1237 lines
44 KiB
HTML
1237 lines
44 KiB
HTML
<html devsite>
|
||
<head>
|
||
<title>Android Security Bulletin—May 2016</title>
|
||
<meta name="project_path" value="/_project.yaml" />
|
||
<meta name="book_path" value="/_book.yaml" />
|
||
</head>
|
||
<body>
|
||
<!--
|
||
Copyright 2017 The Android Open Source Project
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
-->
|
||
|
||
|
||
|
||
<p><em>Published May 02, 2016 | Updated May 04, 2016</em></p>
|
||
|
||
<p>The Android Security Bulletin contains details of security vulnerabilities
|
||
affecting Android devices. Alongside the bulletin, we have released a
|
||
security update to Nexus devices through an over-the-air (OTA) update. The
|
||
Nexus firmware images have also been released to the
|
||
<a href="https://developers.google.com/android/nexus/images">Google Developer site</a>.
|
||
Security Patch Levels of May 01, 2016 or later address these issues (refer to
|
||
the <a href="https://support.google.com/nexus/answer/4457705">Nexus documentation</a>
|
||
for instructions on how to check the security patch level).</p>
|
||
|
||
<p>Partners were notified about the issues described in the bulletin on April 04,
|
||
2016 or earlier. Where applicable, source code patches for these issues have
|
||
been released to the Android Open Source Project (AOSP) repository.</p>
|
||
|
||
<p>The most severe of these issues is a Critical security vulnerability that could
|
||
enable remote code execution on an affected device through multiple methods
|
||
such as email, web browsing, and MMS when processing media files. The
|
||
<a href="/security/overview/updates-resources.html#severity">severity
|
||
assessment</a> is based on the effect that exploiting the vulnerability would
|
||
possibly have on an affected device, assuming the platform and service
|
||
mitigations are disabled for development purposes or if successfully bypassed.
|
||
</p>
|
||
|
||
<p>We have had no reports of active customer exploitation or abuse of these newly
|
||
reported issues. Refer to the <a href="#mitigations">Android and Google Service Mitigations</a>
|
||
section for details on the <a href="/security/enhancements/index.html">
|
||
Android security platform protections</a> and service protections such as SafetyNet,
|
||
which improve the security of the Android platform.</p>
|
||
|
||
<p>We encourage all customers to accept these updates to their devices.</p>
|
||
|
||
<h2 id=announcements>Announcements</h2>
|
||
|
||
|
||
<ul>
|
||
<li> To reflect a broader focus, we renamed this bulletin (and all following in the
|
||
series) to the Android Security Bulletin. These bulletins encompass a broader
|
||
range of vulnerabilities that may affect Android devices, even if they do not
|
||
affect Nexus devices.</li>
|
||
<li> We updated the Android Security
|
||
<a href="/security/overview/updates-resources.html#severity">severity ratings</a>.
|
||
These changes were the result of data collected over the last six months on
|
||
reported security vulnerabilities and aim to align severities more closely with
|
||
real world impact to users.</li>
|
||
</ul>
|
||
|
||
<h2 id=android_and_google_service_mitigations>Android and Google Service Mitigations</h2>
|
||
|
||
|
||
<p>This is a summary of the mitigations provided by the
|
||
<a href="/security/enhancements/index.html">Android security platform</a>
|
||
and service protections such as SafetyNet. These capabilities reduce the
|
||
likelihood that security vulnerabilities could be successfully exploited on
|
||
Android.</p>
|
||
|
||
<ul>
|
||
<li> Exploitation for many issues on Android is made more difficult by enhancements
|
||
in newer versions of the Android platform. We encourage all users to update to
|
||
the latest version of Android where possible.</li>
|
||
<li> The Android Security team actively monitors for abuse with
|
||
<a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">
|
||
Verify Apps and SafetyNet</a>, which are designed to warn users about
|
||
