1 <html devsite> 2 <head> 3 <title>Android Security BulletinNovember 2016</title> 4 <meta name="project_path" value="/_project.yaml" /> 5 <meta name="book_path" value="/_book.yaml" /> 6 </head> 7 <body> 8 <!-- 9 Copyright 2017 The Android Open Source Project 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 Unless required by applicable law or agreed to in writing, software 18 distributed under the License is distributed on an "AS IS" BASIS, 19 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 See the License for the specific language governing permissions and 21 limitations under the License. 22 --> 23 24 25 <p><em>Published November 07, 2016 | Updated December 21, 2016</em></p> 26 <p> 27 The Android Security Bulletin contains details of security vulnerabilities 28 affecting Android devices. Alongside the bulletin, we have released a security 29 update to Google devices through an over-the-air (OTA) update. The Google device 30 firmware images have also been released to the 31 <a href="https://developers.google.com/android/nexus/images">Google Developer 32 site</a>. Security patch levels of November 06, 2016 or later address all of 33 these issues. Refer to the 34 <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel 35 and Nexus update schedule</a> to learn how to check a device's security patch level.</p> 36 <p> 37 Partners were notified of the issues described in the bulletin on October 20, 38 2016 or earlier. Where applicable, source code patches for these issues have 39 been released to the Android Open Source Project (AOSP) repository. This 40 bulletin also includes links to patches outside of AOSP. 41 </p> 42 <p> 43 The most severe of these issues is a Critical security vulnerability that could 44 enable remote code execution on an affected device through multiple methods such 45 as email, web browsing, and MMS when processing media files. The 46 <a href="/security/overview/updates-resources.html#severity">severity 47 assessment</a> is based on the effect that exploiting the vulnerability would 48 possibly have on an affected device, assuming the platform and service 49 mitigations are disabled for development purposes or if successfully bypassed.</p> 50 <p> 51 We have had no reports of active customer exploitation or abuse of these newly 52 reported issues. Refer to the 53 <a href="#mitigations">Android and Google service 54 mitigations</a> section for details on the 55 <a href="/security/enhancements/index.html">Android 56 security platform protections</a> and service protections such as 57 <a href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>, 58 which improve the security of the Android platform.</p> 59 <p> 60 We encourage all customers to accept these updates to their devices.</p> 61 <h2 id="announcements">Announcements</h2> 62 <ul> 63 <li>With the introduction of the Pixel and Pixel XL devices, the term for 64 <a href="#google-devices">all devices supported by Google</a> is 65 "Google devices" instead of "Nexus devices." 66 </li> 67 <li>This bulletin has three security patch levels to provide Android partners 68 with the flexibility to more quickly fix a subset of vulnerabilities that are 69 similar across all Android devices. See 70 <a href="#common-questions-and-answers">Common questions and answers</a> for 71 additional information: 72 <ul> 73 <li><strong>2016-11-01</strong>: Partial security patch level. This security 74 patch level indicates that all issues associated with 2016-11-01 (and all 75 previous security patch level) are addressed.</li> 76 <li><strong>2016-11-05</strong>: Complete security patch level. This security 77 patch level indicates that all issues associated with 2016-11-01 and 2016-11-05 78 (and all previous security patch levels) are addressed.</li> 79 <li><strong>Supplemental security patch levels</strong> 80 <p>Supplemental security patch levels are provided to identify devices 81 that contain fixes for issues that were publicly disclosed after the 82 patch level was defined. Addressing these recently disclosed 83 vulnerabilities is not required until the 2016-12-01 security patch level. 84 </p> 85 <ul> 86 <li><strong>2016-11-06</strong>: This security patch level indicates that the 87 device has addressed all issues associated with 2016-11-05 and CVE-2016-5195, 88 which was publicly disclosed on October 19, 2016.</li> 89 </ul> 90 </li> 91 </ul> 92 </li> 93 <li>Supported Google devices will receive a single OTA update with the November 94 05, 2016 security patch level.</li> 95 </ul> 96 97 <h2 id="mitigations">Android and Google service 98 mitigations</h2> 99 <p> 100 This is a summary of the mitigations provided by the 101 <a href="/security/enhancements/index.html">Android 102 security platform</a> and service protections, such as SafetyNet. These 103 capabilities reduce the likelihood that security vulnerabilities could be 104 successfully exploited on Android.</p> 105 <ul> 106 <li>Exploitation for many issues on Android is made more difficult by 107 enhancements in newer versions of the Android platform. We encourage all users 108 to update to the latest version of Android where possible.</li> 109 <li>The Android Security team actively monitors for abuse with 110 <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify 111 Apps and SafetyNet</a>, which are designed to warn users about 112 <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially 113 Harmful Applications</a>. Verify Apps is enabled by default on devices with 114 <a href="http://www.android.com/gms">Google Mobile Services</a> and is especially 115 important for users who install applications from outside of Google Play. Device 116 rooting tools are prohibited within Google Play, but Verify Apps warns users 117 when they attempt to install a detected rooting applicationno matter where it 118 comes from. Additionally, Verify Apps attempts to identify and block 119 installation of known malicious applications that exploit a privilege escalation 120 vulnerability. If such an application has already been installed, Verify Apps 121 will notify the user and attempt to remove the detected application.</li> 122 <li>As appropriate, Google Hangouts and Messenger applications do not 123 automatically pass media to processes such as Mediaserver.</li> 124 </ul> 125 <h2 id="acknowledgements">Acknowledgements</h2> 126 <p> 127 We would like to thank these researchers for their contributions:</p> 128 <ul> 129 <li>Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security 130 Team: CVE-2016-6722</li> 131 <li>Andrei Kapishnikov and Miriam Gershenson of Google: CVE-2016-6703</li> 132 <li>Ao Wang (<a href="https://twitter.com/ArayzSegment">@ArayzSegment</a>) and 133 <a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of 134 <a href="http://www.pkav.net">PKAV</a>, Silence Information Technology: 135 CVE-2016-6700, CVE-2016-6702</li> 136 <li>Askyshang of Security Platform Department, Tencent: CVE-2016-6713</li> 137 <li>Billy Lau of Android Security: CVE-2016-6737</li> 138 <li><a href="mailto:kpatsak (a] unipi.gr">Constantinos Patsakis</a> and 139 <a href="mailto:talepis (a] unipi.gr">Efthimios Alepis</a> of University of Piraeus: 140 CVE-2016-6715</li> 141 <li>dragonltx of Alibaba mobile security team: CVE-2016-6714</li> 142 <li>Gal Beniamini of Project Zero: CVE-2016-6707, CVE-2016-6717</li> 143 <li>Gengjia Chen (<a href="http://twitter.com/chengjia4574">@chengjia4574</a>) 144 and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, 145 <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-6725, 146 CVE-2016-6738, CVE-2016-6740, CVE-2016-6741, CVE-2016-6742, CVE-2016-6744, 147 CVE-2016-6745, CVE-2016-3906</li> 148 <li>Guang Gong () (<a href="http://twitter.com/oldfresher">@oldfresher</a>) of 149 Alpha Team, <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: 150 CVE-2016-6754</li> 151 <li>Jianqiang Zhao (<a 152 href="http://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and 153 <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, 154 <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-6739, 155 CVE-2016-3904, CVE-2016-3907, CVE-2016-6698</li> 156 <li>Marco Grassi (<a href="http://twitter.com/marcograss">@marcograss</a>) of 157 Keen Lab of Tencent (<a href="http://twitter.com/keen_lab">@keen_lab</a>): 158 CVE-2016-6828</li> 159 <li>Mark Brand of Project Zero: CVE-2016-6706</li> 160 <li>Mark Renouf of Google: CVE-2016-6724</li> 161 <li>Micha Bednarski (<a 162 href="https://github.com/michalbednarski">github.com/michalbednarski</a>): 163 CVE-2016-6710</li> 164 <li>Min Chong of Android Security: CVE-2016-6743</li> 165 <li>Peter Pi (<a href="http://twitter.com/heisecode">@heisecode</a>) of Trend 166 Micro: CVE-2016-6721</li> 167 <li>Qidan He () (<a href="http://twitter.com/flanker_hqd">@flanker_hqd</a>) 168 and Gengming Liu () (<a href="http://twitter.com/dmxcsnsbh">@dmxcsnsbh</a>) 169 of KeenLab, Tencent: CVE-2016-6705</li> 170 <li>Robin Lee of Google: CVE-2016-6708</li> 171 <li><a href="mailto:sbauer (a] plzdonthack.me">Scott Bauer</a> (<a 172 href="http://twitter.com/ScottyBauer1">@ScottyBauer1</a>): CVE-2016-6751</li> 173 <li>Sergey Bobrov (<a href="http://twitter.com/Black2Fan">@Black2Fan</a>) of 174 Kaspersky Lab: CVE-2016-6716</li> 175 <li>Seven Shen (<a href="http://twitter.com/lingtongshen">@lingtongshen</a>) of 176 Trend Micro Mobile Threat Research Team: CVE-2016-6748, CVE-2016-6749, 177 CVE-2016-6750, CVE-2016-6753</li> 178 <li>Victor van der Veen, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida of 179 Vrije Universiteit Amsterdam and Yanick Fratantonio, Martina Lindorfer, and 180 Giovanni Vigna of University of California, Santa Barbara: CVE-2016-6728</li> 181 <li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of 182 Alibaba Inc: CVE-2016-6712, CVE-2016-6699, CVE-2016-6711</li> 183 <li>Wenke Dou (<a 184 href="mailto:vancouverdou (a] gmail.com">vancouverdou (a] gmail.com</a>), Chiachih Wu 185 (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang 186 of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6720</li> 187 <li>Wish Wu () (<a href="http://twitter.com/wish_wu">@wish_wu</a>) of Trend 188 Micro Inc.: CVE-2016-6704</li> 189 <li>Yakov Shafranovich of 190 <a href="https://wwws.nightwatchcybersecurity.com">Nightwatch Cybersecurity</a>: 191 CVE-2016-6723</li> 192 <li><a href="mailto:computernik (a] gmail.com">Yuan-Tsung Lo</a>, 193 <a href="mailto:yaojun8558363 (a] gmail.com">Yao Jun</a>, 194 <a href="mailto:segfault5514 (a] gmail.com">Tong Lin</a>, Chiachih Wu (<a 195 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of 196 <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6730, CVE-2016-6732, 197 CVE-2016-6734, CVE-2016-6736</li> 198 <li><a href="mailto:computernik (a] gmail.com">Yuan-Tsung Lo</a>, 199 <a href="mailto:yaojun8558363 (a] gmail.com">Yao Jun</a>, 200 <a href="mailto:wisedd (a] gmail.com">Xiaodong Wang</a>, Chiachih Wu (<a 201 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of 202 <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6731, CVE-2016-6733, 203 CVE-2016-6735, CVE-2016-6746</li> 204 </ul> 205 <p> 206 Additional thanks to Zach Riggle of Android Security for his contributions 207 to several issues in this bulletin.