Published July 06, 2016 | Updated April 1, 2019
The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Alongside the bulletin, we have released a security update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware images have also been released to the Google Developer site. Security patch levels of July 05, 2016 or later address all applicable issues in this bulletin. Refer to the documentation to learn how to check the security patch level.
Partners were notified about the issues described in the bulletin on June 06, 2016 or earlier. Where applicable, source code patches for these issues have been released to the Android Open Source Project (AOSP) repository. This bulletin also includes links to patches outside of AOSP.
The most severe of these issues is a Critical security vulnerability that could enable remote code execution on an affected device through multiple methods such as email, web browsing, and MMS when processing media files. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are disabled for development purposes or if successfully bypassed.
We have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the Android and Google service mitigations section for details on the Android security platform protections and service protections such as SafetyNet, which improve the security of the Android platform.
We encourage all customers to accept these updates to their devices.
Announcements
- This bulletin defines two security patch level strings to provide Android
partners with the flexibility to move more quickly to fix a subset of
vulnerabilities that are similar across all Android devices. See
Common questions and answers
for additional information:
- 2016-07-01: Partial security patch level string. This security patch level string indicates that all issues associated with 2016-07-01 are addressed.
- 2016-07-05: Complete security patch level string. This security patch level string indicates that all issues associated with 2016-07-01 and 2016-07-05 are addressed.
- Supported Nexus devices will be receiving a single OTA update with the July 05, 2016 security patch level.
Android and Google service mitigations
This is a summary of the mitigations provided by the Android security platform and service protections such as SafetyNet. These capabilities reduce the likelihood that security vulnerabilities could be successfully exploited on Android.
- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.
- The Android Security team actively monitors for abuse with Verify Apps and SafetyNet, which are designed to warn users about Potentially Harmful Applications. Verify Apps is enabled by default on devices with Google Mobile Services, and is especially important for users who install applications from outside of Google Play. Device rooting tools are prohibited within Google Play, but Verify Apps warns users when they attempt to install a detected rooting application—no matter where it comes from. Additionally, Verify Apps attempts to identify and block installation of known malicious applications that exploit a privilege escalation vulnerability. If such an application has already been installed, Verify Apps will notify the user and attempt to remove the detected application.
- As appropriate, Google Hangouts and Messenger applications do not automatically pass media to processes such as Mediaserver.
Acknowledgements
We would like to thank these researchers for their contributions:
- Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security Team: CVE-2016-3756, CVE-2016-3741, CVE-2016-3743, CVE-2016-3742
- Adam Donenfeld et al. of Check Point Software Technologies Ltd.: CVE-2016-2503
- Adam Powell of Google: CVE-2016-3752
- Alex Chapman and Paul Stone of Context Information Security: CVE-2016-3763
- Andy Tyler (@ticarpi) of e2e-assure: CVE-2016-2457
- Ben Hawkes of Google Project Zero: CVE-2016-3775
- Chiachih Wu (@chiachih_wu), Yuan-Tsung Lo (computernik@gmail.com), and Xuxian Jiang of C0RE Team: CVE-2016-3770, CVE-2016-3771, CVE-2016-3772, CVE-2016-3773, CVE-2016-3774
- Christopher Tate of Google: CVE-2016-3759
- Di Shen (@returnsme) of KeenLab (@keen_lab), Tencent: CVE-2016-3762
- Gengjia Chen (@chengjia4574), pjf (weibo.com/jfpan) of IceSword Lab, Qihoo 360 Technology Co. Ltd.: CVE-2016-3806, CVE-2016-3816, CVE-2016-3805, CVE-2016-3804, CVE-2016-3767, CVE-2016-3810, CVE-2016-3795, CVE-2016-3796
- Greg Kaiser of Google Android Team: CVE-2016-3758
- Guang Gong (龚广) (@oldfresher) of Mobile Safe Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3764
- Hao Chen and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3792, CVE-2016-3768
- Hao Qin of Security Research Lab, Cheetah Mobile: CVE-2016-3754, CVE-2016-3766
- Jianqiang Zhao (@jianqiangzhao) and pjf (weibo.com/jfpan) of IceSword Lab, Qihoo 360 Technology Co. Ltd: CVE-2016-3814, CVE-2016-3802, CVE-2016-3769, CVE-2016-3807, CVE-2016-3808
- Marco Nelissen of Google: CVE-2016-3818
- Mark Brand of Google Project Zero: CVE-2016-3757
- Michał Bednarski: CVE-2016-3750
- Mingjian Zhou (@Mingjian_Zhou), Chiachih Wu (@chiachih_wu), and Xuxian Jiang of C0RE Team: CVE-2016-3747, CVE-2016-3746, CVE-2016-3765
- Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang Ssong of Alibaba Mobile Security Group: CVE-2016-3800, CVE-2016-3799, CVE-2016-3801, CVE-2016-3812, CVE-2016-3798
- Peter Pi (@heisecode) of Trend Micro: CVE-2016-3793
- Ricky Wai of Google: CVE-2016-3749
- Roeland Krak: CVE-2016-3753
- Scott Bauer (@ScottyBauer1): CVE-2016-3797, CVE-2016-3813, CVE-2016-3815, CVE-2016-2501, CVE-2016-2502
- Vasily Vasilev: CVE-2016-2507
