>A-28770164
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=591b1f455c32206704cbcf426bb30911c260c33e">
|
||
QC-CR#568717</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Jun 2, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8944</td>
|
||
<td>A-28814213
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e758417e7c31b975c862aa55d0ceef28f3cc9104">
|
||
QC-CR#786116</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 6, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9893</td>
|
||
<td>A-28747914
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=bfc6eee5e30a0c20bc37495233506f4f0cc4991d">
|
||
QC-CR#542223</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5</td>
|
||
<td>Mar 27, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9894</td>
|
||
<td>A-28749708
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=83214431cd02674c70402b160b16b7427e28737f">
|
||
QC-CR#545736</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9895</td>
|
||
<td>A-28750150
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=cc4b26575602e492efd986e9a6ffc4278cee53b5">
|
||
QC-CR#570757</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9896</td>
|
||
<td>A-28767593
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=89f2bcf1ac860b0b380e579e9a8764013f263a7d">
|
||
QC-CR#551795</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9897</td>
|
||
<td>A-28769856
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=46135d80765cb70a914f02a6e7b6abe64679ec86">
|
||
QC-CR#563752</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9898</td>
|
||
<td>A-28814690
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=80be0e249c906704085d13d4ae446f73913fc225">
|
||
QC-CR#554575</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Apr 30, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9899</td>
|
||
<td>A-28803909
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=8756624acb1e090b45baf07b2a8d0ebde114000e">
|
||
QC-CR#547910</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5</td>
|
||
<td>Jul 3, 2014</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9900</td>
|
||
<td>A-28803952
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=63c317dbee97983004dffdd9f742a20d17150071">
|
||
QC-CR#570754</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Aug 8, 2014</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-kernel-scheduler">
|
||
Information disclosure vulnerability in kernel scheduler</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the kernel scheduler could enable a
|
||
local malicious application to access data outside of its permission levels.
|
||
This issue is rated as High because it could be used to access sensitive data
|
||
without explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9903</td>
|
||
<td>A-28731691
|
||
<p>
|
||
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4efbc454ba68def5ef285b26ebfcfdb605b52755">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>Feb 21, 2014</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-mediatek-wi-fi-driver-device-specific">
|
||
Information disclosure vulnerability in MediaTek Wi-Fi driver (device specific)</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the MediaTek Wi-Fi driver could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as High because it could be used to access sensitive
|
||
data without explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3852</td>
|
||
<td>A-29141147*
|
||
<p>
|
||
M-ALPS02751738</p></td>
|
||
<td>High</td>
|
||
<td>Android One</td>
|
||
<td>Apr 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-usb-driver">Information
|
||
disclosure vulnerability in USB driver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the USB driver could enable a local
|
||
malicious application to access data outside of its permission levels. This
|
||
issue is rated as High because it could be used to access sensitive data without
|
||
explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-4482</td>
|
||
<td>A-28619695
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=681fef8380eb818c0b845fca5d2ab1dcbab114ee">
|
||
Upstream kernel</a></p></td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>May 3, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="denial-of-service-vulnerability-in-qualcomm-components">
|
||
Denial of service vulnerability in Qualcomm components</h3>
|
||
<p>
|
||
The table below contains security vulnerabilities affecting Qualcomm components,
|
||
potentially including the Wi-Fi driver.
|
||
</p>
|
||
<p>
|
||
The most severe of these issues is rated as High due to the possibility that an
|
||
attacker could cause a temporary remote denial of service resulting in a device
|
||
hang or reboot.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2014-9901</td>
|
||
<td>A-28670333
|
||
<p>
|
||
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=637f0f7931dd7265ac1c250dc2884d6389c66bde">
|
||
QC-CR#548711</a></p></td>
|
||
<td>High</td>
|
||
<td>Nexus 7 (2013)</td>
|
||
<td>Mar 31, 2014</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-google-play-services">
|
||
Elevation of privilege vulnerability in Google Play services</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Google Play services could allow a
|
||
local attacker to bypass the Factory Reset Protection and gain access to the
|
||
device. This is rated as Moderate due to the possibility of bypassing Factory
|
||
Reset Protection, which could lead to successfully resetting the device and
|
||
erasing all its data.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3853</td>
|
||
<td>A-26803208*</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>None</td>
|
||
<td>May 4, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the <a
|
||
href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
|
||
<h3 id="elevation-of-privilege-vulnerability-in-framework-apis-2">
|
||
Elevation of privilege vulnerability in Framework APIs</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the framework APIs could enable a
|
||
pre-installed application to increase its intent filter priority when the
|
||
application is being updated without the user being notified. This issue is
|
||
rated as Moderate because it could be used to gain elevated capabilities without
|
||
explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2497</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/a75537b496e9df71c74c1d045ba5569631a16298">
|
||
A-27450489</a></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-kernel-networking-component">
|
||
Information disclosure vulnerability in kernel networking component</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the kernel networking component could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as Moderate because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-4486</td>
|
||
<td>A-28620102
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6">
|
||
Upstream kernel</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>May 3, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="information-disclosure-vulnerability-in-kernel-sound-component">
|
||
Information disclosure vulnerability in kernel sound component</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the kernel sound component could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as Moderate because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-4569</td>
|
||
<td>A-28980557
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cec8f96e49d9be372fdb0c3836dcf31ec71e457e">
|
||
Upstream kernel</a></p></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>May 9, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-4578</td>
|
||
<td>A-28980217
|
||
<p>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5">
|
||
Upstream kernel</a>
|
||
[<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6">2</a>]</p></td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>May 11, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="vulnerabilities-in-qualcomm-components">
|
||
Vulnerabilities in Qualcomm components</h3>
|
||
<p>
|
||
The table below contains security vulnerabilities affecting Qualcomm components,
|
||
potentially including the bootloader, camera driver, character driver,
|
||
networking, sound driver, and video driver.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3854</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm/commit/?h=LA.AF.1.2.1_rb1.5&id=cc96def76dfd18fba88575065b29f2ae9191fafa">
|
||
QC-CR#897326</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Feb 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3855</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4">
|
||
QC-CR#990824</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>May 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2060</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/platform/system/netd/commit/?id=e9925f5acb4401588e23ea8a27c3e318f71b5cf8">
|
||
QC-CR#959631</a></td>
|
||
<td>Moderate</td>
|
||
<td>None</td>
|
||
<td>Apr 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
|
||
<p>
|
||
This section answers common questions that may occur after reading this
|
||
bulletin.