<a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">
|
||
Potentially Harmful Applications</a>. Verify Apps is enabled by default on devices with
|
||
<a href="http://www.android.com/gms">Google Mobile Services</a>, and is especially
|
||
important for users who install applications from outside
|
||
of Google Play. Device rooting tools are prohibited within Google Play, but
|
||
Verify Apps warns users when they attempt to install a detected rooting
|
||
application—no matter where it comes from. Additionally, Verify Apps attempts
|
||
to identify and block installation of known malicious applications that exploit
|
||
a privilege escalation vulnerability. If such an application has already been
|
||
installed, Verify Apps will notify the user and attempt to remove the detected
|
||
application.</li>
|
||
<li> As appropriate, Google Hangouts and Messenger applications do not automatically
|
||
pass media to processes such as mediaserver.</li>
|
||
</ul>
|
||
|
||
<h2 id=acknowledgements>Acknowledgements</h2>
|
||
|
||
|
||
<p>We would like to thank these researchers for their contributions:</p>
|
||
|
||
<ul>
|
||
<li> Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security
|
||
Team: CVE-2016-2454
|
||
<li> Andy Tyler (<a href="https://twitter.com/ticarpi">@ticarpi</a>) of
|
||
<a href="https://www.e2e-assure.com">e2e-assure</a>: CVE-2016-2457
|
||
<li> Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>) and
|
||
Xuxian Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2441,
|
||
CVE-2016-2442
|
||
<li> Dzmitry Lukyanenka (<a href="http://www.linkedin.com/in/dzima">
|
||
www.linkedin.com/in/dzima</a>): CVE-2016-2458
|
||
<li> Gal Beniamini: CVE-2016-2431
|
||
<li> Hao Chen of Vulpecker Team, Qihoo 360 Technology Co. Ltd: CVE-2016-2456
|
||
<li> Jake Valletta of Mandiant, a FireEye company: CVE-2016-2060
|
||
<li> Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>)
|
||
and pjf (<a href="http://weibo.com/jfpan">weibo.com/jfpan</a>) of IceSword Lab,
|
||
Qihoo 360 Technology Co. Ltd: CVE-2016-2434, CVE-2016-2435, CVE-2016-2436,
|
||
CVE-2016-2441, CVE-2016-2442, CVE-2016-2444, CVE-2016-2445, CVE-2016-2446
|
||
<li> Imre Rad of <a href="http://www.search-lab.hu">Search-Lab Ltd.</a>: CVE-2016-4477
|
||
<li> Jeremy C. Joslin of Google: CVE-2016-2461
|
||
<li> Kenny Root of Google: CVE-2016-2462
|
||
<li> Marco Grassi (<a href="https://twitter.com/marcograss">@marcograss</a>) of KeenLab
|
||
(<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2016-2443
|
||
<li> Michał Bednarski (<a href="https://github.com/michalbednarski">
|
||
https://github.com/michalbednarski</a>): CVE-2016-2440
|
||
<li> Mingjian Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
|
||
Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian
|
||
Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2450, CVE-2016-2448,
|
||
CVE-2016-2449, CVE-2016-2451, CVE-2016-2452
|
||
<li> Peter Pi (<a href="https://twitter.com/heisecode">@heisecode</a>) of Trend Micro:
|
||
CVE-2016-2459, CVE-2016-2460
|
||
<li> Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of Alibaba Inc.:
|
||
CVE-2016-2428, CVE-2016-2429
|
||
<li> <a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>, <a href="mailto:zlbzlb815@163.com">
|
||
Lubo Zhang</a>, Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>),
|
||
and Xuxian Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2437
|
||
<li> Yulong Zhang and Tao (Lenx) Wei of Baidu X-Lab: CVE-2016-2439
|
||
<li> Zach Riggle (<a href="https://twitter.com/ebeip90">@ebeip90</a>) of the Android
|
||
Security Team: CVE-2016-2430
|
||
</ul>
|
||
|
||
<h2 id=security_vulnerability_details>Security Vulnerability Details</h2>
|
||
|
||
|
||
<p>In the sections below, we provide details for each of the security
|
||
vulnerabilities that apply to the 2016-05-01 patch level. There is a description of the issue,
|
||
a severity rationale, and a table with the CVE, associated bug, severity,
|
||
updated Nexus devices, updated AOSP versions (where applicable), and date reported.