- Weichao Sun (@sunblate) of Alibaba Inc.: CVE-2016-2508, CVE-2016-3755
- Wen Niu (@NWMonster) of KeenLab (@keen_lab), Tencent: CVE-2016-3809
- Xiling Gong of Tencent Security Platform Department: CVE-2016-3745
- Yacong Gu of TCA Lab, Institute of Software, Chinese Academy of Sciences: CVE-2016-3761
- Yongke Wang (@Rudykewang) of Xuanwu LAB, Tencent: CVE-2016-2505
- Yongke Wang (@Rudykewang) and Wei Wei (@Danny__Wei) of Xuanwu LAB, Tencent: CVE-2016-2506
- Yulong Zhang and Tao (Lenx) Wei of Baidu X-Lab: CVE-2016-3744
2016-07-01 security patch level—Security vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-07-01 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Remote code execution vulnerability in Mediaserver
A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. The Mediaserver process has access to audio and video streams, as well as access to privileges that third-party apps could not normally access.
The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-2506 | A-28175045 | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 11, 2016 |
| CVE-2016-2505 | A-28333006 | Critical | All Nexus | 6.0, 6.0.1 | Apr 21, 2016 |
| CVE-2016-2507 | A-28532266 | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | May 2, 2016 |
| CVE-2016-2508 | A-28799341 [2] | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | May 16, 2016 |
| CVE-2016-3741 | A-28165661 [2] | Critical | All Nexus | 6.0, 6.0.1 | Google internal |
| CVE-2016-3742 | A-28165659 | Critical | All Nexus | 6.0, 6.0.1 | Google internal |
| CVE-2016-3743 | A-27907656 | Critical | All Nexus | 6.0, 6.0.1 | Google internal |
Remote code execution vulnerability in OpenSSL & BoringSSL
A remote code execution vulnerability in OpenSSL and BoringSSL could enable an attacker using a specially crafted file to cause memory corruption during file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of an affected process.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-2108 | A-28175332 | Critical | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | May 3, 2016 |
Remote code execution vulnerability in Bluetooth
A remote code execution vulnerability in Bluetooth could allow a proximal attacker to execute arbitrary code during the pairing process. This issue is rated as High due to the possibility of remote code execution during the initialization of a Bluetooth device.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3744 | A-27930580 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Mar 30, 2016 |
Elevation of privilege vulnerability in libpng
An elevation of privilege vulnerability in libpng could enable a local malicious application to execute arbitrary code within the context of an elevated system application. This issue is rated as High because it could be used to gain local access to elevated capabilities, such as Signature or SignatureOrSystem permissions privileges, which are not accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3751 | A-23265085 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Dec 3, 2015 |
Elevation of privilege vulnerability in Mediaserver
An elevation of privilege vulnerability in Mediaserver could enable a local malicious application to execute arbitrary code within the context of an elevated system application. This issue is rated as High because it could be used to gain local access to elevated capabilities, such as Signature or SignatureOrSystem permissions privileges, which are not accessible to a third-party application.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3745 | A-28173666 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 10, 2016 |
| CVE-2016-3746 | A-27890802 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Mar 27, 2016 |
| CVE-2016-3747 | A-27903498 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Mar 28, 2016 |
Elevation of privilege vulnerability in sockets
An elevation of privilege vulnerability in sockets could enable a local malicious application to access system calls outside of its permissions level. This issue is rated as High because it could permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3748 | A-28171804 | High | All Nexus | 6.0, 6.0.1 | Apr 13, 2016 |
Elevation of privilege vulnerability in LockSettingsService
An elevation of privilege vulnerability in the LockSettingsService could enable a malicious application to reset the screen lock password without authorization from the user. This issue is rated as High because it is a local bypass of user interaction requirements for any developer or security settings modifications.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3749 | A-28163930 | High | All Nexus | 6.0, 6.0.1 | Google internal |
Elevation of privilege vulnerability in Framework APIs
An elevation of privilege vulnerability in the Parcels Framework APIs could enable a local malicious application to bypass operating system protections that isolate application data from other applications. This issue is rated as High because it could be used to gain access to data that the application does not have access to.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3750 | A-28395952 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Dec 16, 2015 |
Elevation of privilege vulnerability in ChooserTarget service
An elevation of privilege vulnerability in the ChooserTarget service could enable a local malicious application to execute code in the context of another application. This issue is rated High because it could be used to access Activities belonging to another application without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3752 | A-28384423 | High | All Nexus | 6.0, 6.0.1 | Google internal |
