2118 lines
68 KiB
HTML
2118 lines
68 KiB
HTML
<html devsite>
|
||
<head>
|
||
<title>Android Security Bulletin—October 2016</title>
|
||
<meta name="project_path" value="/_project.yaml" />
|
||
<meta name="book_path" value="/_book.yaml" />
|
||
</head>
|
||
<body>
|
||
<!--
|
||
Copyright 2017 The Android Open Source Project
|
||
|
||
Licensed under the Apache License, Version 2.0 (the "License");
|
||
you may not use this file except in compliance with the License.
|
||
You may obtain a copy of the License at
|
||
|
||
http://www.apache.org/licenses/LICENSE-2.0
|
||
|
||
Unless required by applicable law or agreed to in writing, software
|
||
distributed under the License is distributed on an "AS IS" BASIS,
|
||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||
See the License for the specific language governing permissions and
|
||
limitations under the License.
|
||
-->
|
||
|
||
|
||
<p><em>Published October 03, 2016 | Updated October 04, 2016</em>
|
||
</p>
|
||
<p>
|
||
The Android Security Bulletin contains details of security vulnerabilities
|
||
affecting Android devices. Alongside the bulletin, we have released a security
|
||
update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware
|
||
images have also been released to the
|
||
<a href="https://developers.google.com/android/nexus/images">Google Developer
|
||
site</a>. Security Patch Levels of October 05, 2016 or later address these
|
||
issues. Refer to the
|
||
<a href="https://support.google.com/nexus/answer/4457705#nexus_devices">documentation</a>
|
||
to learn how to check the security patch level. Supported Nexus devices will
|
||
receive a single OTA update with the October 05, 2016 security patch level.
|
||
</p>
|
||
<p>
|
||
Partners were notified about the issues described in the bulletin on September
|
||
06, 2016 or earlier. Where applicable, source code patches for these issues
|
||
have been released to the Android Open Source Project (AOSP) repository. This
|
||
bulletin also includes links to patches outside of AOSP.
|
||
</p>
|
||
<p>
|
||
The most severe of these issues are Critical security vulnerabilities in
|
||
device-specific code that could enable remote code execution within the context
|
||
of the kernel, leading to the possibility of a local permanent device
|
||
compromise, which may require reflashing the operating system to repair the
|
||
device. The <a href="/security/overview/updates-resources.html#severity">severity
|
||
assessment</a> is based on the effect that exploiting the vulnerability would
|
||
possibly have on an affected device, assuming the platform and service
|
||
mitigations are disabled for development purposes or if successfully bypassed.
|
||
</p>
|
||
<p>
|
||
We have had no reports of active customer exploitation or abuse of these newly
|
||
reported issues. Refer to the <a href="#mitigations">Android and Google service
|
||
mitigations</a> section for details on the
|
||
<a href="/security/enhancements/index.html">Android
|
||
security platform protections</a> and service protections such as
|
||
<a href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>,
|
||
which improve the security of the Android platform.
|
||
</p>
|
||
<p>
|
||
We encourage all customers to accept these updates to their devices.
|
||
</p>
|
||
<h2 id="announcements">Announcements</h2>
|
||
<ul>
|
||
<li>This bulletin has two security patch level strings to provide Android
|
||
partners with the flexibility to more quickly fix a subset of vulnerabilities
|
||
that are similar across all Android devices. See
|
||
<a href="#common-questions-and-answers">Common questions and answers</a> for
|
||
additional information:
|
||
<ul>
|
||
<li><strong>2016-10-01</strong>: Partial security patch level string. This
|
||
security patch level string indicates that all issues associated with 2016-10-01
|
||
(and all previous security patch level strings) are addressed.</li>
|
||
<li><strong>2016-10-05</strong>: Complete security patch level string. This
|
||
security patch level string indicates that all issues associated with 2016-10-01
|
||
and 2016-10-05 (and all previous security patch level strings) are addressed.</li>
|
||
</ul>
|
||
</li>
|
||
<li>Supported Nexus devices will receive a single OTA update with the October
|
||
05, 2016 security patch level.</li>
|
||
</ul>
|
||
|
||
<h2 id="mitigations">Android and Google service mitigations</h2>
|
||
<p>
|
||
This is a summary of the mitigations provided by the
|
||
<a href="/security/enhancements/index.html">Android
|
||
security platform</a> and service protections such as SafetyNet. These
|
||
capabilities reduce the likelihood that security vulnerabilities could be
|
||
successfully exploited on Android.