|
||
When available, we will link the AOSP change that addressed the issue to
|
||
the bug ID. When multiple changes relate to a single bug, additional AOSP
|
||
references are linked to numbers following the bug ID.</p>
|
||
|
||
<h3 id=remote_code_execution_vulnerability_in_mediaserver>
|
||
Remote Code Execution Vulnerability in Mediaserver</h3>
|
||
|
||
|
||
<p>During media file and data processing of a specially crafted file, a
|
||
vulnerability in mediaserver could allow an attacker to cause memory corruption
|
||
and remote code execution as the mediaserver process.</p>
|
||
|
||
<p>The affected functionality is provided as a core part of the operating system
|
||
and there are multiple applications that allow it to be reached with remote
|
||
content, most notably MMS and browser playback of media.</p>
|
||
|
||
<p>This issue is rated as Critical severity due to the possibility of remote code
|
||
execution within the context of the mediaserver service. The mediaserver
|
||
service has access to audio and video streams, as well as access to privileges
|
||
that third-party apps could not normally access.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2428</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/aac/+/5d4405f601fa11a8955fd7611532c982420e4206">
|
||
26751339</a></td>
|
||
<td>Critical</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Jan 22, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2429</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/flac/+/b499389da21d89d32deff500376c5ee4f8f0b04c">
|
||
27211885</a></td>
|
||
<td>Critical</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 16, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_debuggerd>
|
||
Elevation of Privilege Vulnerability in Debuggerd</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the integrated Android debugger
|
||
could enable a local malicious application to execute arbitrary code within the
|
||
context of the Android debugger. This issue is rated as Critical severity due
|
||
to the possibility of a local permanent device compromise, which may require
|
||
reflashing the operating system to repair the device.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2430</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/core/+/ad54cfed4516292654c997910839153264ae00a0">
|
||
27299236</a></td>
|
||
<td>Critical</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 22, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_qualcomm_trustzone>
|
||
Elevation of Privilege Vulnerability in Qualcomm TrustZone </h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the Qualcomm TrustZone component
|
||
could enable a secure local malicious application to execute arbitrary code
|
||
within the context of the TrustZone kernel. This issue is rated as Critical
|
||
severity due to the possibility of a local permanent device compromise, which
|
||
may require reflashing the operating system to repair the device.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2431</td>
|
||
<td>24968809*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 6, Nexus 7 (2013), Android One</td>
|
||
<td>Oct 15, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2432</td>
|
||
<td>25913059*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 6, Android One</td>
|
||
<td>Nov 28, 2015</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_qualcomm_wi-fi_driver>
|
||
Elevation of Privilege Vulnerability in Qualcomm Wi-Fi Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Critical severity due to
|
||
possibility of a local privilege escalation and arbitrary code execution
|
||
leading to the possibility of a local permanent device compromise, which may
|
||
require reflashing the operating system to repair the device.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-0569</td>
|
||
<td>26754117*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 7 (2013)</td>
|
||
<td>Jan 23, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-0570</td>
|
||
<td>26764809*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 7 (2013)</td>
|
||
<td>Jan 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_nvidia_video_driver>
|
||
Elevation of Privilege Vulnerability in NVIDIA Video Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the NVIDIA video driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as Critical severity due to the possibility of
|
||
a local permanent device compromise, which may require reflashing the operating
|
||
system to repair the device.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2434</td>
|
||
<td>27251090*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 9</td>
|
||
<td>Feb 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2435</td>
|
||
<td>27297988*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 9</td>
|
||
<td>Feb 20, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2436</td>
|
||
<td>27299111*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 9</td>
|
||
<td>Feb 22, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2437</td>
|
||
<td>27436822*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 9</td>
|
||
<td>Mar 1, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_kernel>
|
||