</p> 208 209 <h2 id="2016-11-01-details">2016-11-01 security patch levelVulnerability details</h2> 210 <p> 211 In the sections below, we provide details for each of the security 212 vulnerabilities that apply to the 2016-11-01 patch level. There is a description of 213 the issue, a severity rationale, and a table with the CVE, associated 214 references, severity, updated Google devices, updated AOSP versions (where 215 applicable), and date reported. When available, we will link the public change 216 that addressed the issue to the bug ID, like the AOSP change list. When multiple 217 changes relate to a single bug, additional references are linked to numbers 218 following the bug ID.</p> 219 220 <h3 id="rce-in-mediaserver">Remote code execution vulnerability in Mediaserver</h3> 221 <p> 222 A remote code execution vulnerability in Mediaserver could enable an attacker 223 using a specially crafted file to cause memory corruption during media file and 224 data processing. This issue is rated as Critical due to the possibility of 225 remote code execution within the context of the Mediaserver process. 226 </p> 227 <table> 228 <col width="18%"> 229 <col width="18%"> 230 <col width="10%"> 231 <col width="19%"> 232 <col width="17%"> 233 <col width="17%"> 234 <tr> 235 <th>CVE</th> 236 <th>References</th> 237 <th>Severity</th> 238 <th>Updated Google devices</th> 239 <th>Updated AOSP versions</th> 240 <th>Date reported</th> 241 </tr> 242 <tr> 243 <td>CVE-2016-6699</td> 244 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/3b1c9f692c4d4b7a683c2b358fc89e831a641b88"> 245 A-31373622</a></td> 246 <td>Critical</td> 247 <td>All</td> 248 <td>7.0</td> 249 <td>Jul 27, 2016</td> 250 </tr> 251 </table> 252 <h3 id="eop-in-libzipfile">Elevation of privilege vulnerability in libzipfile</h3> 253 <p> 254 An elevation of privilege vulnerability in libzipfile could enable a local 255 malicious application to execute arbitrary code within the context of a 256 privileged process. This issue is rated as Critical due to the possibility of a 257 local permanent device compromise, which may require reflashing the operating 258 system to repair the device. 259 </p> 260 <table> 261 <col width="18%"> 262 <col width="18%"> 263 <col width="10%"> 264 <col width="19%"> 265 <col width="17%"> 266 <col width="17%"> 267 <tr> 268 <th>CVE</th> 269 <th>References</th> 270 <th>Severity</th> 271 <th>Updated Google devices</th> 272 <th>Updated AOSP versions</th> 273 <th>Date reported</th> 274 </tr> 275 <tr> 276 <td>CVE-2016-6700</td> 277 <td>A-30916186</td> 278 <td>Critical</td> 279 <td>None*</td> 280 <td>4.4.4, 5.0.2, 5.1.1</td> 281 <td>Aug 17, 2016</td> 282 </tr> 283 </table> 284 <p> 285 * Supported Google devices on Android 7.0 or later that have installed all 286 available updates are not affected by this vulnerability. 287 </p> 288 <h3 id="rce-in-skia">Remote code execution vulnerability in Skia</h3> 289 <p> 290 A remote code execution vulnerability in libskia could enable an attacker using 291 a specially crafted file to cause memory corruption during media file and data 292 processing. This issue is rated as High due to the possibility of remote code 293 execution within the context of the gallery process. 294 </p> 295 <table> 296 <col width="18%"> 297 <col width="18%"> 298 <col width="10%"> 299 <col width="19%"> 300 <col width="17%"> 301 <col width="17%"> 302 <tr> 303 <th>CVE</th> 304 <th>References</th> 305 <th>Severity</th> 306 <th>Updated Google devices</th> 307 <th>Updated AOSP versions</th> 308 <th>Date reported</th> 309 </tr> 310 <tr> 311 <td>CVE-2016-6701</td> 312 <td><a href="https://android.googlesource.com/platform/external/skia/+/aca73722873e908633ff27375f6f93a08cbb7dd3"> 313 A-30190637</a></td> 314 <td>High</td> 315 <td>All</td> 316 <td>7.0</td> 317 <td>Google internal</td> 318 </tr> 319 </table> 320 <h3 id="rce-in-libjpeg">Remote code execution vulnerability in libjpeg</h3> 321 <p> 322 A remote code execution vulnerability in libjpeg could enable an attacker using 323 a specially crafted file to execute arbitrary code in the context of an 324 unprivileged process. This issue is rated as High due to the possibility of 325 remote code execution in an application that uses libjpeg. 326 </p> 327 <table> 328 <col width="18%"> 329 <col width="18%"> 330 <col width="10%"> 331 <col width="19%"> 332 <col width="17%"> 333 <col width="17%"> 334 <tr> 335 <th>CVE</th> 336 <th>References</th> 337 <th>Severity</th> 338 <th>Updated Google devices</th> 339 <th>Updated AOSP versions</th> 340 <th>Date reported</th> 341 </tr> 342 <tr> 343 <td>CVE-2016-6702</td> 344 <td>A-30259087</td> 345 <td>High</td> 346 <td>None*</td> 347 <td>4.4.4, 5.0.2, 5.1.1</td> 348 <td>Jul 19, 2016</td> 349 </tr> 350 </table> 351 <p> 352 * Supported Google devices on Android 7.0 or later that have installed all 353 available updates are not affected by this vulnerability. 354 </p> 355 <h3 id="rce-in-android-runtime">Remote code execution vulnerability in Android runtime</h3> 356 <p> 357 A remote code execution vulnerability in an Android runtime library could enable 358 an attacker using a specially crafted payload to execute arbitrary code in the 359 context of an unprivileged process. This issue is rated as High due to the 360 possibility of remote code execution in an application that uses the Android 361 runtime. 362 </p> 363 <table> 364 <col width="18%"> 365 <col width="18%"> 366 <col width="10%"> 367 <col width="19%"> 368 <col width="17%"> 369 <col width="17%"> 370 <tr> 371 <th>CVE</th> 372 <th>References</th> 373 <th>Severity</th> 374 <th>Updated Google devices</th> 375 <th>Updated AOSP versions</th> 376 <th>Date reported</th> 377 </tr> 378 <tr> 379 <td>CVE-2016-6703</td> 380 <td>A-30765246</td> 381 <td>High</td> 382 <td>None*</td> 383 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 384 <td>Google internal</td> 385 </tr> 386 </table> 387 <p> 388 * Supported Google devices on Android 7.0 or later that have installed all 389 available updates are not affected by this vulnerability. 390 </p> 391 <h3 id="eop-in-mediaserver">Elevation of privilege vulnerability in Mediaserver</h3> 392 <p> 393 An elevation of privilege vulnerability in Mediaserver could enable a local 394 malicious application to execute arbitrary code within the context of a 395 privileged process. This issue is rated as High because it could be used to gain 396 local access to elevated capabilities, which are not normally accessible to a 397 third-party application. 398 </p> 399 <table> 400 <col width="18%"> 401 <col width="18%"> 402 <col width="10%"> 403 <col width="19%"> 404 <col width="17%"> 405 <col width="17%"> 406 <tr> 407 <th>CVE</th> 408 <th>References</th> 409 <th>Severity</th> 410 <th>Updated Google devices</th> 411 <th>Updated AOSP versions</th> 412 <th>Date reported</th> 413 </tr> 414 <tr> 415 <td>CVE-2016-6704</td> 416 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/c6c446f9e022adf20064e65a17574804f8af8e7d"> 417 A-30229821</a> 418 [<a href="https://android.googlesource.com/platform/hardware/qcom/audio/+/9cb9810ecb63c8ff55ecf4bc77431dc5b0688b5f">2</a>] 419 [<a href="https://android.googlesource.com/platform/system/media/+/a6274f03b4dfe1c3a22af51e3a17ea56a314e747">3</a>] 420 </td> 421 <td>High</td> 422 <td>All</td> 423 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 424 <td>Jul 19, 2016</td> 425 </tr> 426 <tr> 427 <td>CVE-2016-6705</td> 428 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/3a03fa24d21f97e84e796ac5ef14b3f434c0e8f1"> 429 A-30907212</a> 430 [<a href="https://android.googlesource.com/platform/frameworks/av/+/bd04b47d38a89f1dada1c6da2ef4a3d235c166b8">2</a>] 431 </td> 432 <td>High</td> 433 <td>All</td> 434 <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 435 <td>Aug 16, 2016</td> 436 </tr> 437 <tr> 438 <td>CVE-2016-6706</td> 439 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/1d4feebdb85db46e138530f360d9ff2490e14353"> 440 A-31385713</a> 441 </td> 442 <td>High</td> 443 <td>All</td> 444 <td>7.0</td> 445 <td>Sep 8, 2016</td> 446 </tr> 447 </table> 448 <h3 id="eop-in-system-server">Elevation of privilege vulnerability in System Server</h3> 449 <p> 450 An elevation of privilege vulnerability in System Server could enable a local 451 malicious application to execute arbitrary code within the context of a 452 privileged process. This issue is rated as High because it could be used to gain 453 local access to elevated capabilities, which are not normally accessible to a 454 third-party application. 455 </p> 456 <table> 457 <col width="18%"> 458 <col width="18%"> 459 <col width="10%"> 460 <col width="19%"> 461 <col width="17%"> 462 <col width="17%"> 463 <tr> 464 <th>CVE</th> 465 <th>References</th> 466 <th>Severity</th> 467 <th>Updated Google devices</th> 468 <th>Updated AOSP versions</th> 469 <th>Date reported</th> 470 </tr> 471 <tr> 472 <td>CVE-2016-6707</td> 473 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/16024ea7c4bae08c972cf6b3734029aad33e8870"> 474 A-31350622</a> 475 </td> 476 <td>High</td> 477 <td>All</td> 478 <td>6.0, 6.0.1, 7.0</td> 479 <td>Sep 7, 2016</td> 480 </tr> 481 </table> 482 <h3 id="eop-in-system-ui">Elevation of privilege vulnerability in System UI</h3> 483 <p> 484 An elevation of privilege in the System UI could enable a local malicious user 485 to bypass the security prompt of a work profile in Multi-Window mode. This 486 issue is rated as High because it is a local bypass of user interaction 487 requirements for any developer or security setting modifications. 