|
||
</p>
|
||
<ul>
|
||
<li>Exploitation for many issues on Android is made more difficult by
|
||
enhancements in newer versions of the Android platform. We encourage all users
|
||
to update to the latest version of Android where possible.</li>
|
||
<li>The Android Security team actively monitors for abuse with <a
|
||
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
|
||
Apps and SafetyNet</a>, which are designed to warn users about <a
|
||
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
|
||
Harmful Applications</a>. Verify Apps is enabled by default on devices with <a
|
||
href="http://www.android.com/gms">Google Mobile Services</a>, and is especially
|
||
important for users who install applications from outside of Google Play. Device
|
||
rooting tools are prohibited within Google Play, but Verify Apps warns users
|
||
when they attempt to install a detected rooting application—no matter where it
|
||
comes from. Additionally, Verify Apps attempts to identify and block
|
||
installation of known malicious applications that exploit a privilege escalation
|
||
vulnerability. If such an application has already been installed, Verify Apps
|
||
will notify the user and attempt to remove the detected application.</li>
|
||
<li>As appropriate, Google Hangouts and Messenger applications do not
|
||
automatically pass media to processes such as Mediaserver.</li>
|
||
</ul>
|
||
<h2 id="acknowledgements">Acknowledgements</h2>
|
||
<p>
|
||
We would like to thank these researchers for their contributions:
|
||
</p>
|
||
<ul>
|
||
<li>Andre Teixeira Rizzo: CVE-2016-3882</li>
|
||
<li>Andrea Biondo: CVE-2016-3921</li>
|
||
<li>Daniel Micay of Copperhead Security: CVE-2016-3922</li>
|
||
<li><a href="https://github.com/google/syzkaller">Dmitry Vyukov</a> of Google:
|
||
CVE-2016-7117</li>
|
||
<li>dosomder: CVE-2016-3931</li>
|
||
<li>Ecular Xu (徐健) of Trend Micro: CVE-2016-3920</li>
|
||
<li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>)
|
||
and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360
|
||
Technology Co. Ltd.: CVE-2016-6690, CVE-2016-3901, CVE-2016-6672, CVE-2016-3940,
|
||
CVE-2016-3935</li>
|
||
<li><a href="mailto:hzhan033@ucr.edu">Hang Zhang</a>,
|
||
<a href="mailto:dshe002@ucr.edu">Dongdong She</a>, and
|
||
<a href="mailto:zhiyunq@cs.ucr.edu">Zhiyun Qian</a> of UC Riverside: CVE-2015-8950</li>
|
||
<li>Hao Chen of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3860</li>
|
||
<li>Jann Horn of Google Project Zero: CVE-2016-3900, CVE-2016-3885</li>
|
||
<li><a href="http://keybase.io/jasonrogena">Jason Rogena</a>: CVE-2016-3917</li>
|
||
<li>Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and
|
||
<a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360: CVE-2016-6688,
|
||
CVE-2016-6677, CVE-2016-6673, CVE-2016-6687, CVE-2016-6686, CVE-2016-6681,
|
||
CVE-2016-6682, CVE-2016-3930</li>
|
||
<li>Joshua Drake (<a href="https://twitter.com/jduck">@jduck</a>):
|
||
CVE-2016-3920</li>
|
||
<li>Maciej Szawłowski of Google security team: CVE-2016-3905</li>
|
||
<li>Mark Brand of Google Project Zero: CVE-2016-6689</li>
|
||
<li><a href="https://github.com/michalbednarski">Michał Bednarski</a>:
|
||
CVE-2016-3914, CVE-2016-6674, CVE-2016-3911, CVE-2016-3912</li>
|
||
<li>Mingjian Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
|
||
Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian
|
||
Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3933, CVE-2016-3932</li>
|
||
<li>Nightwatch Cybersecurity Research
|
||
(<a href="https://twitter.com/nightwatchcyber">@nightwatchcyber</a>): CVE-2016-5348</li>
|
||
<li>Roee Hay, IBM Security X-Force Researcher: CVE-2016-6678</li>
|
||
<li>Samuel Tan of Google: CVE-2016-3925</li>
|
||
<li><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a>
|
||
(<a href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>):
|
||
CVE-2016-3936, CVE-2016-3928, CVE-2016-3902, CVE-2016-3937, CVE-2016-6696</li>
|
||
<li>Seven Shen (<a href="https://twitter.com/lingtongshen">@lingtongshen</a>) of
|
||
Trend Micro Mobile Threat Research Team: CVE-2016-6685, CVE-2016-6683,
|
||
CVE-2016-6680, CVE-2016-6679, CVE-2016-3903, CVE-2016-6693, CVE-2016-6694,
|
||
CVE-2016-6695</li>
|
||
<li><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a>, Mingjian Zhou
|
||
(<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu
|
||
(<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
|
||
<a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3909</li>
|
||
<li>Wenlin Yang and Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>)
|
||
of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3918</li>
|
||
<li>Wish Wu (<a href="http://weibo.com/wishlinux">吴潍浠</a>)
|
||
(<a href="https://twitter.com/wish_wu">@wish_wu)</a> of
|
||
<a href="http://blog.trendmicro.com/trendlabs-security-intelligence/author/wishwu/">Trend
|
||
Micro Inc.</a>: CVE-2016-3924, CVE-2016-3915, CVE-2016-3916, CVE-2016-3910</li>
|
||
<li>Yong Shi of Eagleye team, SCC, Huawei: CVE-2016-3938</li>
|
||
<li>Zhanpeng Zhao (行之) (<a href="https://twitter.com/0xr0ot">@0xr0ot</a>) of
|
||
Security Research Lab, <a href="http://www.cmcm.com">Cheetah Mobile</a>:
|
||
CVE-2016-3908</li>
|
||
</ul>
|
||
|
||
<h2 id="2016-10-01-details">2016-10-01
|
||
security patch level—Vulnerability details</h2>
|
||
<p>
|
||
In the sections below, we provide details for each of the security
|
||
vulnerabilities that apply to the 2016-10-01 patch level. There is a description of
|
||
the issue, a severity rationale, and a table with the CVE, associated
|
||
references, severity, updated Nexus devices, updated AOSP versions (where
|
||
applicable), and date reported. When available, we will link the public change
|
||
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
||
changes relate to a single bug, additional references are linked to numbers
|
||
following the bug ID.