Elevation of Privilege Vulnerability in Kernel</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the kernel could enable a local
|
||
malicious application to execute arbitrary code within the context of the
|
||
kernel. This issue is rated as Critical severity due to the possibility of a
|
||
local privilege escalation and arbitrary code execution leading to the
|
||
possibility of a local permanent device compromise, which may require
|
||
reflashing the operating system to repair the device. This issue was described
|
||
in <a href="/security/advisory/2016-03-18.html">Android Security Advisory 2016-03-18</a>.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-1805</td>
|
||
<td>27275324*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9</td>
|
||
<td>Feb 19, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch in AOSP is available for specific kernel versions:
|
||
<a href="https://android.googlesource.com/kernel/common/+/bf010e99c9bc48002f6bfa1ad801a59bf996270f">3.14</a>,
|
||
<a href="https://android.googlesource.com/kernel/common/+/4a5a45669796c5b4617109182e25b321f9f00beb">3.10</a>, and
|
||
<a href="https://android.googlesource.com/kernel/common/+/f7ebfe91b806501808413c8473a300dff58ddbb5">3.4</a>.</p>
|
||
|
||
<h3 id=remote_code_execution_vulnerability_in_kernel>
|
||
Remote Code Execution Vulnerability in Kernel</h3>
|
||
|
||
|
||
<p>A remote code execution vulnerability in the audio subsystem could enable a
|
||
local malicious application to execute arbitrary code within the context of the
|
||
kernel. Normally a kernel code execution bug like this would be rated Critical,
|
||
but because it first requires compromising a privileged service in order to
|
||
call the audio subsystem, it is rated High severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2438</td>
|
||
<td>26636060*</td>
|
||
<td>High</td>
|
||
<td>Nexus 9 </td>
|
||
<td>Google Internal</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is available in
|
||
<a href="https://github.com/torvalds/linux/commit/b5a663aa426f4884c71cd8580adae73f33570f0d">
|
||
Linux upstream</a>.</p>
|
||
|
||
<h3 id=information_disclosure_vulnerability_in_qualcomm_tethering_controller>
|
||
Information Disclosure Vulnerability in Qualcomm Tethering Controller</h3>
|
||
|
||
|
||
<p>An information disclosure vulnerability in the Qualcomm Tethering controller
|
||
could allow a local malicious application to access personal identifiable
|
||
information without the privileges to do so. This issue is rated as High
|
||
severity because it can be used to gain elevated capabilities, such as
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a> or
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>
|
||
permissions privileges, which are not accessible to a third-party application.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2060</td>
|
||
<td>27942588*</td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Mar 23, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update should be contained in the
|
||
latest drivers of affected devices.</p>
|
||
|
||
<h3 id=remote_code_execution_vulnerability_in_bluetooth>
|
||
Remote Code Execution Vulnerability in Bluetooth</h3>
|
||
|
||
|
||
<p>During pairing of a Bluetooth device, a vulnerability in Bluetooth could allow
|
||
a proximal attacker to execute arbitrary code during the pairing process. This
|
||
issue is rated as High severity due to the possibility of remote code execution
|
||
during the initialization of a Bluetooth device.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2439</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/bt/+/9b534de2aca5d790c2a1c4d76b545f16137d95dd">
|
||
27411268</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 28, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_binder>
|
||
Elevation of Privilege Vulnerability in Binder</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in Binder could allow a local malicious
|
||
application to execute arbitrary code within the context of another app’s
|
||
process. While freeing memory, a vulnerability in the Binder could allow an
|
||
attacker to cause local code execution. This issue is rated as High severity
|
||
due to the possibility of local code execution during free memory process in
|
||
the Binder.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2440</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/a59b827869a2ea04022dd225007f29af8d61837a">
|
||
27252896</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 18, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_qualcomm_buspm_driver>
|
||
Elevation of Privilege Vulnerability in Qualcomm Buspm Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the Qualcomm buspm driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. Normally a kernel code execution bug like this would be
|
||
rated Critical, but because it first requires compromising a service that can
|
||
call the driver, it is rated as High severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2441</td>
|
||
<td>26354602*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P</td>
|
||
<td>Dec 30, 2015</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2442</td>
|
||
<td>26494907*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P</td>
|
||