488 </p> 489 <table> 490 <col width="18%"> 491 <col width="18%"> 492 <col width="10%"> 493 <col width="19%"> 494 <col width="17%"> 495 <col width="17%"> 496 <tr> 497 <th>CVE</th> 498 <th>References</th> 499 <th>Severity</th> 500 <th>Updated Google devices</th> 501 <th>Updated AOSP versions</th> 502 <th>Date reported</th> 503 </tr> 504 <tr> 505 <td>CVE-2016-6708</td> 506 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/c9c73fde339b4db496f2c1ff8c18df1e9db5a7c1"> 507 A-30693465</a> 508 </td> 509 <td>High</td> 510 <td>All</td> 511 <td>7.0</td> 512 <td>Google internal</td> 513 </tr> 514 </table> 515 <h3 id="id-in-conscrypt">Information disclosure vulnerability in Conscrypt</h3> 516 <p> 517 An information disclosure vulnerability in Conscrypt could enable 518 an attacker to gain access to sensitive information if a 519 legacy encryption API is used by an application. This issue is rated as High 520 because it could be used to access data without permission. 521 </p> 522 <table> 523 <col width="18%"> 524 <col width="18%"> 525 <col width="10%"> 526 <col width="19%"> 527 <col width="17%"> 528 <col width="17%"> 529 <tr> 530 <th>CVE</th> 531 <th>References</th> 532 <th>Severity</th> 533 <th>Updated Google devices</th> 534 <th>Updated AOSP versions</th> 535 <th>Date reported</th> 536 </tr> 537 <tr> 538 <td>CVE-2016-6709</td> 539 <td><a href="https://android.googlesource.com/platform/external/conscrypt/+/44ef9535b9afb123d150d8e0362e4bb50794dd41"> 540 A-31081987</a> 541 </td> 542 <td>High</td> 543 <td>All</td> 544 <td>6.0, 6.0.1, 7.0</td> 545 <td>Oct 9, 2015</td> 546 </tr> 547 </table> 548 <h3 id="id-in-download-manager">Information disclosure vulnerability in download 549 manager</h3> 550 <p> 551 An information disclosure vulnerability in the download manager could enable a 552 local malicious application to bypass operating system protections that isolate 553 application data from other applications. This issue is rated as High because it 554 could be used to gain access to data that the application does not have access 555 to. 556 </p> 557 <table> 558 <col width="18%"> 559 <col width="18%"> 560 <col width="10%"> 561 <col width="19%"> 562 <col width="17%"> 563 <col width="17%"> 564 <tr> 565 <th>CVE</th> 566 <th>References</th> 567 <th>Severity</th> 568 <th>Updated Google devices</th> 569 <th>Updated AOSP versions</th> 570 <th>Date reported</th> 571 </tr> 572 <tr> 573 <td>CVE-2016-6710</td> 574 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/9fab683c9598d234dd8461335c276ed3e37c91e8"> 575 A-30537115</a> 576 [<a href="https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/243e62949f7208d3b82eda3ee4ec22d3dbc1fb19">2</a>] 577 </td> 578 <td>High</td> 579 <td>All</td> 580 <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 581 <td>Jul 30, 2016</td> 582 </tr> 583 </table> 584 <h3 id="dos-in-bluetooth">Denial of service 585 vulnerability in Bluetooth</h3> 586 <p> 587 A denial of service vulnerability in Bluetooth could enable a proximate attacker 588 to block Bluetooth access to an affected device. This issue is rated as High due 589 to the possibility of remote denial of service. 590 </p> 591 <table> 592 <col width="18%"> 593 <col width="18%"> 594 <col width="10%"> 595 <col width="19%"> 596 <col width="17%"> 597 <col width="17%"> 598 <tr> 599 <th>CVE</th> 600 <th>References</th> 601 <th>Severity</th> 602 <th>Updated Google devices</th> 603 <th>Updated AOSP versions</th> 604 <th>Date reported</th> 605 </tr> 606 <tr> 607 <td>CVE-2014-9908</td> 608 <td>A-28672558</td> 609 <td>High</td> 610 <td>None*</td> 611 <td>4.4.4, 5.0.2, 5.1.1</td> 612 <td>May 5, 2014</td> 613 </tr> 614 </table> 615 <p> 616 * Supported Google devices on Android 7.0 or later that have installed all 617 available updates are not affected by this vulnerability. 618 </p> 619 <h3 id="dos-in-openjdk">Denial of service 620 vulnerability in OpenJDK</h3> 621 <p> 622 A remote denial of service vulnerability in OpenJDK could enable an attacker to 623 use a specially crafted file to cause a device hang or reboot. This issue is 624 rated as High due to the possibility of remote denial of service. 625 </p> 626 <table> 627 <col width="18%"> 628 <col width="18%"> 629 <col width="10%"> 630 <col width="19%"> 631 <col width="17%"> 632 <col width="17%"> 633 <tr> 634 <th>CVE</th> 635 <th>References</th> 636 <th>Severity</th> 637 <th>Updated Google devices</th> 638 <th>Updated AOSP versions</th> 639 <th>Date reported</th> 640 </tr> 641 <tr> 642 <td>CVE-2015-0410</td> 643 <td><a href="https://android.googlesource.com/platform/libcore/+/21098574528bdf99dd50a74a60e161573e999108"> 644 A-30703445</a> 645 </td> 646 <td>High</td> 647 <td>All</td> 648 <td>7.0</td> 649 <td>Jan 16, 2015</td> 650 </tr> 651 </table> 652 <h3 id="dos-in-mediaserver">Denial of service 653 vulnerability in Mediaserver</h3> 654 <p> 655 A remote denial of service vulnerability in Mediaserver could enable an attacker 656 to use a specially crafted file to cause a device hang or reboot. This issue is 657 rated as High due to the possibility of remote denial of service. 658 </p> 659 <table> 660 <col width="18%"> 661 <col width="18%"> 662 <col width="10%"> 663 <col width="19%"> 664 <col width="17%"> 665 <col width="17%"> 666 <tr> 667 <th>CVE</th> 668 <th>References</th> 669 <th>Severity</th> 670 <th>Updated Google devices</th> 671 <th>Updated AOSP versions</th> 672 <th>Date reported</th> 673 </tr> 674 <tr> 675 <td>CVE-2016-6711</td> 676 <td><a href="https://android.googlesource.com/platform/external/libvpx/+/063be1485e0099bc81ace3a08b0ec9186dcad693"> 677 A-30593765</a> 678 </td> 679 <td>High</td> 680 <td>None*</td> 681 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 682 <td>Aug 1, 2016</td> 683 </tr> 684 <tr> 685 <td>CVE-2016-6712</td> 686 <td><a href="https://android.googlesource.com/platform/external/libvpx/+/fdb1b40e7bb147c07bda988c9501ad223795d12d"> 687 A-30593752</a> 688 </td> 689 <td>High</td> 690 <td>None*</td> 691 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 692 <td>Aug 1, 2016</td> 693 </tr> 694 <tr> 695 <td>CVE-2016-6713</td> 696 <td><a href="https://android.googlesource.com/platform/external/libavc/+/8cafca0e8b1ed8125918e203118c5a4e612fd56c"> 697 A-30822755</a></td> 698 <td>High</td> 699 <td>All</td> 700 <td>6.0, 6.0.1, 7.0</td> 701 <td>Aug 11, 2016</td> 702 </tr> 703 <tr> 704 <td>CVE-2016-6714</td> 705 <td><a href="https://android.googlesource.com/platform/external/libavc/+/5bdb0a6b72782e505671a387bb5f83222d891d6a"> 706 A-31092462</a> 707 </td> 708 <td>High</td> 709 <td>All</td> 710 <td>6.0, 6.0.1, 7.0</td> 711 <td>Aug 22, 2016</td> 712 </tr> 713 </table> 714 <p> 715 * Supported Google devices on Android 7.0 or later that have installed all 716 available updates are not affected by this vulnerability. 717 </p> 718 <h3 id="eop-in-framework-apis">Elevation of 719 privilege vulnerability in Framework APIs</h3> 720 <p> 721 An elevation of privilege vulnerability in the Framework APIs could allow a 722 local malicious application to record audio without the user's permission. This 723 issue is rated as Moderate because it is a local bypass of user interaction 724 requirements (access to functionality that would normally require either user 725 initiation or user permission). 726 </p> 727 <table> 728 <col width="18%"> 729 <col width="18%"> 730 <col width="10%"> 731 <col width="19%"> 732 <col width="17%"> 733 <col width="17%"> 734 <tr> 735 <th>CVE</th> 736 <th>References</th> 737 <th>Severity</th> 738 <th>Updated Google devices</th> 739 <th>Updated AOSP versions</th> 740 <th>Date reported</th> 741 </tr> 742 <tr> 743 <td>CVE-2016-6715</td> 744 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/3de09838fb0996bb4b420630800ad34e828fd1b6"> 745 A-29833954</a> 746 </td> 747 <td>Moderate</td> 748 <td>All</td> 749 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 750 <td>Jun 28, 2016</td> 751 </tr> 752 </table> 753 <h3 id="eop-in-aosp-launcher">Elevation of 754 privilege vulnerability in AOSP Launcher</h3> 755 <p> 756 An elevation of privilege vulnerability in the AOSP Launcher could allow a local 757 malicious application to create shortcuts that have elevated privileges without 758 the user's consent. This issue is rated as Moderate because it is a local bypass 759 of user interaction requirements (access to functionality that would normally 760 require either user initiation or user permission). 761 </p> 762 <table> 763 <col width="18%"> 764 <col width="18%"> 765 <col width="10%"> 766 <col width="19%"> 767 <col width="17%"> 768 <col width="17%"> 769 <tr> 770 <th>CVE</th> 771 <th>References</th> 772 <th>Severity</th> 773 <th>Updated Google devices</th> 774 <th>Updated AOSP versions</th> 775 <th>Date reported</th> 776 </tr> 777 <tr> 778 <td>CVE-2016-6716</td> 779 <td><a href="https://android.googlesource.com/platform/packages/apps/Launcher3/+/e83fc11c982e67dd0181966f5f3a239ea6b14924"> 780 A-30778130</a> 781 </td> 782 <td>Moderate</td> 783 <td>All</td> 784 <td>7.0</td> 785 <td>Aug 5, 2016</td> 786 </tr> 787 </table> 788 <h3 id="eop-in-mediaserver-1">Elevation of 789 privilege vulnerability in Mediaserver</h3> 790 <p> 791 An elevation of privilege vulnerability in Mediaserver could enable a local 792 malicious application to execute arbitrary code within the context of a 793 privileged process. This issue is rated as Moderate because it first requires 794 exploitation of a separate vulnerability. 