Information disclosure vulnerability in Mediaserver
An information disclosure vulnerability in Mediaserver could enable a remote attacker to access protected data normally only accessible to locally installed apps that request permission. This issue is rated as High because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3753 | A-27210135 | High | None* | 4.4.4 | Feb 15, 2016 |
* Supported Nexus devices that have installed all available updates are not affected by this vulnerability.
Information disclosure vulnerability in OpenSSL
An information disclosure vulnerability in OpenSSL could enable a remote attacker to access protected data normally only accessible to locally installed apps that request permission. This issue is rated as High because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-2107 | A-28550804 | High | None* | 4.4.4, 5.0.2, 5.1.1 | April 13, 2016 |
* Supported Nexus devices that have installed all available updates are not affected by this vulnerability.
Denial of service vulnerability in Mediaserver
A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of a temporary remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3754 | A-28615448 [2] | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | May 5, 2016 |
| CVE-2016-3755 | A-28470138 | High | All Nexus | 6.0, 6.0.1 | Apr 29, 2016 |
| CVE-2016-3756 | A-28556125 | High | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Google internal |
Denial of service vulnerability in libc
A denial of service vulnerability in libc could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3818 | A-28740702 [2] | High | None* | 4.4.4 | Google internal |
* Supported Nexus devices that have installed all available updates are not affected by this vulnerability.
Elevation of privilege vulnerability in lsof
An elevation of privilege vulnerability in lsof could enable a local malicious application to execute arbitrary code that could lead to a permanent device compromise. This issue is rated as Moderate because it requires uncommon manual steps.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3757 | A-28175237 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 11, 2016 |
Elevation of privilege vulnerability in DexClassLoader
An elevation of privilege vulnerability in the DexClassLoader could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it requires uncommon manual steps.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3758 | A-27840771 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Google internal |
Elevation of privilege vulnerability in Framework APIs
An elevation of privilege vulnerability in the Framework APIs could enable a local malicious application to request backup permissions and intercept all backup data. This issue is rated as Moderate because it requires specific permissions to bypass operating system protections that isolate application data from other applications.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3759 | A-28406080 | Moderate | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1 | Google internal |
Elevation of privilege vulnerability in Bluetooth
An elevation of privilege vulnerability in the Bluetooth component could enable a local attacker to add an authenticated Bluetooth device that persists for the primary user. This issue is rated as Moderate because it could be used to gain elevated capabilities without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3760 | A-27410683 [2] [3] | Moderate | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1 | Feb 29, 2016 |
Elevation of privilege vulnerability in NFC
An elevation of privilege vulnerability in NFC could enable a local malicious background application to access information from a foreground application. This issue is rated as Moderate because it could be used to gain elevated capabilities without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3761 | A-28300969 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 20, 2016 |
Elevation of privilege vulnerability in sockets
An elevation of privilege vulnerability in sockets could enable a local malicious application to gain access to certain uncommon socket types possibly leading to arbitrary code execution within the context of the kernel. This issue is rated as Moderate because it could permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3762 | A-28612709 | Moderate | All Nexus | 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 21, 2016 |
Information disclosure vulnerability in Proxy Auto-Config
An information disclosure vulnerability in the Proxy Auto-Config component could allow an application to access sensitive information. This issue is rated Moderate because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3763 | A-27593919 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Mar 10, 2016 |
Information disclosure vulnerability in Mediaserver
An information disclosure vulnerability in Mediaserver could allow a local malicious application to access sensitive information. This issue is rated as Moderate because it could be used to access data without permission.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3764 | A-28377502 | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 25, 2016 |
| CVE-2016-3765 | A-28168413 | Moderate | All Nexus | 6.0, 6.0.1 | Apr 8, 2016 |
Denial of service vulnerability in Mediaserver
A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as Moderate due to the possibility of remote denial of service.