<td>Dec 30, 2015</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_qualcomm_mdp_driver>
|
||
Elevation of Privilege Vulnerability in Qualcomm MDP Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the Qualcomm MDP driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. Normally a kernel code execution bug like this would be rated
|
||
Critical, but because it first requires compromising a service that can call
|
||
the driver, it is rated as High severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2443</td>
|
||
<td>26404525*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 7 (2013)</td>
|
||
<td>Jan 5, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=eop_in_qualcomm_wi-fi_driver>
|
||
Elevation of Privilege Vulnerability in Qualcomm Wi-Fi Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the Qualcomm Wi-Fi component could
|
||
enable a local malicious application to invoke system calls changing the device
|
||
settings and behavior without the privileges to do so. This issue is rated as
|
||
High severity because it could be used to gain local access to elevated
|
||
capabilities, such as
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a> or
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>
|
||
permissions privileges, which are not accessible to a third-party application.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-0571</td>
|
||
<td>26763920*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 7 (2013)</td>
|
||
<td>Jan 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=eop_in_nvidia_video_driver>
|
||
Elevation of Privilege Vulnerability in NVIDIA Video Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the NVIDIA media driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. Normally a kernel code execution bug like this would be rated
|
||
Critical, but because it first requires compromising a high privilege service
|
||
to call the driver, it is rated High severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2444</td>
|
||
<td>27208332*</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>Feb 16, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2445</td>
|
||
<td>27253079*</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>Feb 17, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2446</td>
|
||
<td>27441354*</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>Mar 1, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=eop_in_wi-fi>
|
||
Elevation of Privilege Vulnerability in Wi-Fi</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in Wi-Fi could enable a local malicious
|
||
application to execute arbitrary code within the context of an elevated system
|
||
application. This issue is rated as High severity because it could also be used
|
||
to gain elevated capabilities, such as
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a> or
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>
|
||
permissions privileges, which are not accessible to third-party applications.</p>
|
||
|
||
<p><strong>Note</strong>:The CVE number has been updated, per MITRE request,
|
||
from CVE-2016-2447 to CVE-2016-4477.</p>
|
||
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-4477</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/wpa_supplicant_8/+/b79e09574e50e168dd5f19d540ae0b9a05bd1535">
|
||
27371366</a>
|
||
[<a href="https://android.googlesource.com/platform/external/wpa_supplicant_8/+/b845b81ec6d724bd359cdb77f515722dd4066cf8">2</a>]
|
||
</td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 24, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_mediaserver>
|
||
Elevation of Privilege Vulnerability in Mediaserver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in mediaserver could enable a local
|
||
malicious application to execute arbitrary code within the context of an
|
||
elevated system application. This issue is rated as High severity because it
|
||
could be used to gain elevated capabilities, such as
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a> or
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>
|
||
permissions privileges, which are not accessible to a third-party application.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2448</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/a2d1d85726aa2a3126e9c331a8e00a8c319c9e2b">
|
||
27533704</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 7, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2449</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b04aee833c5cfb6b31b8558350feb14bb1a0f353">
|
||
27568958</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 9, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2450</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/7fd96ebfc4c9da496c59d7c45e1f62be178e626d">
|
||
27569635</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 9, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2451</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba">
|
||
27597103</a></td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 10, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2452</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/44749eb4f273f0eb681d0fa013e3beef754fa687">
|
||
27662364</a>
|
||
[<a href="https://android.googlesource.com/platform/frameworks/av/+/65756b4082cd79a2d99b2ccb5b392291fd53703f">2</a>]