795 </p> 796 <table> 797 <col width="18%"> 798 <col width="18%"> 799 <col width="10%"> 800 <col width="19%"> 801 <col width="17%"> 802 <col width="17%"> 803 <tr> 804 <th>CVE</th> 805 <th>References</th> 806 <th>Severity</th> 807 <th>Updated Google devices</th> 808 <th>Updated AOSP versions</th> 809 <th>Date reported</th> 810 </tr> 811 <tr> 812 <td>CVE-2016-6717</td> 813 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/45d9bbabbe7920bf4e0a68074b97d8260aef2e07"> 814 A-31350239</a> 815 </td> 816 <td>Moderate</td> 817 <td>All</td> 818 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 819 <td>Sep 7, 2016</td> 820 </tr> 821 </table> 822 <h3 823 id="eop-in-account-manager-service">Elevation 824 of privilege vulnerability in Account Manager Service</h3> 825 <p> 826 An elevation of privilege vulnerability in the Account Manager Service could 827 enable a local malicious application to retrieve sensitive information without 828 user interaction. This issue is rated as Moderate because it is a local bypass 829 of user interaction requirements (access to functionality that would normally 830 require either user initiation or user permission.) 831 </p> 832 <table> 833 <col width="18%"> 834 <col width="18%"> 835 <col width="10%"> 836 <col width="19%"> 837 <col width="17%"> 838 <col width="17%"> 839 <tr> 840 <th>CVE</th> 841 <th>References</th> 842 <th>Severity</th> 843 <th>Updated Google devices</th> 844 <th>Updated AOSP versions</th> 845 <th>Date reported</th> 846 </tr> 847 <tr> 848 <td>CVE-2016-6718</td> 849 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/fecfd550edeca422c0d9f32a9c0abe73398a1ff1"> 850 A-30455516</a> 851 </td> 852 <td>Moderate</td> 853 <td>All</td> 854 <td>7.0</td> 855 <td>Google internal</td> 856 </tr> 857 </table> 858 <h3 id="eop-in-bluetooth">Elevation of 859 privilege vulnerability in Bluetooth</h3> 860 <p> 861 An elevation of privilege vulnerability in the Bluetooth component could enable 862 a local malicious application to pair with any Bluetooth device without user 863 consent. This issue is rated as Moderate because it is a local bypass of user 864 interaction requirements (access to functionality that would normally require 865 either user initiation or user permission). 866 </p> 867 <table> 868 <col width="18%"> 869 <col width="18%"> 870 <col width="10%"> 871 <col width="19%"> 872 <col width="17%"> 873 <col width="17%"> 874 <tr> 875 <th>CVE</th> 876 <th>References</th> 877 <th>Severity</th> 878 <th>Updated Google devices</th> 879 <th>Updated AOSP versions</th> 880 <th>Date reported</th> 881 </tr> 882 <tr> 883 <td>CVE-2016-6719</td> 884 <td><a href="https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e1b6db10e913c09d0b695368336137f6aabee462"> 885 A-29043989</a> 886 [<a href="https://android.googlesource.com/platform/frameworks/base/+/b1dc1757071ba46ee653d68f331486e86778b8e4">2</a>] 887 </td> 888 <td>Moderate</td> 889 <td>All</td> 890 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 891 <td>Google internal</td> 892 </tr> 893 </table> 894 <h3 id="id-in-mediaserver">Information 895 disclosure vulnerability in Mediaserver</h3> 896 <p> 897 An information disclosure vulnerability in Mediaserver could enable a local 898 malicious application to access data outside of its permission levels. This 899 issue is rated as Moderate because it could be used to access sensitive data 900 without permission. 901 </p> 902 <table> 903 <col width="18%"> 904 <col width="18%"> 905 <col width="10%"> 906 <col width="19%"> 907 <col width="17%"> 908 <col width="17%"> 909 <tr> 910 <th>CVE</th> 911 <th>References</th> 912 <th>Severity</th> 913 <th>Updated Google devices</th> 914 <th>Updated AOSP versions</th> 915 <th>Date reported</th> 916 </tr> 917 <tr> 918 <td>CVE-2016-6720</td> 919 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/0f177948ae2640bfe4d70f8e4248e106406b3b0a"> 920 A-29422020</a> 921 [<a href="https://android.googlesource.com/platform/frameworks/av/+/2c75e1c3b98e4e94f50c63e2b7694be5f948477c">2</a>] 922 [<a href="https://android.googlesource.com/platform/frameworks/av/+/7c88b498fda1c2b608a9dd73960a2fd4d7b7e3f7">3</a>] 923 [<a href="https://android.googlesource.com/platform/frameworks/av/+/640b04121d7cd2cac90e2f7c82b97fce05f074a5">4</a>]</td> 924 <td>Moderate</td> 925 <td>All</td> 926 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 927 <td>Jun 15, 2016</td> 928 </tr> 929 <tr> 930 <td>CVE-2016-6721</td> 931 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/f6bf0102bdc1adff973e08d8ce9c869c4e2efade"> 932 A-30875060</a></td> 933 <td>Moderate</td> 934 <td>All</td> 935 <td>6.0, 6.0.1, 7.0</td> 936 <td>Aug 13, 2016</td> 937 </tr> 938 <tr> 939 <td>CVE-2016-6722</td> 940 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/89c03b3b9ff74a507a8b8334c50b08b334483556"> 941 A-31091777</a></td> 942 <td>Moderate</td> 943 <td>All</td> 944 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 945 <td>Aug 23, 2016</td> 946 </tr> 947 </table> 948 <h3 id="dos-in-proxy-auto-config">Denial of service 949 vulnerability in Proxy Auto Config</h3> 950 <p> 951 A denial of service vulnerability in Proxy Auto Config could enable a remote 952 attacker to use a specially crafted file to cause a device hang or reboot. This 953 issue is rated as Moderate because it requires an uncommon device configuration. 954 </p> 955 <table> 956 <col width="18%"> 957 <col width="18%"> 958 <col width="10%"> 959 <col width="19%"> 960 <col width="17%"> 961 <col width="17%"> 962 <tr> 963 <th>CVE</th> 964 <th>References</th> 965 <th>Severity</th> 966 <th>Updated Google devices</th> 967 <th>Updated AOSP versions</th> 968 <th>Date reported</th> 969 </tr> 970 <tr> 971 <td>CVE-2016-6723</td> 972 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/d5b0d0b1df2e1a7943a4bb2034fd21487edd0264"> 973 A-30100884</a> 974 [<a href="https://android.googlesource.com/platform/frameworks/base/+/31f351160cdfd9dbe9919682ebe41bde3bcf91c6">2</a>] 975 </td> 976 <td>Moderate</td> 977 <td>All</td> 978 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 979 <td>Jul 11, 2016</td> 980 </tr> 981 </table> 982 <h3 id="dos-in-input-manager-service">Denial of 983 service vulnerability in Input Manager Service</h3> 984 <p> 985 A denial of service vulnerability in the Input Manager Service could enable a 986 local malicious application to cause the device to continually reboot. This 987 issue is rated as Moderate because it is a temporary denial of service that 988 requires a factory reset to fix. 989 </p> 990 <table> 991 <col width="18%"> 992 <col width="18%"> 993 <col width="10%"> 994 <col width="19%"> 995 <col width="17%"> 996 <col width="17%"> 997 <tr> 998 <th>CVE</th> 999 <th>References</th> 1000 <th>Severity</th> 1001 <th>Updated Google devices</th> 1002 <th>Updated AOSP versions</th> 1003 <th>Date reported</th> 1004 </tr> 1005 <tr> 1006 <td>CVE-2016-6724</td> 1007 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/7625010a2d22f8c3f1aeae2ef88dde37cbebd0bf"> 1008 A-30568284</a> 1009 </td> 1010 <td>Moderate</td> 1011 <td>All</td> 1012 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 1013 <td>Google internal</td> 1014 </tr> 1015 </table> 1016 <h2 id="2016-11-05-details">2016-11-05 security patch levelVulnerability details</h2> 1017 <p> 1018 In the sections below, we provide details for each of the security 1019 vulnerabilities that apply to the 2016-11-05 patch level. There is a description of 1020 the issue, a severity rationale, and a table with the CVE, associated 1021 references, severity, updated Google devices, updated AOSP versions (where 1022 applicable), and date reported. When available, we will link the public change 1023 that addressed the issue to the bug ID, like the AOSP change list. When multiple 1024 changes relate to a single bug, additional references are linked to numbers 1025 following the bug ID. 1026 </p> 1027 <h3 id="rce-in-qualcomm-crypto-driver">Remote 1028 code execution vulnerability in Qualcomm crypto driver</h3> 1029 <p> 1030 A remote code execution vulnerability in the Qualcomm crypto driver could enable 1031 a remote attacker to execute arbitrary code within the context of the kernel. 1032 This issue is rated as Critical due to the possibility of remote code execution 1033 in the context of the kernel. 1034 </p> 1035 <table> 1036 <col width="19%"> 1037 <col width="20%"> 1038 <col width="10%"> 1039 <col width="23%"> 1040 <col width="17%"> 1041 <tr> 1042 <th>CVE</th> 1043 <th>References</th> 1044 <th>Severity</th> 1045 <th>Updated Google devices</th> 1046 <th>Date reported</th> 1047 </tr> 1048 <tr> 1049 <td>CVE-2016-6725</td> 1050 <td>A-30515053<br> 1051 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=cc95d644ee8a043f2883d65dda20e16f95041de3">QC-CR#1050970</a></td> 1052 <td>Critical</td> 1053 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1054 <td>Jul 25, 2016</td> 1055 </tr> 1056 </table> 1057 <h3 id="eop-in-kernel-file-system">Elevation of 1058 privilege vulnerability in kernel file system</h3> 1059 <p> 1060 An elevation of privilege vulnerability in the kernel file system could enable a 1061 local malicious application to execute arbitrary code within the context of the 1062 kernel. This issue is rated as Critical due to the possibility of a local 1063 permanent device compromise, which may require reflashing the operating system 1064 to repair the device. 1065 </p> 1066 <table> 1067 <col width="19%"> 1068 <col width="20%"> 1069 <col width="10%"> 1070 <col width="23%"> 1071 <col width="17%"> 1072 <tr> 1073 <th>CVE</th> 1074 <th>References</th> 1075 <th>Severity</th> 1076 <th>Updated Google devices</th> 1077 <th>Date reported</th> 1078 </tr> 1079 <tr> 1080 <td>CVE-2015-8961</td> 1081 <td>A-30952474 1082 <br> 1083 <a 1084 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6934da9238da947628be83635e365df41064b09b">Upstream 1085 kernel</a></td> 1086 <td>Critical</td> 1087 <td>Pixel, Pixel XL</td> 1088 <td>Oct 18, 2015</td> 1089 </tr> 1090 <tr> 1091 <td>CVE-2016-7911</td> 1092 <td>A-30946378 1093 <br> 1094 <a 1095 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8ba8682107ee2ca3347354e018865d8e1967c5f4">Upstream 1096 kernel</a></td> 1097 <td>Critical</td> 1098 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1099 Pixel, Pixel XL</td> 1100 <td>Jul 01, 2016</td> 1101 </tr> 1102 <tr> 1103 <td>CVE-2016-7910</td> 1104 <td>A-30942273 1105 <br> 1106 <a 1107 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=77da160530dd1dc94f6ae15a981f24e5f0021e84">Upstream 1108 kernel</a></td> 1109 <td>Critical</td> 1110 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1111 Pixel, Pixel XL</td> 1112 <td>Jul 29, 2016</td> 1113 </tr> 1114 </table> 1115 <h3 id="eop-in-kernel-scsi-driver">Elevation of 1116 privilege vulnerability in kernel SCSI driver</h3> 1117 <p> 1118 An elevation of privilege vulnerability in the kernel SCSI driver could enable a 1119 local malicious application to execute arbitrary code within the context of the 1120 kernel. This issue is rated as Critical due to the possibility of a local 1121 permanent device compromise, which may require reflashing the operating system 1122 to repair the device. 