| CVE | References | Severity | Updated Nexus devices | Updated AOSP versions | Date reported |
|---|---|---|---|---|---|
| CVE-2016-3766 | A-28471206 [2] | Moderate | All Nexus | 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 | Apr 29, 2016 |
2016-07-05 security patch level—Vulnerability details
In the sections below, we provide details for each of the security vulnerabilities that apply to the 2016-07-05 patch level. There is a description of the issue, a severity rationale, and a table with the CVE, associated references, severity, updated Nexus devices, updated AOSP versions (where applicable), and date reported. When available, we will link the public change that addressed the issue to the bug ID, like the AOSP change list. When multiple changes relate to a single bug, additional references are linked to numbers following the bug ID.
Elevation of privilege vulnerability in Qualcomm GPU driver
An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2503 | A-28084795* QC-CR1006067 | Critical | Nexus 5X, Nexus 6P | Apr 5, 2016 |
| CVE-2016-2067 | A-28305757 QC-CR988993 | Critical | Nexus 5X, Nexus 6, Nexus 6P | Apr 20, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek Wi-Fi driver
An elevation of privilege vulnerability in the MediaTek Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3767 | A-28169363*
M-ALPS02689526 |
Critical | Android One | Apr 6, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm performance component
An elevation of privilege vulnerability in the Qualcomm performance component could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical severity due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3768 | A-28172137* QC-CR1010644 | Critical | Nexus 5, Nexus 6, Nexus 5X, Nexus 6P, Nexus 7 (2013) | Apr 9, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in NVIDIA video driver
An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3769 | A-28376656* N-CVE20163769 |
Critical | Nexus 9 | Apr 18, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek drivers (Device specific)
An elevation of privilege vulnerability in multiple MediaTek drivers could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3770 | A-28346752* M-ALPS02703102 |
Critical | Android One | Apr 22, 2016 |
| CVE-2016-3771 | A-29007611* M-ALPS02703102 |
Critical | Android One | Apr 22, 2016 |
| CVE-2016-3772 | A-29008188* M-ALPS02703102 |
Critical | Android One | Apr 22, 2016 |
| CVE-2016-3773 | A-29008363* M-ALPS02703102 |
Critical | Android One | Apr 22, 2016 |
| CVE-2016-3774 | A-29008609* M-ALPS02703102 |
Critical | Android One | Apr 22, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in kernel file system
An elevation of privilege vulnerability in the kernel file system could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3775 | A-28588279* | Critical | Nexus 5X, Nexus 6, Nexus 6P and Nexus Player, Pixel C | May 4, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in USB driver
An elevation of privilege vulnerability in the USB driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical severity due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2015-8816 | A-28712303* | Critical | Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, Pixel C | May 4, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm components
The table below contains security vulnerabilities affecting Qualcomm components including the bootloader, camera driver, character driver, networking, sound driver and video driver.