|
||
[<a href="https://android.googlesource.com/platform/frameworks/av/+/daa85dac2055b22dabbb3b4e537597e6ab73a866">3</a>]
|
||
</td>
|
||
<td>High</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 14, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_mediatek_wi-fi_driver>
|
||
Elevation of Privilege Vulnerability in MediaTek Wi-Fi Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in the MediaTek Wi-Fi driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. Normally a kernel code execution bug like this would be
|
||
rated Critical, but because it first requires compromising a service that can
|
||
call the driver, it is rated as High severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2453</td>
|
||
<td>27549705*</td>
|
||
<td>High</td>
|
||
<td>Android One</td>
|
||
<td>Mar 8, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=remote_denial_of_service_vulnerability_in_qualcomm_hardware_codec>
|
||
Remote Denial of Service Vulnerability in Qualcomm Hardware Codec</h3>
|
||
|
||
|
||
<p>During media file and data processing of a specially crafted file, a remote
|
||
denial of service vulnerability in the Qualcomm hardware video codec could
|
||
allow a remote attacker to block access to an affected device by causing a
|
||
device reboot. This is rated as High severity due to the possibility of remote
|
||
denial of service.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2454</td>
|
||
<td>26221024*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5</td>
|
||
<td>Dec 16, 2015</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_conscrypt>
|
||
Elevation of Privilege Vulnerability in Conscrypt</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in Conscrypt could allow an local
|
||
application to believe a message was authenticated when it was not. This issue
|
||
is rated as Moderate severity because it requires coordinated steps across
|
||
multiple devices.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2461</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/conscrypt/+/50d0447566db4a77d78d592f1c1b5d31096fac8f">
|
||
27324690</a>
|
||
[<a href="https://android.googlesource.com/platform/external/conscrypt/+/1638945d4ed9403790962ec7abed1b7a232a9ff8">2</a>]
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>Google Internal</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2462</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/conscrypt/+/8bec47d2184fca7e8b7337d2a65b2b75a9bc8f54">
|
||
27371173</a></td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>6.0, 6.0.1</td>
|
||
<td>Google Internal</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_openssl_&_boringssl>
|
||
Elevation of Privilege Vulnerability in OpenSSL & BoringSSL</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in OpenSSL and BoringSSL could enable a
|
||
local malicious application to access data outside of its permission levels.
|
||
Normally this would be rated High, but because it requires an uncommon manual
|
||
configuration, it is rated as Moderate severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-0705</td>
|
||
<td><a href="https://android.googlesource.com/platform/external/boringssl/+/591be84e89682622957c8f103ca4be3a5ed0f800">
|
||
27449871</a></td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 7, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=eop_in_mediatek_wi-fi_driver>
|
||
Elevation of Privilege Vulnerability in MediaTek Wi-Fi Driver</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in MediaTek Wi-Fi driver could enable a
|
||
local malicious application to cause a denial of service. Normally an elevation
|
||
of privilege bug like this would be rated High, but because it requires first
|
||
compromising a system service, it is rated as Moderate severity.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2456</td>
|
||
<td>27275187*</td>
|
||
<td>Moderate</td>
|
||
<td>Android One</td>
|
||
<td>Feb 19, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is not in AOSP. The update is contained in the
|
||
latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>.</p>
|
||
|
||
<h3 id=elevation_of_privilege_vulnerability_in_wi-fi>
|
||
Elevation of Privilege Vulnerability in Wi-Fi</h3>
|
||
|
||
|
||
<p>An elevation of privilege vulnerability in Wi-Fi could enable a guest account
|
||
to modify the Wi-Fi settings that persist for the primary user. This issue is
|
||
rated as Moderate severity because it enables local access to "
|
||
<a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">
|
||
dangerous</a>" capabilities without permission.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2457</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/12332e05f632794e18ea8c4ac52c98e82532e5db">
|
||
27411179</a></td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 29, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=information_disclosure_vulnerability_in_aosp_mail>
|
||
Information Disclosure Vulnerability in AOSP Mail</h3>
|
||
|
||
|
||
<p>An information disclosure vulnerability in AOSP Mail could enable a local
|
||
malicious application to gain access to user’s private information. This issue
|
||
is rated Moderate severity because it could be used to improperly access data
|
||