|
||
</p>
|
||
<p>
|
||
<strong>1. How do I determine if my device is updated to address these issues?
|
||
</strong>
|
||
</p>
|
||
<p>
|
||
Security Patch Levels of 2016-08-01 or later address all issues associated with
|
||
the 2016-08-01 security patch string level. Security Patch Levels of 2016-08-05
|
||
or later address all issues associated with the 2016-08-05 security patch string
|
||
level. Refer to the <a
|
||
href="https://support.google.com/nexus/answer/4457705">help center</a> for
|
||
instructions on how to check the security patch level. Device manufacturers that
|
||
include these updates should set the patch string level to:
|
||
[ro.build.version.security_patch]:[2016-08-01] or
|
||
[ro.build.version.security_patch]:[2016-08-05].
|
||
</p>
|
||
<p>
|
||
<strong>2. Why does this bulletin have two security patch level
|
||
strings?</strong>
|
||
</p>
|
||
<p>
|
||
This bulletin has two security patch level strings in order to provide Android
|
||
partners with the flexibility to move more quickly to fix a subset of
|
||
vulnerabilities that are similar across all Android devices. Android partners
|
||
are encouraged to fix all issues in this bulletin and use the latest security
|
||
patch level string.
|
||
</p>
|
||
<p>
|
||
Devices that use the security patch level of August 5, 2016 or newer must
|
||
include all applicable patches in this (and previous) security bulletins.
|
||
</p>
|
||
<p>
|
||
Devices that use the August 1, 2016 security patch level must include all issues
|
||
associated with that security patch level, as well as fixes for all issues
|
||
reported in previous security bulletins. Devices that use August 1, 2016
|
||
security patch level may also include a subset of fixes associated with the
|
||
August 5, 2016 security patch level.
|
||
</p>
|
||
<p>
|
||
3<strong>. How do I determine which Nexus devices are affected by each
|
||
issue?</strong>
|
||
</p>
|
||
<p>
|
||
In the <a href="#2016-08-01-details">2016-08-01</a>
|
||
and <a href="#2016-08-05-details">2016-08-05</a>
|
||
security vulnerability details sections, each table has an Updated Nexus devices
|
||
column that covers the range of affected Nexus devices updated for each issue.
|
||
This column has a few options:
|
||
</p>
|
||
<ul>
|
||
<li><strong>All Nexus devices</strong>: If an issue affects all Nexus devices,
|
||
the table will have “All Nexus” in the <em>Updated Nexus devices</em> column.
|
||
“All Nexus” encapsulates the following <a
|
||
href="https://support.google.com/nexus/answer/4457705#nexus_devices">supported
|
||
devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9,
|
||
Android One, Nexus Player, and Pixel C.</li>
|
||
<li><strong>Some Nexus devices</strong>: If an issue doesn’t affect all Nexus
|
||
devices, the affected Nexus devices are listed in the <em>Updated Nexus
|
||
devices</em> column.</li>
|
||
<li><strong>No Nexus devices</strong>: If no Nexus devices are affected by the
|
||
issue, the table will have “None” in the <em>Updated Nexus devices</em> column.
|
||
</li>
|
||
</ul>
|
||
<p>
|
||
<strong>4. What do the entries in the references column map to?</strong>
|
||
</p>
|
||
<p>
|
||
Entries under the <em>References</em> column of the vulnerability details table
|
||
may contain a prefix identifying the organization to which the reference value
|
||
belongs. These prefixes map as follows:
|
||
</p>
|
||
<table>
|
||
<tr>
|
||
<th>Prefix</th>
|
||
<th>Reference</th>
|
||
</tr>
|
||
<tr>
|
||
<td>A-</td>
|
||
<td>Android bug ID</td>
|
||
</tr>
|
||
<tr>
|
||
<td>QC-</td>
|
||
<td>Qualcomm reference number</td>
|
||
</tr>
|
||
<tr>
|
||
<td>M-</td>
|
||
<td>MediaTek reference number</td>
|
||
</tr>
|
||
<tr>
|
||
<td>N-</td>
|
||
<td>NVIDIA reference number</td>
|
||
</tr>
|
||
</table>
|
||
<h2 id="revisions">Revisions</h2>
|
||
|
||
<ul>
|
||
<li>August 01, 2016: Bulletin published.</li>
|
||
<li>August 02, 2016: Bulletin revised to include AOSP links.</li>
|
||
<li>August 16, 2016: CVE-2016-3856 corrected to CVE-2016-2060 and updated the
|
||
reference URL.</li>
|
||
<li>October 21, 2016: Corrected typo in CVE-2016-4486.</li>
|
||
</ul>
|
||
|
||
</body>
|
||
</html>
|