The most severe of these issues is rated as Critical due to possibility of arbitrary code execution leading to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device.
| CVE | References | Severity* | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2014-9795 | A-28820720 QC-CR681957 [2] |
Critical | Nexus 5 | Aug 8, 2014 |
| CVE-2014-9794 | A-28821172 QC-CR646385 |
Critical | Nexus 7 (2013) | Aug 8, 2014 |
| CVE-2015-8892 | A-28822807 QC-CR902998 |
Critical | Nexus 5X, Nexus 6P | Dec 30, 2015 |
| CVE-2014-9781 | A-28410333 QC-CR556471 |
High | Nexus 7 (2013) | Feb 6, 2014 |
| CVE-2014-9786 | A-28557260 QC-CR545979 |
High | Nexus 5, Nexus 7 (2013) | Mar 13, 2014 |
| CVE-2014-9788 | A-28573112 QC-CR548872 |
High | Nexus 5 | Mar 13, 2014 |
| CVE-2014-9779 | A-28598347 QC-CR548679 |
High | Nexus 5 | Mar 13, 2014 |
| CVE-2014-9780 | A-28602014 QC-CR542222 |
High | Nexus 5, Nexus 5X, Nexus 6P | Mar 13, 2014 |
| CVE-2014-9789 | A-28749392 QC-CR556425 |
High | Nexus 5 | Mar 13, 2014 |
| CVE-2014-9793 | A-28821253 QC-CR580567 |
High | Nexus 7 (2013) | Mar 13, 2014 |
| CVE-2014-9782 | A-28431531 QC-CR511349 |
High | Nexus 5, Nexus 7 (2013) | Mar 31, 2014 |
| CVE-2014-9783 | A-28441831 QC-CR511382 [2] |
High | Nexus 7 (2013) | Mar 31, 2014 |
| CVE-2014-9785 | A-28469042 QC-CR545747 |
High | Nexus 7 (2013) | Mar 31, 2014 |
| CVE-2014-9787 | A-28571496 QC-CR545764 |
High | Nexus 7 (2013) | Mar 31, 2014 |
| CVE-2014-9784 | A-28442449 QC-CR585147 |
High | Nexus 5, Nexus 7 (2013) | Apr 30, 2014 |
| CVE-2014-9777 | A-28598501 QC-CR563654 |
High | Nexus 5, Nexus 7 (2013) | Apr 30, 2014 |
| CVE-2014-9778 | A-28598515 QC-CR563694 |
High | Nexus 5, Nexus 7 (2013) | Apr 30, 2014 |
| CVE-2014-9790 | A-28769136 QC-CR545716 [2] |
High | Nexus 5, Nexus 7 (2013) | Apr 30, 2014 |
| CVE-2014-9792 | A-28769399 QC-CR550606 |
High | Nexus 5 | Apr 30, 2014 |
| CVE-2014-9797 | A-28821090 QC-CR674071 |
High | Nexus 5 | Jul 3, 2014 |
| CVE-2014-9791 | A-28803396 QC-CR659364 |
High | Nexus 7 (2013) | Aug 29, 2014 |
| CVE-2014-9796 | A-28820722 QC-CR684756 |
High | Nexus 5, Nexus 7 (2013) | Sep 30, 2014 |
| CVE-2014-9800 | A-28822150 QC-CR692478 |
High | Nexus 5, Nexus 7 (2013) | Oct 31, 2014 |
| CVE-2014-9799 | A-28821731 QC-CR691916 |
High | Nexus 5, Nexus 7 (2013) | Oct 31, 2014 |
| CVE-2014-9801 | A-28822060 QC-CR705078 |
High | Nexus 5 | Nov 28, 2014 |
| CVE-2014-9802 | A-28821965 QC-CR705108 |
High | Nexus 5, Nexus 7 (2013) | Dec 31, 2014 |
| CVE-2015-8891 | A-28842418 QC-CR813930 |
High | Nexus 5, Nexus 7 (2013) | May 29, 2015 |
| CVE-2015-8888 | A-28822465 QC-CR813933 |
High | Nexus 5 | Jun 30, 2015 |
| CVE-2015-8889 | A-28822677 QC-CR804067 |
High | Nexus 6P | Jun 30, 2015 |
| CVE-2015-8890 | A-28822878 QC-CR823461 |
High | Nexus 5, Nexus 7 (2013) | Aug 19, 2015 |
* The severity rating for these issues is provided directly by Qualcomm.