|
||
</p>
|
||
<h3 id="eopv-in-servicemanager">Elevation of privilege vulnerability in ServiceManager</h3>
|
||
<p>
|
||
An elevation of privilege in ServiceManager could enable a local malicious
|
||
application to register arbitrary services that would normally be provided by a
|
||
privileged process, such as the system_server. This issue is rated as High
|
||
severity due to the possibility of service impersonation.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3900</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/d3c6ce463ac91ecbeb2128beb475d31d3ca6ef42">A-29431260</a>
|
||
[<a href="https://android.googlesource.com/platform/frameworks/native/+/047eec456943dc082e33220d28abb7df4e089f69">2</a>]
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jun 15, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-lock-settings-service">Elevation
|
||
of privilege vulnerability in Lock Settings Service</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Lock Settings Service could enable a
|
||
local malicious application to clear the device PIN or password. This issue is
|
||
rated as High because it is a local bypass of user interaction requirements for
|
||
any developer or security settings modifications.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3908</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/96daf7d4893f614714761af2d53dfb93214a32e4">A-30003944</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 6, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-mediaserver">Elevation of privilege vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Mediaserver could enable a local
|
||
malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3909</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/d4271b792bdad85a80e2b83ab34c4b30b74f53ec">A-30033990</a>
|
||
[<a href="https://android.googlesource.com/platform/frameworks/av/+/c48ef757cc50906e8726a3bebc3b60716292cdba">2</a>]
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 8, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3910</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/035cb12f392860113dce96116a5150e2fde6f0cc">A-30148546</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 13, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3913</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/0c3b93c8c2027e74af642967eee5c142c8fd185d">A-30204103</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 18, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-zygote-process">Elevation of privilege vulnerability in Zygote process</h3>
|
||
<p>
|
||
An elevation of privilege in the Zygote process could enable a local malicious
|
||
application to execute arbitrary code within the context of a privileged
|
||
process. This issue is rated as High because it could be used to gain local
|
||
access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3911</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/2c7008421cb67f5d89f16911bdbe36f6c35311ad">A-30143607</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-framework-apis">Elevation of privilege vulnerability in framework APIs</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the framework APIs could enable a
|
||
local malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3912</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/6c049120c2d749f0c0289d822ec7d0aa692f55c5">A-30202481</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-telephony">Elevation of privilege vulnerability in Telephony</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Telephony component could enable
|
||
a local malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3914</td>
|
||
<td><a href="https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3a3a5d145d380deef2d5b7c3150864cd04be397f">A-30481342</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 28, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-camera-service">Elevation of privilege vulnerability in Camera service</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Camera service could enable a
|
||
local malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3915</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/media/+/e9e44f797742f52996ebf307740dad58c28fd9b5">A-30591838</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Aug 1, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3916</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/media/+/8e7a2b4d13bff03973dbad2bfb88a04296140433">A-30741779</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Aug 2, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-fingerprint-login">Elevation of privilege vulnerability in fingerprint login</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability during fingerprint login could enable a
|
||
malicious device owner to login as a different user account on the device. This
|
||
issue is rated as High due to the possibility of a lockscreen bypass.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3917</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd">A-30744668</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0.1, 7.0</td>
|
||
<td>Aug 5, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="information-disclosure-vulnerability-in-aosp-mail">Information
|
||
disclosure vulnerability in AOSP Mail</h3>
|
||
<p>
|
||
An information disclosure vulnerability in AOSP Mail could enable a local
|
||
malicious application to bypass operating system protections that isolate
|
||
application data from other applications. This issue is rated as High because it
|
||
could be used to access data without permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3918</td>
|
||
<td><a href="https://android.googlesource.com/platform/packages/apps/Email/+/6b2b0bd7c771c698f11d7be89c2c57c8722c7454">A-30745403</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Aug 5, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="dosv-in-wi-fi">Denial of service
|
||
vulnerability in Wi-Fi</h3>
|
||
<p>
|
||
A denial of service vulnerability in Wi-Fi could enable a local proximate
|
||
attacker to create a hotspot and cause a device reboot. This issue is rated as
|
||
High due to the possibility of a temporary remote denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="19%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3882</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/35a86eef3c0eef760f7e61c52a343327ba601630">A-29464811</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1, 7.0</td>
|
||
<td>Jun 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="dosv-in-gps">Denial of service vulnerability in GPS</h3>
|
||
<p>
|
||
A denial of service vulnerability in the GPS component could enable a remote
|
||
attacker to cause a device hang or reboot. This issue is rated as High due to
|
||
the possibility of a temporary remote denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5348</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/218b813d5bc2d7d3952ea1861c38b4aa944ac59b">A-29555864</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jun 20, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="dosv-in-mediaserver">Denial of service vulnerability in Mediaserver</h3>
|
||
<p>
|
||
A denial of service vulnerability in Mediaserver could enable an attacker to use
|
||
a specially crafted file to cause a device hang or reboot. This issue is rated