1123 </p> 1124 <table> 1125 <col width="19%"> 1126 <col width="20%"> 1127 <col width="10%"> 1128 <col width="23%"> 1129 <col width="17%"> 1130 <tr> 1131 <th>CVE</th> 1132 <th>References</th> 1133 <th>Severity</th> 1134 <th>Updated Google devices</th> 1135 <th>Date reported</th> 1136 </tr> 1137 <tr> 1138 <td>CVE-2015-8962</td> 1139 <td>A-30951599 1140 <br> 1141 <a 1142 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3951a3709ff50990bf3e188c27d346792103432">Upstream 1143 kernel</a></td> 1144 <td>Critical</td> 1145 <td>Pixel, Pixel XL</td> 1146 <td>Oct 30, 2015</td> 1147 </tr> 1148 </table> 1149 <h3 id="eop-in-kernel-media-driver">Elevation 1150 of privilege vulnerability in kernel media driver</h3> 1151 <p> 1152 An elevation of privilege vulnerability in the kernel media driver could enable 1153 a local malicious application to execute arbitrary code within the context of 1154 the kernel. This issue is rated as Critical due to the possibility of a local 1155 permanent device compromise, which may require reflashing the operating system 1156 to repair the device. 1157 </p> 1158 <table> 1159 <col width="19%"> 1160 <col width="20%"> 1161 <col width="10%"> 1162 <col width="23%"> 1163 <col width="17%"> 1164 <tr> 1165 <th>CVE</th> 1166 <th>References</th> 1167 <th>Severity</th> 1168 <th>Updated Google devices</th> 1169 <th>Date reported</th> 1170 </tr> 1171 <tr> 1172 <td>CVE-2016-7913</td> 1173 <td>A-30946097 1174 <br> 1175 <a 1176 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8dfbcc4351a0b6d2f2d77f367552f48ffefafe18">Upstream 1177 kernel</a></td> 1178 <td>Critical</td> 1179 <td>Nexus 6P, Android One, Nexus Player, Pixel, Pixel XL</td> 1180 <td>Jan 28, 2016</td> 1181 </tr> 1182 </table> 1183 <h3 id="eop-in-kernel-usb-driver">Elevation of 1184 privilege vulnerability in kernel USB driver</h3> 1185 <p> 1186 An elevation of privilege vulnerability in the kernel USB driver could enable a 1187 local malicious application to execute arbitrary code within the context of the 1188 kernel. This issue is rated as Critical due to the possibility of a local 1189 permanent device compromise, which may require reflashing the operating system 1190 to repair the device. 1191 </p> 1192 <table> 1193 <col width="19%"> 1194 <col width="20%"> 1195 <col width="10%"> 1196 <col width="23%"> 1197 <col width="17%"> 1198 <tr> 1199 <th>CVE</th> 1200 <th>References</th> 1201 <th>Severity</th> 1202 <th>Updated Google devices</th> 1203 <th>Date reported</th> 1204 </tr> 1205 <tr> 1206 <td>CVE-2016-7912</td> 1207 <td>A-30950866 1208 <br> 1209 <a 1210 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=38740a5b87d53ceb89eb2c970150f6e94e00373a">Upstream 1211 kernel</a></td> 1212 <td>Critical</td> 1213 <td>Pixel C, Pixel, Pixel XL</td> 1214 <td>Apr 14, 2016</td> 1215 </tr> 1216 </table> 1217 <h3 id="eop-in-kernel-ion-subsystem">Elevation 1218 of privilege vulnerability in kernel ION subsystem</h3> 1219 <p> 1220 An elevation of privilege vulnerability in the kernel ION subsystem could enable 1221 a local malicious application to execute arbitrary code within the context of 1222 the kernel. This issue is rated as Critical due to the possibility of a local 1223 permanent device compromise, which may require reflashing the operating system 1224 to repair the device. 1225 </p> 1226 <table> 1227 <col width="19%"> 1228 <col width="20%"> 1229 <col width="10%"> 1230 <col width="23%"> 1231 <col width="17%"> 1232 <tr> 1233 <th>CVE</th> 1234 <th>References</th> 1235 <th>Severity</th> 1236 <th>Updated Google devices</th> 1237 <th>Date reported</th> 1238 </tr> 1239 <tr> 1240 <td>CVE-2016-6728</td> 1241 <td>A-30400942*</td> 1242 <td>Critical</td> 1243 <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, 1244 Android One</td> 1245 <td>Jul 25, 2016</td> 1246 </tr> 1247 </table> 1248 <p> 1249 * The patch for this issue is not publicly available. The update is contained in 1250 the latest binary drivers for Google devices available from the <a 1251 href="https://developers.google.com/android/nexus/drivers">Google Developer 1252 site</a>. 1253 </p> 1254 <h3 id="eop-in-qualcomm-bootloader">Elevation 1255 of privilege vulnerability in Qualcomm bootloader</h3> 1256 <p> 1257 An elevation of privilege vulnerability in the Qualcomm bootloader could enable 1258 a local malicious application to execute arbitrary code within the context of 1259 the kernel. This issue is rated as Critical due to the possibility of a local 1260 permanent device compromise, which may require reflashing the operating system 1261 to repair the device. 1262 </p> 1263 <table> 1264 <col width="19%"> 1265 <col width="20%"> 1266 <col width="10%"> 1267 <col width="23%"> 1268 <col width="17%"> 1269 <tr> 1270 <th>CVE</th> 1271 <th>References</th> 1272 <th>Severity</th> 1273 <th>Updated Google devices</th> 1274 <th>Date reported</th> 1275 </tr> 1276 <tr> 1277 <td>CVE-2016-6729</td> 1278 <td>A-30977990* 1279 <br> 1280 QC-CR#977684</td> 1281 <td>Critical</td> 1282 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1283 <td>Jul 25, 2016</td> 1284 </tr> 1285 </table> 1286 <p> 1287 * The patch for this issue is not publicly available. The update is contained in 1288 the latest binary drivers for Google devices available from the <a 1289 href="https://developers.google.com/android/nexus/drivers">Google Developer 1290 site</a>. 1291 </p> 1292 <h3 id="eop-in-nvidia-gpu-driver">Elevation of 1293 privilege vulnerability in NVIDIA GPU driver</h3> 1294 <p> 1295 An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a 1296 local malicious application to execute arbitrary code within the context of the 1297 kernel. This issue is rated as Critical due to the possibility of a local 1298 permanent device compromise, which may require reflashing the operating system 1299 to repair the device. 1300 </p> 1301 <table> 1302 <col width="19%"> 1303 <col width="20%"> 1304 <col width="10%"> 1305 <col width="23%"> 1306 <col width="17%"> 1307 <tr> 1308 <th>CVE</th> 1309 <th>References</th> 1310 <th>Severity</th> 1311 <th>Updated Google devices</th> 1312 <th>Date reported</th> 1313 </tr> 1314 <tr> 1315 <td>CVE-2016-6730</td> 1316 <td>A-30904789*<br> 1317 N-CVE-2016-6730</td> 1318 <td>Critical</td> 1319 <td>Pixel C</td> 1320 <td>Aug 16, 2016</td> 1321 </tr> 1322 <tr> 1323 <td>CVE-2016-6731</td> 1324 <td>A-30906023*<br> 1325 N-CVE-2016-6731</td> 1326 <td>Critical</td> 1327 <td>Pixel C</td> 1328 <td>Aug 16, 2016</td> 1329 </tr> 1330 <tr> 1331 <td>CVE-2016-6732</td> 1332 <td>A-30906599*<br> 1333 N-CVE-2016-6732</td> 1334 <td>Critical</td> 1335 <td>Pixel C</td> 1336 <td>Aug 16, 2016</td> 1337 </tr> 1338 <tr> 1339 <td>CVE-2016-6733</td> 1340 <td>A-30906694*<br> 1341 N-CVE-2016-6733</td> 1342 <td>Critical</td> 1343 <td>Pixel C</td> 1344 <td>Aug 16, 2016</td> 1345 </tr> 1346 <tr> 1347 <td>CVE-2016-6734</td> 1348 <td>A-30907120*<br> 1349 N-CVE-2016-6734</td> 1350 <td>Critical</td> 1351 <td>Pixel C</td> 1352 <td>Aug 16, 2016</td> 1353 </tr> 1354 <tr> 1355 <td>CVE-2016-6735</td> 1356 <td>A-30907701*<br> 1357 N-CVE-2016-6735</td> 1358 <td>Critical</td> 1359 <td>Pixel C</td> 1360 <td>Aug 16, 2016</td> 1361 </tr> 1362 <tr> 1363 <td>CVE-2016-6736</td> 1364 <td>A-30953284*<br> 1365 N-CVE-2016-6736</td> 1366 <td>Critical</td> 1367 <td>Pixel C</td> 1368 <td>Aug 18, 2016</td> 1369 </tr> 1370 </table> 1371 <p> 1372 * The patch for this issue is not publicly available. The update is contained in 1373 the latest binary drivers for Google devices available from the <a 1374 href="https://developers.google.com/android/nexus/drivers">Google Developer 1375 site</a>. 1376 </p> 1377 <h3 1378 id="eop-in-kernel-networking-subsystem">Elevation 1379 of privilege vulnerability in kernel networking subsystem</h3> 1380 <p> 1381 An elevation of privilege vulnerability in the kernel networking subsystem could 1382 enable a local malicious application to execute arbitrary code within the 1383 context of the kernel. This issue is rated as Critical due to the possibility of 1384 a local permanent device compromise, which may require reflashing the operating 1385 system to repair the device. 1386 </p> 1387 <table> 1388 <col width="19%"> 1389 <col width="20%"> 1390 <col width="10%"> 1391 <col width="23%"> 1392 <col width="17%"> 1393 <tr> 1394 <th>CVE</th> 1395 <th>References</th> 1396 <th>Severity</th> 1397 <th>Updated Google devices</th> 1398 <th>Date reported</th> 1399 </tr> 1400 <tr> 1401 <td>CVE-2016-6828</td> 1402 <td>A-31183296 1403 <br> 1404 <a 1405 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/include/net/tcp.h?id=bb1fceca22492109be12640d49f5ea5a544c6bb4">Upstream 1406 kernel</a></td> 1407 <td>Critical</td> 1408 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1409 Pixel, Pixel XL</td> 1410 <td>Aug 18, 2016</td> 1411 </tr> 1412 </table> 1413 <h3 1414 id="eop-in-kernel-sound-subsystem">Elevation of 1415 privilege vulnerability in kernel sound subsystem</h3> 1416 <p> 1417 An elevation of privilege vulnerability in the kernel sound subsystem could 1418 enable a local malicious application to execute arbitrary code within the 1419 context of the kernel. This issue is rated as Critical due to the possibility of 1420 a local permanent device compromise, which may require reflashing the operating 1421 system to repair the device. 1422 </p> 1423 <table> 1424 <col width="19%"> 1425 <col width="20%"> 1426 <col width="10%"> 1427 <col width="23%"> 1428 <col width="17%"> 1429 <tr> 1430 <th>CVE</th> 1431 <th>References</th> 1432 <th>Severity</th> 1433 <th>Updated Google devices</th> 1434 <th>Date reported</th> 1435 </tr> 1436 <tr> 1437 <td>CVE-2016-2184</td> 1438 <td>A-30952477 1439 <br> 1440 <a 1441 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=836b34a935abc91e13e63053d0a83b24dfb5ea78">Upstream 1442 kernel</a></td> 1443 <td>Critical</td> 1444 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1445 Pixel, Pixel XL</td> 1446 <td>Mar 31, 2016</td> 1447 </tr> 1448 </table> 1449 <h3 id="eop-in-kernel-ion-subsystem-1">Elevation 1450 of privilege vulnerability in kernel ION subsystem</h3> 1451 <p> 1452 An elevation of privilege vulnerability in the kernel ION subsystem could enable 1453 a local malicious application to execute arbitrary code within the context of 1454 the kernel. This issue is rated as Critical due to the possibility of a local 1455 permanent device compromise, which may require reflashing the operating system 1456 to repair the device. 