Elevation of privilege vulnerability in Qualcomm USB driver
An elevation of privilege vulnerability in the Qualcomm USB driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2502 | A-27657963 QC-CR997044 | High | Nexus 5X, Nexus 6P | Mar 11, 2016 |
Elevation of privilege vulnerability in Qualcomm Wi-Fi driver
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3792 | A-27725204 QC-CR561022 | High | Nexus 7 (2013) | Mar 17, 2016 |
Elevation of privilege vulnerability in Qualcomm camera driver
An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2501 | A-27890772* QC-CR1001092 | High | Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013) | Mar 27, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in NVIDIA camera driver
An elevation of privilege vulnerability in the NVIDIA camera driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3793 | A-28026625* N-CVE20163793 |
High | Nexus 9 | Apr 5, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek power driver
An elevation of privilege in the MediaTek power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3795 | A-28085222* M-ALPS02677244 |
High | Android One | Apr 7, 2016 |
| CVE-2016-3796 | A-29008443* M-ALPS02677244 |
High | Android One | Apr 7, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm Wi-Fi driver
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3797 | A-28085680* QC-CR1001450 | High | Nexus 5X | Apr 7, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek hardware sensor driver
An elevation of privilege vulnerability in the MediaTek hardware sensor driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3798 | A-28174490* M-ALPS02703105 |
High | Android One | Apr 11, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek video driver
An elevation of privilege vulnerability in the MediaTek video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3799 | A-28175025* M-ALPS02693738 |
High | Android One | Apr 11, 2016 |
| CVE-2016-3800 | A-28175027* M-ALPS02693739 |
High | Android One | Apr 11, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek GPS driver
An elevation of privilege vulnerability in the MediaTek GPS driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3801 | A-28174914* M-ALPS02688853 |
High | Android One | Apr 11, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in kernel file system
An elevation of privilege vulnerability in the kernel file system could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3802 | A-28271368* | High | Nexus 9 | Apr 19, 2016 |
| CVE-2016-3803 | A-28588434* | High | Nexus 5X, Nexus 6P | May 4, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek power management driver
An elevation of privilege in the MediaTek power management driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3804 | A-28332766* M-ALPS02694410 |
High | Android One | Apr 20, 2016 |
| CVE-2016-3805 | A-28333002* M-ALPS02694412 |
High | Android One | Apr 21, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in MediaTek display driver
An elevation of privilege vulnerability in the MediaTek display driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3806 | A-28402341* M-ALPS02715341 |
High | Android One | Apr 26, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in serial peripheral interface driver
An elevation of privilege vulnerability in the serial peripheral interface driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3807 | A-28402196* | High | Nexus 5X, Nexus 6P | Apr 26, 2016 |
| CVE-2016-3808 | A-28430009* | High | Pixel C | Apr 26, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in Qualcomm sound driver
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High severity because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-2068 | A-28470967 QC-CR1006609 | High | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | Apr 28, 2016 |
Elevation of privilege vulnerability in kernel
An elevation of privilege vulnerability in the kernel could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2014-9803 | A-28557020 Upstream kernel |
High | Nexus 5X, Nexus 6P | Google internal |
Information disclosure vulnerability in networking component
An information disclosure vulnerability in the networking component could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3809 | A-27532522* | High | All Nexus | Mar 5, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in MediaTek Wi-Fi driver
An information disclosure vulnerability in the MediaTek Wi-Fi driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as High because it could be used to access sensitive data without explicit user permission.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3810 | A-28175522* M-ALPS02694389 |
High | Android One | Apr 12, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Elevation of privilege vulnerability in kernel video driver
An elevation of privilege vulnerability in the kernel video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3811 | A-28447556* | Moderate | Nexus 9 | Google internal |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in MediaTek video codec driver
An information disclosure vulnerability in the MediaTek video codec driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3812 | A-28174833* M-ALPS02688832 |
Moderate | Android One | Apr 11, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in Qualcomm USB driver
An information disclosure vulnerability in the Qualcomm USB driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3813 | A-28172322* QC-CR1010222 | Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P | Apr 11, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in NVIDIA camera driver
An information disclosure vulnerability in the NVIDIA camera driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3814 | A-28193342* N-CVE20163814 |
Moderate | Nexus 9 | Apr 14, 2016 |
| CVE-2016-3815 | A-28522274* N-CVE20163815 |
Moderate | Nexus 9 | May 1, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in MediaTek display driver
An information disclosure vulnerability in the MediaTek display driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-3816 | A-28402240* | Moderate | Android One | Apr 26, 2016 |
* The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the Google Developer site.