|
||
as High due to the possibility of remote denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3920</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/6d0249be2275fd4086783f259f4e2c54722a7c55">A-30744884</a>
|
||
</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Aug 5, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-framework-listener">Elevation of privilege vulnerability in Framework Listener</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Framework Listener could enable a
|
||
local malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as Moderate because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="18%">
|
||
<col width="20%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3921</td>
|
||
<td><a href="https://android.googlesource.com/platform/system/core/+/771ab014c24a682b32990da08e87e2f0ab765bd2">A-29831647</a>
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jun 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-telephony-2">Elevation of privilege vulnerability in Telephony</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Telephony could enable a local
|
||
malicious application to execute arbitrary code in the context of a privileged
|
||
process. This issue is rated as Moderate because it first requires compromising
|
||
a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3922</td>
|
||
<td><a href="https://android.googlesource.com/platform/hardware/ril/+/95610818918f6f11fe7d23aca1380e6c0fac2af0">A-30202619</a>
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="eopv-in-accessibility-services">Elevation of privilege vulnerability in Accessibility services</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Accessibility services could
|
||
enable a local malicious application to generate unexpected touch events on the
|
||
device that could lead to applications accepting permission dialogs without the
|
||
user’s explicit consent. This issue is rated as Moderate because it is a local
|
||
bypass of user interaction requirements that would normally require either user
|
||
initiation or user permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="18%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3923</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/5f256310187b4ff2f13a7abb9afed9126facd7bc">A-30647115</a>
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>7.0</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="information-disclosure-vulnerability-in-mediaserver">Information
|
||
disclosure vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in Mediaserver could enable a local
|
||
malicious application to access data outside of its permission levels. This
|
||
issue is rated as Moderate because it could be used to access sensitive data
|
||
without permission.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="18%">
|
||
<col width="20%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3924</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/c894aa36be535886a8e5ff02cdbcd07dd24618f6">A-30204301</a>
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
|
||
<td>Jul 18, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="dosv-in-wi-fi-2">Denial of service vulnerability in Wi-Fi</h3>
|
||
<p>
|
||
A denial of service vulnerability in the Wi-Fi service could enable a local
|
||
malicious application to prevent Wi-Fi calling. This issue is rated as Moderate
|
||
due to the possibility of a denial of service to application functionality.
|
||
</p>
|
||
<table>
|
||
<col width="18%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="19%">
|
||
<col width="17%">
|
||
<col width="19%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Updated AOSP versions</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3925</td>
|
||
<td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/c2905409c20c8692d4396b8531b09e7ec81fa3fb">A-30230534</a>
|
||
</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>6.0, 6.0.1, 7.0</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<h2 id="2016-10-05-details">2016-10-05
|
||
security patch level—Vulnerability details</h2>
|
||
<p>
|
||
In the sections below, we provide details for each of the security
|
||
vulnerabilities that apply to the 2016-10-05 patch level. There is a description of
|
||
the issue, a severity rationale, and a table with the CVE, associated
|
||
references, severity, updated Nexus devices, updated AOSP versions (where
|
||
applicable), and date reported. When available, we will link the public change
|
||
that addressed the issue to the bug ID, like the AOSP change list. When multiple
|
||
changes relate to a single bug, additional references are linked to numbers
|
||
following the bug ID.
|
||
</p>
|
||
<h3 id="remote-code-execution-vulnerability-in-kernel-asn-1-decoder">Remote code
|
||
execution vulnerability in kernel ASN.1 decoder</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as Critical due to the possibility of a local
|
||
permanent device compromise, which may require reflashing the operating system
|
||
to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-0758</td>
|
||
<td>A-29814470<br>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa">
|
||
Upstream kernel</a></td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>May 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="remote-code-execution-vulnerability-in-kernel-networking-subsystem">Remote
|
||
code execution vulnerability in kernel networking subsystem</h3>
|
||
<p>
|
||
A remote code execution vulnerability in the kernel networking subsystem could
|
||
enable a remote attacker to execute arbitrary code within the context of the
|
||
kernel. This issue is rated as Critical due to the possibility of a local
|
||
permanent device compromise, which may require reflashing the operating system
|
||
to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-7117</td>
|
||
<td>A-30515201<br>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d">Upstream
|
||
kernel</a></td>
|
||
<td>Critical</td>
|
||
<td>All Nexus</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-mediatek-video-driver">Elevation
|
||
of privilege vulnerability in MediaTek video driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the MediaTek video driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Critical due to the possibility of
|
||
a local permanent device compromise, which may require reflashing the operating
|
||
system to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3928</td>
|
||
<td>A-30019362*<br>
|
||
M-ALPS02829384</td>
|
||
<td>Critical</td>
|
||
<td>None</td>
|
||
<td>Jul 6, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3
|
||
id="eopv-in-kernel-shared-memory-driver">Elevation
|
||
of privilege vulnerability in kernel shared memory driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel shared memory driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Critical due to the possibility of
|
||
a local permanent device compromise, which may require reflashing the operating
|
||
system to repair the device.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5340</td>
|
||
<td>A-30652312<br>
|
||
<a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6">QC-CR#1008948</a></td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jul 26, 2016</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h3 id="vulnerabilities-in-qc-components">