1457 </p> 1458 <table> 1459 <col width="19%"> 1460 <col width="20%"> 1461 <col width="10%"> 1462 <col width="23%"> 1463 <col width="17%"> 1464 <tr> 1465 <th>CVE</th> 1466 <th>References</th> 1467 <th>Severity</th> 1468 <th>Updated Google devices</th> 1469 <th>Date reported</th> 1470 </tr> 1471 <tr> 1472 <td>CVE-2016-6737</td> 1473 <td>A-30928456*</td> 1474 <td>Critical</td> 1475 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel C, Nexus Player, Pixel, 1476 Pixel XL</td> 1477 <td>Google internal</td> 1478 </tr> 1479 </table> 1480 <p> 1481 * The patch for this issue is not publicly available. The update is contained in 1482 the latest binary drivers for Google devices available from the <a 1483 href="https://developers.google.com/android/nexus/drivers">Google Developer 1484 site</a>. 1485 </p> 1486 <h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm 1487 components</h3> 1488 <p> 1489 The table below contains security vulnerabilities affecting Qualcomm components 1490 and are described in further detail in Qualcomm AMSS June 2016 security 1491 bulletin and Security Alert 80-NV606-17. 1492 </p> 1493 <table> 1494 <col width="19%"> 1495 <col width="20%"> 1496 <col width="10%"> 1497 <col width="23%"> 1498 <col width="17%"> 1499 <tr> 1500 <th>CVE</th> 1501 <th>References</th> 1502 <th>Severity*</th> 1503 <th>Updated Google devices</th> 1504 <th>Date reported</th> 1505 </tr> 1506 <tr> 1507 <td>CVE-2016-6727</td> 1508 <td>A-31092400**</td> 1509 <td>Critical</td> 1510 <td>Android One</td> 1511 <td>Qualcomm internal</td> 1512 </tr> 1513 <tr> 1514 <td>CVE-2016-6726</td> 1515 <td>A-30775830**</td> 1516 <td>High</td> 1517 <td>Nexus 6, Android One</td> 1518 <td>Qualcomm internal</td> 1519 </tr> 1520 </table> 1521 <p>* The severity rating for these vulnerabilities was determined by the vendor.</p> 1522 <p> 1523 ** The patch for this issue is not publicly available. The update is contained in 1524 the latest binary drivers for Google devices available from the <a 1525 href="https://developers.google.com/android/nexus/drivers">Google Developer 1526 site</a>. 1527 </p> 1528 <h3 id="rce-in-expat">Remote code execution 1529 vulnerability in Expat</h3> 1530 <p> 1531 The table below contains security vulnerabilities affecting the Expat library. 1532 The most severe of these issues is an elevation of privilege vulnerability in 1533 the Expat XML parser, which could enable an attacker using a specially crafted 1534 file to execute arbitrary code in an unprivileged process. This issue is rated 1535 as High due to the possibility of arbitrary code execution in an application 1536 that uses Expat. 1537 </p> 1538 <table> 1539 <col width="18%"> 1540 <col width="18%"> 1541 <col width="10%"> 1542 <col width="19%"> 1543 <col width="17%"> 1544 <col width="17%"> 1545 <tr> 1546 <th>CVE</th> 1547 <th>References</th> 1548 <th>Severity</th> 1549 <th>Updated Google devices</th> 1550 <th>Updated AOSP versions</th> 1551 <th>Date reported</th> 1552 </tr> 1553 1554 <tr> 1555 <td>CVE-2016-0718</td> 1556 <td><a href="https://android.googlesource.com/platform/external/expat/+/52ac633b73856ded34b33bd4adb4ab793bbbe963"> 1557 A-28698301</a></td> 1558 <td>High</td> 1559 <td>None*</td> 1560 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 1561 <td>May 10, 2016</td> 1562 </tr> 1563 <tr> 1564 <td>CVE-2012-6702</td> 1565 <td><a href="https://android.googlesource.com/platform/external/expat/+/a11ff32280a863bff93df13ad643912ad9bf1302"> 1566 A-29149404</a></td> 1567 <td>Moderate</td> 1568 <td>None*</td> 1569 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 1570 <td>Mar 06, 2016</td> 1571 </tr> 1572 <tr> 1573 <td>CVE-2016-5300</td> 1574 <td><a href="https://android.googlesource.com/platform/external/expat/+/a11ff32280a863bff93df13ad643912ad9bf1302"> 1575 A-29149404</a></td> 1576 <td>Moderate</td> 1577 <td>None*</td> 1578 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 1579 <td>Jun 04, 2016</td> 1580 </tr> 1581 <tr> 1582 <td>CVE-2015-1283</td> 1583 <td><a href="https://android.googlesource.com/platform/external/expat/+/13b40c2040a17038b63a61e2b112c634da203d3b"> 1584 A-27818751</a></td> 1585 <td>Low</td> 1586 <td>None*</td> 1587 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 1588 <td>Jul 24, 2015</td> 1589 </tr> 1590 </table> 1591 1592 <p> 1593 * Supported Google devices on Android 7.0 or later that have installed all 1594 available updates are not affected by this vulnerability. 1595 </p> 1596 <h3 id="rce-in-webview">Remote code execution vulnerability in Webview</h3> 1597 <p> 1598 A remote code execution vulnerability in Webview could enable a remote attacker 1599 to execute arbitrary code when the user is navigating to a website. This issue 1600 is rated as High due to the possibility of remote code execution in an 1601 unprivileged process. 1602 </p> 1603 <table> 1604 <col width="18%"> 1605 <col width="18%"> 1606 <col width="10%"> 1607 <col width="19%"> 1608 <col width="17%"> 1609 <col width="17%"> 1610 <tr> 1611 <th>CVE</th> 1612 <th>References</th> 1613 <th>Severity</th> 1614 <th>Updated Google devices</th> 1615 <th>Updated AOSP versions</th> 1616 <th>Date reported</th> 1617 </tr> 1618 <tr> 1619 <td>CVE-2016-6754</td> 1620 <td>A-31217937</td> 1621 <td>High</td> 1622 <td>None*</td> 1623 <td>5.0.2, 5.1.1, 6.0, 6.0.1</td> 1624 <td>Aug 23, 2016</td> 1625 </tr> 1626 </table> 1627 <p> 1628 * Supported Google devices on Android 7.0 or later that have installed all 1629 available updates are not affected by this vulnerability. 1630 </p> 1631 <h3 id="rce-in-freetype">Remote code execution 1632 vulnerability in Freetype</h3> 1633 <p> 1634 A remote code execution vulnerability in Freetype could enable a local malicious 1635 application to load a specially crafted font to cause memory corruption in an 1636 unprivileged process. This issue is rated as High due to the possibility of 1637 remote code execution in applications that use Freetype. 1638 </p> 1639 <table> 1640 <col width="18%"> 1641 <col width="18%"> 1642 <col width="10%"> 1643 <col width="19%"> 1644 <col width="17%"> 1645 <col width="17%"> 1646 <tr> 1647 <th>CVE</th> 1648 <th>References</th> 1649 <th>Severity</th> 1650 <th>Updated Google devices</th> 1651 <th>Updated AOSP versions</th> 1652 <th>Date reported</th> 1653 </tr> 1654 <tr> 1655 <td>CVE-2014-9675</td> 1656 <td><a href="https://android.googlesource.com/platform/external/freetype/+/f720f0dbcf012d6c984dbbefa0875ef9840458c6"> 1657 A-24296662</a> 1658 [<a href="https://android.googlesource.com/platform/external/pdfium/+/96f965ff7411f1edba72140fd70740e63cabec71">2</a>] 1659 </td> 1660 <td>High</td> 1661 <td>None*</td> 1662 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td> 1663 <td>Google internal</td> 1664 </tr> 1665 </table> 1666 <p> 1667 * Supported Google devices on Android 7.0 or later that have installed all 1668 available updates are not affected by this vulnerability. 1669 </p> 1670 <h3 1671 id="eop-in-kernel-performance-subsystem">Elevation 1672 of privilege vulnerability in kernel performance subsystem</h3> 1673 <p> 1674 An elevation of privilege vulnerability in the kernel performance subsystem 1675 could enable a local malicious application to execute arbitrary code within the 1676 context of the kernel. This issue is rated as High because it first requires 1677 compromising a privileged process. 1678 </p> 1679 <table> 1680 <col width="19%"> 1681 <col width="20%"> 1682 <col width="10%"> 1683 <col width="23%"> 1684 <col width="17%"> 1685 <tr> 1686 <th>CVE</th> 1687 <th>References</th> 1688 <th>Severity</th> 1689 <th>Updated Google devices</th> 1690 <th>Date reported</th> 1691 </tr> 1692 <tr> 1693 <td>CVE-2015-8963</td> 1694 <td>A-30952077 1695 <br> 1696 <a 1697 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=12ca6ad2e3a896256f086497a7c7406a547ee373">Upstream 1698 kernel</a></td> 1699 <td>High</td> 1700 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1701 Pixel, Pixel XL</td> 1702 <td>Dec 15, 2015</td> 1703 </tr> 1704 </table> 1705 <h3 1706 id="eop-in-kernel-system-call-auditing-subsystem">Elevation 1707 of privilege vulnerability in kernel system-call auditing subsystem</h3> 1708 <p> 1709 An elevation of privilege vulnerability in the kernel system-call auditing 1710 subsystem could enable a local malicious application to disrupt system-call 1711 auditing in the kernel. This issue is rated as High because it is a general 1712 bypass for a kernel-level defense in depth or exploit mitigation technology. 1713 </p> 1714 <table> 1715 <col width="19%"> 1716 <col width="20%"> 1717 <col width="10%"> 1718 <col width="23%"> 1719 <col width="17%"> 1720 <tr> 1721 <th>CVE</th> 1722 <th>References</th> 1723 <th>Severity</th> 1724 <th>Updated Google devices</th> 1725 <th>Date reported</th> 1726 </tr> 1727 <tr> 1728 <td>CVE-2016-6136</td> 1729 <td>A-30956807 1730 <br> 1731 <a 1732 href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=43761473c254b45883a64441dd0bc85a42f3645c">Upstream 1733 kernel</a></td> 1734 <td>High</td> 1735 <td>Android One, Pixel C, Nexus Player</td> 1736 <td>Jul 1, 2016</td> 1737 </tr> 1738 </table> 1739 <h3 1740 id="eop-in-qualcomm-crypto-engine-driver">Elevation 1741 of privilege vulnerability in Qualcomm crypto engine driver</h3> 1742 <p> 1743 An elevation of privilege vulnerability in the Qualcomm crypto engine driver 1744 could enable a local malicious application to execute arbitrary code within the 1745 context of the kernel. This issue is rated as High because it first requires 1746 compromising a privileged process. 