Information disclosure vulnerability in kernel teletype driver
An information disclosure vulnerability in the teletype driver could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2016-0723 | A-28409131 Upstream kernel |
Moderate | Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, Pixel C | Apr 26, 2016 |
Denial of service vulnerability in Qualcomm bootloader
A denial of service vulnerability in the Qualcomm bootloader could enable a local malicious application to cause a local permanent device compromise, which may require reflashing the operating system to repair the device. This issue is rated as Moderate because it first requires compromising a privileged process.
| CVE | References | Severity | Updated Nexus devices | Date reported |
|---|---|---|---|---|
| CVE-2014-9798 | A-28821448 QC-CR681965 | Moderate | Nexus 5 | Oct 31, 2014 |
| CVE-2015-8893 | A-28822690 QC-CR822275 | Moderate | Nexus 5, Nexus 7 (2013) | Aug 19, 2015 |
Common questions and answers
This section answers common questions that may occur after reading this bulletin.
1. How do I determine if my device is updated to address these issues?
Security Patch Levels of 2016-07-01 or later address all issues associated with the 2016-7-01 security patch string level. Security Patch Levels of 2016-07-05 or later address all issues associated with the 2016-07-05 security patch string level. Refer to the help center for instructions on how to check the security patch level. Device manufacturers that include these updates should set the patch string level to: [ro.build.version.security_patch]:[2016-07-01] or [ro.build.version.security_patch]:[2016-07-05].
2. Why does this bulletin have two security patch level strings?
This bulletin has two security patch level strings in order to provide Android partners with the flexibility to move more quickly to fix a subset of vulnerabilities that are similar across all Android devices. Android partners are encouraged to fix all issues in this bulletin and use the latest security patch level string.
Devices that use the security patch level of July 5, 2016 or newer must include all applicable patches in this (and previous) security bulletins.
Devices that use the July 1, 2016 security patch level must include all issues associated with that security patch level, as well as fixes for all issues reported in previous security bulletins. Devices that use July 1, 2016 security patch level may also include a subset of fixes associated with the July 5, 2016 security patch level.
3. How do I determine which Nexus devices are affected by each issue?
In the 2016-07-01 and 2016-07-05 security vulnerability details sections, each table has an Updated Nexus devices column that covers the range of affected Nexus devices updated for each issue. This column has a few options:
- All Nexus devices: If an issue affects all Nexus devices, the table will have “All Nexus” in the Updated Nexus devices column. “All Nexus” encapsulates the following supported devices: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Android One, Nexus Player, and Pixel C.
- Some Nexus devices: If an issue doesn’t affect all Nexus devices, the affected Nexus devices are listed in the Updated Nexus devices column.
- No Nexus devices: If no Nexus devices are affected by the issue, the table will have “None” in the Updated Nexus devices column.
4. What do the entries in the references column map to?
Entries under the References column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs. These prefixes map as follows:
| Prefix | Reference |
|---|---|
| A- | Android bug ID |
| QC- | Qualcomm reference number |
| M- | MediaTek reference number |
| N- | NVIDIA reference number |
Revisions
- July 06, 2016: Bulletin published.
- July 07, 2016:
- Added AOSP links.
- Removed CVE-2016-3794 because it is a duplicate of CVE-2016-3814
- Added attribution for CVE-2016-2501 and CVE-2016-2502
- July 11, 2016: Updated attribution for CVE-2016-3750
- July 14, 2016: Updated attribution for CVE-2016-2503
- April 1, 2019: Updated patch links for CVE-2016-3818