|
||
Vulnerabilities in Qualcomm components</h3>
|
||
<p>
|
||
The table below contains security vulnerabilities affecting Qualcomm components
|
||
and are described in further detail in the Qualcomm AMSS March 2016 and
|
||
Qualcomm AMSS April 2016 security bulletins.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="16%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="21%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3926</td>
|
||
<td>A-28823953*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P</td>
|
||
<td>Qualcomm internal</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3927</td>
|
||
<td>A-28823244*</td>
|
||
<td>Critical</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>Qualcomm internal</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3929</td>
|
||
<td>A-28823675*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>Qualcomm internal</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-qualcomm-networking-component">Elevation
|
||
of privilege vulnerability in Qualcomm networking component</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm networking component
|
||
could enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-2059</td>
|
||
<td>A-27045580<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=9e8bdd63f7011dff5523ea435433834b3702398d">QC-CR#974577</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Feb 4, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-nvidia-mmc-test-driver">Elevation of privilege vulnerability in
|
||
NVIDIA MMC test driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the NVIDIA MMC test driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3930</td>
|
||
<td>A-28760138*<br>
|
||
N-CVE-2016-3930</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>May 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3
|
||
id="eopv-in-qsee-communicator-driver">Elevation of privilege vulnerability in
|
||
Qualcomm QSEE Communicator driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm QSEE
|
||
Communicator driver could enable a local malicious application to
|
||
execute arbitrary code within the context of the kernel. This issue is rated as
|
||
High because it first requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3931</td>
|
||
<td>A-29157595<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e80b88323f9ff0bb0e545f209eec08ec56fca816">QC-CR#1036418</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jun 4, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-mediaserver-2">Elevation of privilege vulnerability in Mediaserver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in Mediaserver could enable a local
|
||
malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3932</td>
|
||
<td>A-29161895<br>
|
||
M-ALPS02770870</td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Jun 6, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3933</td>
|
||
<td>A-29421408*<br>
|
||
N-CVE-2016-3933</td>
|
||
<td>High</td>
|
||
<td>Nexus 9, Pixel C</td>
|
||
<td>Jun 14, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-qualcomm-camera-driver">Elevation of privilege vulnerability
|
||
in Qualcomm camera driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm camera driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3903</td>
|
||
<td>A-29513227<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=b8874573428e8ce024f57c6242d662fcca5e5d55">QC-CR#1040857</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jun 20, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3934</td>
|
||
<td>A-30102557<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=27fbeb6b025d5d46ccb0497cbed4c6e78ed1c5cc">QC-CR#789704</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jul 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-qualcomm-sound-driver">Elevation
|
||
of privilege vulnerability in Qualcomm sound driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm sound driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8951</td>
|
||
<td>A-30142668<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=APSS.FSM.3.0&id=ccff36b07bfc49efc77b9f1b55ed2bf0900b1d5b">QC-CR#948902</a><br>
|
||
QC-CR#948902</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6P, Android One</td>
|
||
<td>Jun 20, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-qualcomm-crypto-engine-driver">Elevation
|
||
of privilege vulnerability in Qualcomm crypto engine driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm cryptographic engine
|
||
driver could enable a local malicious application to execute arbitrary code
|
||
within the context of the kernel. This issue is rated as High because it first
|
||
requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3901</td>
|
||
<td>A-29999161<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5f69ccf3b011c1d14a1b1b00dbaacf74307c9132">QC-CR#1046434</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jul 6, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3935</td>
|
||
<td>A-29999665<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5f69ccf3b011c1d14a1b1b00dbaacf74307c9132">QC-CR#1046507</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jul 6, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="eopv-in-mediatek-video-driver-2">Elevation
|
||
of privilege vulnerability in MediaTek video driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the MediaTek video driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3936</td>
|
||
<td>A-30019037*<br>
|
||
M-ALPS02829568</td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Jul 6, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3937</td>
|
||
<td>A-30030994*<br>
|
||
M-ALPS02834874</td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Jul 7, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-qualcomm-video-driver">Elevation
|
||
of privilege vulnerability in Qualcomm video driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm video driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3938</td>
|
||
<td>A-30019716<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=467c81f9736b1ebc8d4ba70f9221bba02425ca10">QC-CR#1049232</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Jul 7, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3939</td>
|
||
<td>A-30874196<br>
|
||
<a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=e0bb18771d6ca71db2c2a61226827059be3fa424">QC-CR#1001224</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
|
||
<td>Aug 15, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="eopv-in-synaptics-touchscreen-driver">Elevation
|
||
of privilege vulnerability in Synaptics touchscreen driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Synaptics touchscreen driver
|
||
could enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3940</td>
|
||
<td>A-30141991*</td>
|
||
<td>High</td>
|
||
<td>Nexus 6P, Android One</td>
|
||
<td>Jul 12, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6672</td>
|
||
<td>A-30537088*</td>
|
||
<td>High</td>
|
||
<td>Nexus 5X</td>
|
||
<td>Jul 31, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-nvidia-camera-driver">Elevation
|
||
of privilege vulnerability in NVIDIA camera driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the NVIDIA camera driver could enable
|
||
a local malicious application to execute arbitrary code within the context of
|
||