1747 </p> 1748 <table> 1749 <col width="19%"> 1750 <col width="20%"> 1751 <col width="10%"> 1752 <col width="23%"> 1753 <col width="17%"> 1754 <tr> 1755 <th>CVE</th> 1756 <th>References</th> 1757 <th>Severity</th> 1758 <th>Updated Google devices</th> 1759 <th>Date reported</th> 1760 </tr> 1761 <tr> 1762 <td>CVE-2016-6738</td> 1763 <td>A-30034511 1764 <br> 1765 <a 1766 href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=a829c54236b455885c3e9c7c77ac528b62045e79">QC-CR#1050538</a></td> 1767 <td>High</td> 1768 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1769 <td>Jul 7, 2016</td> 1770 </tr> 1771 </table> 1772 <h3 1773 id="eop-in-qualcomm-camera-driver">Elevation of 1774 privilege vulnerability in Qualcomm camera driver</h3> 1775 <p> 1776 An elevation of privilege vulnerability in the Qualcomm camera driver could 1777 enable a local malicious application to execute arbitrary code within the 1778 context of the kernel. This issue is rated as High because it first requires 1779 compromising a privileged process. 1780 </p> 1781 <table> 1782 <col width="19%"> 1783 <col width="20%"> 1784 <col width="10%"> 1785 <col width="23%"> 1786 <col width="17%"> 1787 <tr> 1788 <th>CVE</th> 1789 <th>References</th> 1790 <th>Severity</th> 1791 <th>Updated Google devices</th> 1792 <th>Date reported</th> 1793 </tr> 1794 <tr> 1795 <td>CVE-2016-6739</td> 1796 <td>A-30074605*<br> 1797 QC-CR#1049826</td> 1798 <td>High</td> 1799 <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td> 1800 <td>Jul 11, 2016</td> 1801 </tr> 1802 <tr> 1803 <td>CVE-2016-6740</td> 1804 <td>A-30143904 1805 <br> 1806 <a 1807 href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=ef78bd62f0c064ae4c827e158d828b2c110ebcdc">QC-CR#1056307</a></td> 1808 <td>High</td> 1809 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1810 <td>Jul 12, 2016</td> 1811 </tr> 1812 <tr> 1813 <td>CVE-2016-6741</td> 1814 <td>A-30559423 1815 <br> 1816 <a 1817 href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=d291eebd8e43bba3229ae7ef9146a132894dc293">QC-CR#1060554</a></td> 1818 <td>High</td> 1819 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1820 <td>Jul 28, 2016</td> 1821 </tr> 1822 </table> 1823 <p> 1824 * The patch for this issue is not publicly available. The update is contained in 1825 the latest binary drivers for Google devices available from the <a 1826 href="https://developers.google.com/android/nexus/drivers">Google Developer 1827 site</a>. 1828 </p> 1829 <h3 id="eop-in-qualcomm-bus-driver">Elevation 1830 of privilege vulnerability in Qualcomm bus driver</h3> 1831 <p> 1832 An elevation of privilege vulnerability in the Qualcomm bus driver could enable 1833 a local malicious application to execute arbitrary code within the context of 1834 the kernel. This issue is rated as High because it first requires compromising a 1835 privileged process. 1836 </p> 1837 <table> 1838 <col width="19%"> 1839 <col width="20%"> 1840 <col width="10%"> 1841 <col width="23%"> 1842 <col width="17%"> 1843 <tr> 1844 <th>CVE</th> 1845 <th>References</th> 1846 <th>Severity</th> 1847 <th>Updated Google devices</th> 1848 <th>Date reported</th> 1849 </tr> 1850 <tr> 1851 <td>CVE-2016-3904</td> 1852 <td>A-30311977 1853 <br> 1854 <a 1855 href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=069683407ca9a820d05c914b57c587bcd3f16a3a">QC-CR#1050455</a></td> 1856 <td>High</td> 1857 <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td> 1858 <td>Jul 22, 2016</td> 1859 </tr> 1860 </table> 1861 <h3 1862 id="eop-in-synaptics-touchscreen-driver">Elevation 1863 of privilege vulnerability in Synaptics touchscreen driver</h3> 1864 <p> 1865 An elevation of privilege vulnerability in the Synaptics touchscreen driver 1866 could enable a local malicious application to execute arbitrary code within the 1867 context of the kernel. This issue is rated as High because it first requires 1868 compromising a privileged process. 1869 </p> 1870 <table> 1871 <col width="19%"> 1872 <col width="20%"> 1873 <col width="10%"> 1874 <col width="23%"> 1875 <col width="17%"> 1876 <tr> 1877 <th>CVE</th> 1878 <th>References</th> 1879 <th>Severity</th> 1880 <th>Updated Google devices</th> 1881 <th>Date reported</th> 1882 </tr> 1883 <tr> 1884 <td>CVE-2016-6742</td> 1885 <td>A-30799828*</td> 1886 <td>High</td> 1887 <td>Nexus 5X, Android One</td> 1888 <td>Aug 9, 2016</td> 1889 </tr> 1890 <tr> 1891 <td>CVE-2016-6744</td> 1892 <td>A-30970485*</td> 1893 <td>High</td> 1894 <td>Nexus 5X</td> 1895 <td>Aug 19, 2016</td> 1896 </tr> 1897 <tr> 1898 <td>CVE-2016-6745</td> 1899 <td>A-31252388*</td> 1900 <td>High</td> 1901 <td>Nexus 5X, Nexus 6P, Nexus 9, Android One, Pixel, Pixel XL</td> 1902 <td>Sep 1, 2016</td> 1903 </tr> 1904 <tr> 1905 <td>CVE-2016-6743</td> 1906 <td>A-30937462*</td> 1907 <td>High</td> 1908 <td>Nexus 9, Android One</td> 1909 <td>Google internal</td> 1910 </tr> 1911 </table> 1912 <p> 1913 * The patch for this issue is not publicly available. The update is contained in 1914 the latest binary drivers for Google devices available from the <a 1915 href="https://developers.google.com/android/nexus/drivers">Google Developer 1916 site</a>. 1917 </p> 1918 <h3 id="id-in-kernel-components">Information 1919 disclosure vulnerability in kernel components</h3> 1920 <p> 1921 An information disclosure vulnerability in kernel components, including the 1922 human interface device driver, file system, and Teletype driver, could enable a 1923 local malicious application to access data outside of its permission levels. 1924 This issue is rated as High because it could be used to access sensitive data 1925 without explicit user permission. 1926 </p> 1927 <table> 1928 <col width="19%"> 1929 <col width="20%"> 1930 <col width="10%"> 1931 <col width="23%"> 1932 <col width="17%"> 1933 <tr> 1934 <th>CVE</th> 1935 <th>References</th> 1936 <th>Severity</th> 1937 <th>Updated Google devices</th> 1938 <th>Date reported</th> 1939 </tr> 1940 <tr> 1941 <td>CVE-2015-8964</td> 1942 <td>A-30951112 1943 <br> 1944 <a 1945 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=dd42bf1197144ede075a9d4793123f7689e164bc">Upstream 1946 kernel</a></td> 1947 <td>High</td> 1948 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1949 Pixel, Pixel XL</td> 1950 <td>Nov 27, 2015</td> 1951 </tr> 1952 <tr> 1953 <td>CVE-2016-7915</td> 1954 <td>A-30951261 1955 <br> 1956 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=50220dead1650609206efe91f0cc116132d59b3f">Upstream 1957 kernel</a></td> 1958 <td>High</td> 1959 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1960 Pixel, Pixel XL</td> 1961 <td>Jan 19, 2016</td> 1962 </tr> 1963 <tr> 1964 <td>CVE-2016-7914</td> 1965 <td>A-30513364 1966 <br> 1967 <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2">Upstream 1968 kernel</a></td> 1969 <td>High</td> 1970 <td>Pixel C, Pixel, Pixel XL</td> 1971 <td>Apr 06, 2016</td> 1972 </tr> 1973 <tr> 1974 <td>CVE-2016-7916</td> 1975 <td>A-30951939 1976 <br> 1977 <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8148a73c9901a8794a50f950083c00ccf97d43b3">Upstream 1978 kernel</a></td> 1979 <td>High</td> 1980 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player, 1981 Pixel, Pixel XL</td> 1982 <td>May 05, 2016</td> 1983 </tr> 1984 </table> 1985 <h3 id="id-in-nvidia-gpu-driver">Information 1986 disclosure vulnerability in NVIDIA GPU driver</h3> 1987 <p> 1988 An information disclosure vulnerability in the NVIDIA GPU driver could enable a 1989 local malicious application to access data outside of its permission levels. 1990 This issue is rated as High because it could be used to access sensitive data 1991 without explicit user permission. 1992 </p> 1993 <table> 1994 <col width="19%"> 1995 <col width="20%"> 1996 <col width="10%"> 1997 <col width="23%"> 1998 <col width="17%"> 1999 <tr> 2000 <th>CVE</th> 2001 <th>References</th> 2002 <th>Severity</th> 2003 <th>Updated Google devices</th> 2004 <th>Date reported</th> 2005 </tr> 2006 <tr> 2007 <td>CVE-2016-6746</td> 2008 <td>A-30955105*<br> 2009 N-CVE-2016-6746</td> 2010 <td>High</td> 2011 <td>Pixel C</td> 2012 <td>Aug 18, 2016</td> 2013 </tr> 2014 </table> 2015 <p> 2016 * The patch for this issue is not publicly available. The update is contained in 2017 the latest binary drivers for Google devices available from the <a 2018 href="https://developers.google.com/android/nexus/drivers">Google Developer 2019 site</a>. 2020 </p> 2021 <h3 id="dos-in-mediaserver-1">Denial of service vulnerability in Mediaserver</h3> 2022 <p> 2023 A denial of service vulnerability in Mediaserver could enable an attacker to use 2024 a specially crafted file to cause a device hang or reboot. This issue is rated 2025 as High due to the possibility of remote denial of service. 2026 </p> 2027 <table> 2028 <col width="19%"> 2029 <col width="20%"> 2030 <col width="10%"> 2031 <col width="23%"> 2032 <col width="17%"> 2033 <tr> 2034 <th>CVE</th> 2035 <th>References</th> 2036 <th>Severity</th> 2037 <th>Updated Google devices</th> 2038 <th>Date reported</th> 2039 </tr> 2040 <tr> 2041 <td>CVE-2016-6747</td> 2042 <td>A-31244612*<br> 2043 N-CVE-2016-6747</td> 2044 <td>High</td> 2045 <td>Nexus 9</td> 2046 <td>Google internal</td> 2047 </tr> 2048 </table> 2049 <p> 2050 * The patch for this issue is not publicly available. The update is contained in 2051 the latest binary drivers for Google devices available from the <a 2052 href="https://developers.google.com/android/nexus/drivers">Google Developer 2053 site</a>. 2054 </p> 2055 <h3 id="id-in-kernel-components-1">Information disclosure vulnerability in 2056 kernel components</h3> 2057 <p> 2058 An information disclosure vulnerability in kernel components, including the 2059 process-grouping subsystem and the networking subsystem, could enable a local 2060 malicious application to access data outside of its permission levels. This 2061 issue is rated as Moderate because it first requires compromising a privileged 2062 process. 