without permission.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2458</td>
|
||
<td><a href="https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/a55168330d9326ff2120285763c818733590266a">
|
||
27335139</a>
|
||
[<a href="https://android.googlesource.com/platform/packages/apps/Email/+/2791f0b33b610247ef87278862e66c6045f89693">2</a>]
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Feb 23, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=information_disclosure_vulnerability_in_mediaserver>
|
||
Information Disclosure Vulnerability in Mediaserver</h3>
|
||
|
||
|
||
<p>An information disclosure vulnerability in Mediaserver could allow an
|
||
application to access sensitive information. This issue is rated as Moderate
|
||
severity because it could be used to improperly access data without permission.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bugs</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2459</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73">
|
||
27556038</a></td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 7, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2460</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73">
|
||
27555981</a></td>
|
||
<td>Moderate</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
|
||
<td>Mar 7, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
|
||
<h3 id=denial_of_service_vulnerability_in_kernel>
|
||
Denial of Service Vulnerability in Kernel</h3>
|
||
|
||
|
||
<p>A denial of service vulnerability in the kernel could allow a local malicious
|
||
application to cause a device reboot. This issue is rated as Low severity
|
||
because the effect is a temporary denial of service.</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="27%">
|
||
<col width="16%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>Android bug</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-0774</td>
|
||
<td>27721803*</td>
|
||
<td>Low</td>
|
||
<td><a href="#nexus_devices">All Nexus</a></td>
|
||
<td>Mar 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>* The patch for this issue is available in
|
||
<a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/fs/pipe.c?id=b381fbc509052d07ccf8641fd7560a25d46aaf1e">
|
||
Linux upstream</a>.</p>
|
||
|
||
<h2 id=common_questions_and_answers>Common Questions and Answers</h2>
|
||
|
||
|
||
<p>This section reviews answers to common questions that may occur after reading
|
||
this bulletin.</p>
|
||
|
||
<p><strong>1. How do I determine if my device is updated to address these issues?</strong></p>
|
||
|
||
<p>Security Patch Levels of May 01, 2016 or later address these issues (refer to
|
||
the <a href="https://support.google.com/nexus/answer/4457705">Nexus documentation</a>
|
||
for instructions on how to check the security patch level). Device
|
||
manufacturers that include these updates should set the patch string level to:
|
||
[ro.build.version.security_patch]:[2016-05-01]</p>
|
||
|
||
<p id="nexus_devices"><strong>2. How do I determine which Nexus devices are affected
|
||
by each issue?</strong></p>
|
||
|
||
<p>In the <a href="#security_vulnerability_details">Security Vulnerability Details</a>
|
||
section, each table has an Updated Nexus devices column that covers the range
|
||
of affected Nexus devices updated for each issue. This column has a few
|
||
options:</p>
|
||
|
||
<ul>
|
||
<li> <strong>All Nexus devices</strong>: If an issue affects all Nexus devices,
|
||
the table will have All Nexus in the <em>Updated Nexus devices</em> column.
|
||
All Nexus encapsulates the following
|
||
<a href="https://support.google.com/nexus/answer/4457705#nexus_devices">
|
||
supported devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013),
|
||
Nexus 9, Android One, Nexus Player, and Pixel C.
|
||
<li> <strong>Some Nexus devices</strong>: If an issue doesn’t affect all Nexus
|
||
devices, the affected Nexus devices are listed in the <em>Updated Nexus
|
||
devices</em> column.</li>
|
||
<li> <strong>No Nexus devices</strong>: If no Nexus devices are affected by the
|
||
issue, the table will have “None” in the <em>Updated Nexus devices</em> column.</li>
|
||
</ul>
|
||
|
||
<p><strong>3. Why is CVE-2015-1805 included in this bulletin?</strong></p>
|
||
<p>CVE-2015-1805 is included in this bulletin because the <a href="/security/advisory/2016-03-18.html">
|
||
Android Security Advisory—2016-03-18</a> was published very close to the release of
|
||
the April bulletin. Due to the tight timeline, device manufacturers were given the
|
||
option to ship fixes from the <a href="2016-04-02.html">Nexus Security Bulletin—April 2016</a>,
|
||
without the fix for CVE-2015-1805, if they used the April 01, 2016 Security Patch Level.
|
||
It is included again in this bulletin as it must be fixed in order to use the
|
||
May 01, 2016 Security Patch Level.</p>
|
||
<h2 id=revisions>Revisions</h2>
|
||
|
||
|
||
<ul>
|
||
<li> May 02, 2016: Bulletin published.</li>
|
||
<li> May 04, 2016:
|
||
<ul>
|
||
<li> Bulletin revised to include AOSP links.
|
||
<li> List of all Nexus devices updated to include Nexus Player and Pixel C.
|
||
<li> CVE-2016-2447 updated to CVE-2016-4477, per MITRE request.
|
||
</ul>
|
||
</li>
|
||
</ul>
|
||
|
||
</body>
|
||
</html>
|