the kernel. This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6673</td>
|
||
<td>A-30204201*<br>
|
||
N-CVE-2016-6673</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>Jul 17, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-system_server">Elevation of privilege vulnerability in system_server</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in system_server could enable a local
|
||
malicious application to execute arbitrary code within the context of a
|
||
privileged process. This issue is rated as High because it could be used to gain
|
||
local access to elevated capabilities, which are not normally accessible to a
|
||
third-party application.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6674</td>
|
||
<td>A-30445380*</td>
|
||
<td>High</td>
|
||
<td>All Nexus</td>
|
||
<td>Jul 26, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="eopv-in-qualcomm-wi-fi-driver">Elevation
|
||
of privilege vulnerability in Qualcomm Wi-Fi driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3905</td>
|
||
<td>A-28061823<br>
|
||
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b5112838eb91b71eded4b5ee37338535784e0aef">QC-CR#1001449</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6675</td>
|
||
<td>A-30873776<br>
|
||
<a href="https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=1353fa0bd0c78427f3ae7d9bde7daeb75bd01d09">QC-CR#1000861</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Android One</td>
|
||
<td>Aug 15, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6676</td>
|
||
<td>A-30874066<br>
|
||
<a href="https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6ba9136879232442a182996427e5c88e5a7512a8">QC-CR#1000853</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Android One</td>
|
||
<td>Aug 15, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5342</td>
|
||
<td>A-30878283<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=579e796cb089324c55e0e689a180575ba81b23d9">QC-CR#1032174</a></td>
|
||
<td>High</td>
|
||
<td>Android One</td>
|
||
<td>Aug 15, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="eopv-in-kernel-performance-subsystem">Elevation
|
||
of privilege vulnerability in kernel performance subsystem</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the kernel performance subsystem
|
||
could enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as High because it first requires
|
||
compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8955</td>
|
||
<td>A-29508816<br>
|
||
<a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8fff105e13041e49b82f92eef034f363a6b1c071">Upstream kernel</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5X, Nexus 6P, Pixel C, Android One</td>
|
||
<td>Google internal</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="information-disclosure-vulnerability-in-kernel-ion-subsystem">Information
|
||
disclosure vulnerability in kernel ION subsystem</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the kernel ION subsystem could enable
|
||
a local malicious application to access data outside of its permission levels.
|
||
This issue is rated as High because it could be used to access sensitive data
|
||
without explicit user permission.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8950</td>
|
||
<td>A-29795245<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8">QC-CR#1041735</a></td>
|
||
<td>High</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P</td>
|
||
<td>May 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="information-disclosure-vulnerability-in-nvidia-gpu-driver">Information
|
||
disclosure vulnerability in NVIDIA GPU driver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the NVIDIA GPU driver could enable a
|
||
local malicious application to access data outside of its permission levels.
|
||
This issue is rated as High because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6677</td>
|
||
<td>A-30259955*<br>
|
||
N-CVE-2016-6677</td>
|
||
<td>High</td>
|
||
<td>Nexus 9</td>
|
||
<td>Jul 19, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3
|
||
id="eopv-in-qualcomm-character-driver">Elevation
|
||
of privilege vulnerability in Qualcomm character driver</h3>
|
||
<p>
|
||
An elevation of privilege vulnerability in the Qualcomm character driver could
|
||
enable a local malicious application to execute arbitrary code within the
|
||
context of the kernel. This issue is rated as Moderate because it first requires
|
||
compromising a privileged process, and the vulnerable code is currently not
|
||
accessible.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-0572</td>
|
||
<td>A-29156684<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61">QC-CR#848489</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6P</td>
|
||
<td>May 28, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="information-disclosure-vulnerability-in-qualcomm-sound-driver">Information
|
||
disclosure vulnerability in Qualcomm sound driver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the Qualcomm sound driver could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as Moderate because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3860</td>
|
||
<td>A-29323142<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/diff/sound/soc/msm/qdsp6v2/audio_calibration.c?id=528976f54be246ec93a71ac53aa4faf3e3791c48">QC-CR#1038127</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6P, Android One</td>
|
||
<td>Jun 13, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3
|
||
id="information-disclosure-vulnerability-in-motorola-usbnet-driver">Information
|
||
disclosure vulnerability in Motorola USBNet driver</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the Motorola USBNet driver could
|
||
enable a local malicious application to access data outside of its permission
|
||
levels. This issue is rated as Moderate because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6678</td>
|
||
<td>A-29914434*</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 6</td>
|
||
<td>Jun 30, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="information-disclosure-vulnerability-in-qualcomm-components">Information
|
||
disclosure vulnerability in Qualcomm components</h3>
|
||
<p>
|
||
An information disclosure vulnerability in Qualcomm components, including the
|
||
sound driver, IPA driver and Wi-Fi driver could enable a local malicious
|
||
application to access data outside of its permission levels. This issue is rated
|
||
as Moderate because it first requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6679</td>
|
||
<td>A-29915601<br>
|
||
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=d39345f0abc309959d831d09fcbf1619cc0ae0f5">QC-CR#1000913</a>
|
||
[<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f081695446679aa44baa0d00940ea18455eeb4c5">2</a>]</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Android One</td>
|
||
<td>Jun 30, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-3902</td>
|
||
<td>A-29953313*<br>
|
||
<a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=2fca425d781572393fbe51abe2e27a932d24a768">QC-CR#1044072</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6P,</td>
|
||
<td>Jul 2, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6680</td>
|
||
<td>A-29982678*<br>
|
||
<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2f2fa073b95d4700de88c0f7558b4a18c13ac552">QC-CR#1048052</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Android One</td>
|
||
<td>Jul 3, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6681</td>
|
||
<td>A-30152182<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395">QC-CR#1049521</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6P, Android One</td>
|
||
<td>Jul 14, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6682</td>
|
||
<td>A-30152501<br>
|
||
<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395">QC-CR#1049615</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6P, Android One</td>
|
||
<td>Jul 14, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="information-disclosure-vulnerability-in-kernel-components">Information
|
||
disclosure vulnerability in kernel components</h3>
|
||
<p>
|
||
An information disclosure vulnerability in kernel components, including
|
||
Binder, Sync, Bluetooth, and Sound driver, could enable a local malicious
|
||
application to access data outside of its permission levels. This issue is
|
||
rated as Moderate because it first requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="25%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6683</td>
|
||
<td>A-30143283*</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>Jul 13, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6684</td>
|
||
<td>A-30148243*</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Android One</td>
|
||
<td>Jul 13, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2015-8956</td>
|
||
<td>A-30149612*</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5, Nexus 6P, Android One</td>
|
||
<td>Jul 14, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6685</td>
|
||
<td>A-30402628*</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 6P</td>
|
||
<td>Jul 25, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="information-disclosure-vulnerability-in-nvidia-profiler">Information
|
||
disclosure vulnerability in NVIDIA profiler</h3>
|
||
<p>
|
||
An information disclosure vulnerability in the NVIDIA profiler could enable a
|
||
local malicious application to access data outside of its permission levels.
|
||
This issue is rated as Moderate because it first requires compromising a
|
||
privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6686</td>
|
||
<td>A-30163101*<br>
|
||
N-CVE-2016-6686</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 9</td>
|
||
<td>Jul 15, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6687</td>
|
||
<td>A-30162222*<br>
|
||
N-CVE-2016-6687</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 9</td>
|
||
<td>Jul 15, 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6688</td>
|
||
<td>A-30593080*<br>
|
||
N-CVE-2016-6688</td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 9</td>
|
||
<td>Aug 2, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="information-disclosure-vulnerability-in-kernel">Information disclosure
|
||
vulnerability in kernel</h3>
|
||
<p>
|
||
An information disclosure vulnerability in Binder could enable a local malicious
|
||
application to access data outside of its permission levels. This issue is rated
|
||
as Moderate because it first requires compromising a privileged process.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6689</td>
|
||
<td>A-30768347*</td>
|
||
<td>Moderate</td>
|
||
<td>All Nexus</td>
|
||
<td>Aug 9, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="dosv-in-kernel-networking-subsystem">Denial of service vulnerability
|
||
in kernel networking subsystem</h3>
|
||
<p>
|
||
A denial of service vulnerability in the kernel networking subsystem could
|
||
enable an attacker to block access to TCP connections and cause a temporary
|
||
remote denial of service. This issue is rated as Moderate because cellular
|
||
services are still available and the device is still usable.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="25%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5696</td>
|
||
<td>A-30809774<br>
|
||
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758">Upstream
|
||
kernel</a></td>
|
||
<td>Moderate</td>
|
||
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One</td>
|
||
<td>Jul 12, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h3 id="dosv-in-kernel-sound-driver">Denial of service vulnerability in kernel
|
||
sound driver</h3>
|
||
<p>
|
||
A denial of service vulnerability in the kernel could allow a local malicious
|
||
application to cause a device reboot. This issue is rated as Low because it is a
|
||
temporary denial of service.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="18%">
|
||
<col width="10%">
|
||
<col width="25%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6690</td>
|
||
<td>A-28838221*</td>
|
||
<td>Low</td>
|
||
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus Player</td>
|
||
<td>May 18, 2016</td>
|
||
</tr>
|
||
</table>
|
||
<p>
|
||
* The patch for this issue is not publicly available. The update is contained in
|
||
the latest binary drivers for Nexus devices available from the
|
||
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
|
||
site</a>.
|
||
</p>
|
||
<h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm
|
||
components</h3>
|
||
<p>
|
||
The table below contains a list of security vulnerabilities that affect Qualcomm
|
||
components.
|
||
</p>
|
||
<table>
|
||
<col width="19%">
|
||
<col width="20%">
|
||
<col width="10%">
|
||
<col width="23%">
|
||
<col width="17%">
|
||
<tr>
|
||
<th>CVE</th>
|
||
<th>References</th>
|
||
<th>Severity</th>
|
||
<th>Updated Nexus devices</th>
|
||
<th>Date reported</th>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6691</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la//platform/frameworks/opt/net/wifi/commit/?id=343f123c396b2a97fc7cce396cd5d99365cb9131">QC-CR#978452</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Jul 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6692</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=0f0e7047d39f9fb3a1a7f389918ff79cdb4a50b3">QC-CR#1004933</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6693</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=ac328eb631fa74a63d5d2583e6bfeeb5a7a2df65">QC-CR#1027585</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6694</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=961e38553aae8ba9b1af77c7a49acfbb7b0b6f62">QC-CR#1033525</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6695</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=c319c2b0926d1ea5edb4d0778d88bd3ce37c4b95">QC-CR#1033540</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-6696</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=c3c9341bfdf93606983f893a086cb33a487306e5">QC-CR#1041130</a></td>
|
||
<td>High</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5344</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=64e15c36d6c1c57dc2d95a3f163bc830a469fc20">QC-CR#993650</a></td>
|
||
<td>Moderate</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
<tr>
|
||
<td>CVE-2016-5343</td>
|
||
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08">QC-CR#1010081</a></td>
|
||
<td>Moderate</td>
|
||
<td>None</td>
|
||
<td>Aug 2016</td>
|
||
</tr>
|
||
</table>
|
||
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
|
||
<p>
|
||
This section answers common questions that may occur after reading this
|
||
bulletin.
|
||
</p>
|
||
<p>
|
||
<strong>1. How do I determine if my device is updated to address these issues?
|
||
</strong>
|
||
</p>
|
||
<p>
|
||
Security Patch Levels of 2016-10-01 or later address all issues associated with
|
||
the 2016-10-01 security patch string level. Security Patch Levels of 2016-10-05
|
||
or later address all issues associated with the 2016-10-05 security patch string
|
||
level. Refer to the <a href="https://support.google.com/nexus/answer/4457705">help center</a> for
|
||
instructions on how to check the security patch level. Device manufacturers that
|
||
include these updates should set the patch string level to:
|
||
[ro.build.version.security_patch]:[2016-10-01] or
|
||
[ro.build.version.security_patch]:[2016-10-05].
|
||
</p>
|
||
<p>
|
||
<strong>2. Why does this bulletin have two security patch level
|
||
strings?</strong>
|
||
</p>
|
||
<p>
|
||
This bulletin has two security patch level strings so that Android partners have
|
||
the flexibility to fix a subset of vulnerabilities that are similar across all
|
||
Android devices more quickly. Android partners are encouraged to fix all issues
|
||
in this bulletin and use the latest security patch level string.
|
||
</p>
|
||
<p>
|
||
Devices that use the security patch level of October 5, 2016 or newer must
|
||
include all applicable patches in this (and previous) security bulletins.
|
||
</p>
|
||
<p>
|
||
Devices that use the October 1, 2016 security patch level must include all
|
||
issues associated with that security patch level, as well as fixes for all
|
||
issues reported in previous security bulletins.
|
||
</p>
|
||
<p>
|
||
<strong>3. How do I determine which Nexus devices are affected by each
|
||
issue?</strong>
|
||
</p>
|
||
<p>
|
||
In the <a href="#2016-10-01-details">2016-10-01</a> and
|
||
<a href="#2016-10-05-details">2016-10-05</a>
|
||
security vulnerability details sections, each table has an <em>Updated Nexus
|
||
devices</em> column that covers the range of affected Nexus devices updated for
|
||
each issue. This column has a few options:
|
||
</p>
|
||
<ul>
|
||
<li><strong>All Nexus devices</strong>: If an issue affects all Nexus devices,
|
||
the table will have “All Nexus” in the <em>Updated Nexus devices</em> column.
|
||
“All Nexus” encapsulates the following <a
|
||
href="https://support.google.com/nexus/answer/4457705#nexus_devices">supported
|
||
devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9,
|
||
Android One, Nexus Player and Pixel C.</li>
|
||
<li><strong>Some Nexus devices</strong>: If an issue doesn’t affect all Nexus
|
||
devices, the affected Nexus devices are listed in the <em>Updated Nexus
|
||
devices</em> column.</li>
|
||
<li><strong>No Nexus devices</strong>: If no Nexus devices running Android 7.0
|
||
are affected by the issue, the table will have “None” in the <em>Updated Nexus
|
||
devices</em> column.</li>
|
||
</ul>
|
||
<p>
|
||
<strong>4. What do the entries in the references column map to?</strong>
|
||
</p>
|
||
<p>
|
||
Entries under the <em>References</em> column of the vulnerability details table
|
||
may contain a prefix identifying the organization to which the reference value
|
||
belongs. These prefixes map as follows:
|
||
</p>
|
||
<table>
|
||
<tr>
|
||
<th>Prefix</th>
|
||
<th>Reference</th>
|
||
</tr>
|
||
<tr>
|
||
<td>A-</td>
|
||
<td>Android bug ID</td>
|
||
</tr>
|
||
<tr>
|
||
<td>QC-</td>
|
||
<td>Qualcomm reference number</td>
|
||
</tr>
|
||
<tr>
|
||
<td>M-</td>
|
||
<td>MediaTek reference number</td>
|
||
</tr>
|
||
<tr>
|
||
<td>N-</td>
|
||
<td>NVIDIA reference number</td>
|
||
</tr>
|
||
<tr>
|
||
<td>B-</td>
|
||
<td>Broadcom reference number</td>
|
||
</tr>
|
||
</table>
|
||
|
||
<h2 id="revisions">Revisions</h2>
|
||
<ul>
|
||
<li>October 03, 2016: Bulletin published.</li>
|
||
<li>October 04, 2016: Bulletin revised to include AOSP links and update
|
||
attributions for CVE-2016-3920, CVE-2016-6693, CVE-2016-6694,
|
||
CVE-2016-6695, and CVE-2016-6696.</li>
|
||
</ul>
|
||
|
||
</body>
|
||
</html>
|