2063 </p> 2064 <table> 2065 <col width="19%"> 2066 <col width="20%"> 2067 <col width="10%"> 2068 <col width="23%"> 2069 <col width="17%"> 2070 <tr> 2071 <th>CVE</th> 2072 <th>References</th> 2073 <th>Severity</th> 2074 <th>Updated Google devices</th> 2075 <th>Date reported</th> 2076 </tr> 2077 <tr> 2078 <td>CVE-2016-7917</td> 2079 <td>A-30947055 2080 <br> 2081 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c58d6c93680f28ac58984af61d0a7ebf4319c241">Upstream 2082 kernel</a></td> 2083 <td>Moderate</td> 2084 <td>Pixel C, Pixel, Pixel XL</td> 2085 <td>Feb 02, 2016</td> 2086 </tr> 2087 <tr> 2088 <td>CVE-2016-6753</td> 2089 <td>A-30149174*</td> 2090 <td>Moderate</td> 2091 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Pixel C, Nexus Player, Pixel, Pixel 2092 XL</td> 2093 <td>Jul 13, 2016</td> 2094 </tr> 2095 </table> 2096 <p> 2097 * The patch for this issue is not publicly available. The update is contained in 2098 the latest binary drivers for Google devices available from the <a 2099 href="https://developers.google.com/android/nexus/drivers">Google Developer 2100 site</a>. 2101 </p> 2102 <h3 id="id-in-qualcomm-components">Information 2103 disclosure vulnerability in Qualcomm components</h3> 2104 <p> 2105 An information disclosure vulnerability in Qualcomm components including the GPU 2106 driver, power driver, SMSM Point-to-Point driver, and sound driver, could enable 2107 a local malicious application to access data outside of its permission levels. 2108 This issue is rated as Moderate because it first requires compromising a 2109 privileged process. 2110 </p> 2111 <table> 2112 <col width="19%"> 2113 <col width="20%"> 2114 <col width="10%"> 2115 <col width="23%"> 2116 <col width="17%"> 2117 <tr> 2118 <th>CVE</th> 2119 <th>References</th> 2120 <th>Severity</th> 2121 <th>Updated Google devices</th> 2122 <th>Date reported</th> 2123 </tr> 2124 <tr> 2125 <td>CVE-2016-6748</td> 2126 <td>A-30076504 2127 <br> 2128 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=be651d020b122a1ba9410d23ca4ebbe9f5598df6">QC-CR#987018</a></td> 2129 <td>Moderate</td> 2130 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 2131 <td>Jul 12, 2016</td> 2132 </tr> 2133 <tr> 2134 <td>CVE-2016-6749</td> 2135 <td>A-30228438 2136 <br> 2137 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=f9185dc83b92e7d1ee341e32e8cf5ed00a7253a7">QC-CR#1052818</a></td> 2138 <td>Moderate</td> 2139 <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td> 2140 <td>Jul 12, 2016</td> 2141 </tr> 2142 <tr> 2143 <td>CVE-2016-6750</td> 2144 <td>A-30312054 2145 <br> 2146 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=34bda711a1c7bc7f9fd7bea3a5be439ed00577e5">QC-CR#1052825</a></td> 2147 <td>Moderate</td> 2148 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 2149 <td>Jul 21, 2016</td> 2150 </tr> 2151 <tr> 2152 <td>CVE-2016-3906</td> 2153 <td>A-30445973 2154 <br> 2155 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b333d32745fec4fb1098ee1a03d4425f3c1b4c2e">QC-CR#1054344</a></td> 2156 <td>Moderate</td> 2157 <td>Nexus 5X, Nexus 6P</td> 2158 <td>Jul 27, 2016</td> 2159 </tr> 2160 <tr> 2161 <td>CVE-2016-3907</td> 2162 <td>A-30593266 2163 <br> 2164 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=744330f4e5d70dce71c4c9e03c5b6a8b59bb0cda">QC-CR#1054352</a></td> 2165 <td>Moderate</td> 2166 <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td> 2167 <td>Aug 2, 2016</td> 2168 </tr> 2169 <tr> 2170 <td>CVE-2016-6698</td> 2171 <td>A-30741851 2172 <br> 2173 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=de90beb76ad0b80da821c3b857dd30cd36319e61">QC-CR#1058826</a></td> 2174 <td>Moderate</td> 2175 <td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td> 2176 <td>Aug 2, 2016</td> 2177 </tr> 2178 <tr> 2179 <td>CVE-2016-6751</td> 2180 <td>A-30902162*<br> 2181 QC-CR#1062271</td> 2182 <td>Moderate</td> 2183 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 2184 <td>Aug 15, 2016</td> 2185 </tr> 2186 <tr> 2187 <td>CVE-2016-6752</td> 2188 <td>A-31498159 2189 <br> 2190 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?h=0de2c7600c8f1f0152a2f421c6593f931186400a">QC-CR#987051</a></td> 2191 <td>Moderate</td> 2192 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 2193 <td>Google internal</td> 2194 </tr> 2195 </table> 2196 <p> 2197 * The patch for this issue is not publicly available. The update is contained in 2198 the latest binary drivers for Google devices available from the <a 2199 href="https://developers.google.com/android/nexus/drivers">Google Developer 2200 site</a>. 2201 </p> 2202 2203 <h2 id="2016-11-06-details">2016-11-06 security patch levelVulnerability details</h2> 2204 <p> 2205 In the sections below, we provide details for each of the security 2206 vulnerabilities listed in the 2207 <a href="#2016-11-06-summary">2016-11-06 security patch levelVulnerability 2208 summary</a> above. There is a description of 2209 the issue, a severity rationale, and a table with the CVE, associated 2210 references, severity, updated Google devices, updated AOSP versions (where 2211 applicable), and date reported. When available, we will link the public change 2212 that addressed the issue to the bug ID, like the AOSP change list. When multiple 2213 changes relate to a single bug, additional references are linked to numbers 2214 following the bug ID. 2215 </p> 2216 <h3 2217 id="eop-in-kernel-memory-subsystem">Elevation 2218 of privilege vulnerability in kernel memory subsystem</h3> 2219 <p> 2220 An elevation of privilege vulnerability in the kernel memory subsystem could 2221 enable a local malicious application to execute arbitrary code within the 2222 context of the kernel. This issue is rated as Critical due to the possibility of 2223 a local permanent device compromise, which may require reflashing the operating 2224 system to repair the device. 2225 </p> 2226 <p> 2227 <strong>Note:</strong> A security patch level of 2016-11-06 indicates that this 2228 issue, as well as all issues associated with 2016-11-01 and 2016-11-05 are 2229 addressed. 2230 </p> 2231 <table> 2232 <tr> 2233 <th>CVE</th> 2234 <th>References</th> 2235 <th>Severity</th> 2236 <th>Updated kernel versions</th> 2237 <th>Date reported</th> 2238 </tr> 2239 <tr> 2240 <td>CVE-2016-5195</td> 2241 <td>A-32141528<br> 2242 <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=9691eac5593ff1e2f82391ad327f21d90322aec1">Upstream kernel</a> 2243 [<a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=e45a502bdeae5a075257c4f061d1ff4ff0821354">2</a>]</td> 2244 <td>Critical</td> 2245 <td>3.10, 3.18</td> 2246 <td>Oct 12, 2016</td> 2247 </tr> 2248 </table> 2249 <h2 id="common-questions-and-answers">Common Questions and Answers</h2> 2250 <p> 2251 This section answers common questions that may occur after reading this 2252 bulletin. 2253 </p> 2254 <p> 2255 <strong>1. How do I determine if my device is updated to address these issues?</strong> 2256 </p> 2257 <p> 2258 To learn how to check a devices security patch level, read the instructions on the 2259 <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel 2260 and Nexus update schedule</a>. 2261 </p> 2262 <ul> 2263 <li>Security patch levels of 2016-11-01 or later address all issues associated 2264 with the 2016-11-01 security patch level.</li> 2265 <li>Security patch levels of 2016-11-05 or later address all issues associated 2266 with the 2016-11-05 security patch level and all previous patch levels.</li> 2267 <li>Security patch levels of 2016-11-06 or later address all issues associated 2268 with the 2016-11-06 security patch level and all previous patch 2269 levels.</li> 2270 </ul> 2271 <p> 2272 Device manufacturers that include these updates should set the patch level 2273 string to: 2274 </p> 2275 <ul> 2276 <li>[ro.build.version.security_patch]:[2016-11-01]</li> 2277 <li>[ro.build.version.security_patch]:[2016-11-05]</li> 2278 <li>[ro.build.version.security_patch]:[2016-11-06].</li> 2279 </ul> 2280 <p> 2281 <strong>2. Why does this bulletin have three security patch levels?</strong> 2282 </p> 2283 <p> 2284 This bulletin has three security patch levels so that Android partners have the 2285 flexibility to fix a subset of vulnerabilities that are similar across all 2286 Android devices more quickly. Android partners are encouraged to fix all issues 2287 in this bulletin and use the latest security patch level. 2288 </p> 2289 <ul> 2290 <li>Devices that use the November 1, 2016 security patch level must include all 2291 issues associated with that security patch level, as well as fixes for all 2292 issues reported in previous security bulletins.</li> 2293 <li>Devices that use the security patch level of November 5, 2016 or newer must 2294 include all applicable patches in this (and previous) security bulletins.</li> 2295 <li>Devices that use the security patch level of November 6, 2016 or newer must 2296 include all applicable patches in this (and previous) security 2297 bulletins.</li> 2298 </ul> 2299 <p> 2300 Partners are encouraged to bundle the fixes for all issues they are addressing 2301 in a single update. 2302 </p> 2303 <p id="google-devices"> 2304 <strong>3. How do I determine which Google devices are affected by each 2305 issue?</strong> 2306 </p> 2307 <p> 2308 In the 2309 <a href="#2016-11-01-details">2016-11-01</a>, 2310 <a href="#2016-11-05-details">2016-11-05</a>, 2311 and 2312 <a href="#2016-11-06-details">2016-11-06</a> 2313 security vulnerability details sections, each table has an <em>Updated Google 2314 devices</em> column that covers the range of affected Google devices updated for 2315 each issue. This column has a few options: 2316 </p> 2317 <ul> 2318 <li><strong>All Google devices</strong>: If an issue affects all Nexus and Pixel 2319 devices, the table will have "All" in the <em>Updated Google devices</em> 2320 column. "All" encapsulates the following 2321 <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported 2322 devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, 2323 Android One, Nexus Player, Pixel C, Pixel, and Pixel XL.</li> 2324 <li><strong>Some Google devices</strong>: If an issue doesn't affect all Google 2325 devices, the affected Google devices are listed in the <em>Updated Google 2326 devices</em> column.</li> 2327 <li><strong>No Google devices</strong>: If no Google devices running Android 7.0 2328 are affected by the issue, the table will have "None" in the <em>Updated Google 2329 devices</em> column.</li> 2330 </ul> 2331 <p> 2332 <strong>4. What do the entries in the references column map to?</strong> 2333 </p> 2334 <p> 2335 Entries under the <em>References</em> column of the vulnerability details table 2336 may contain a prefix identifying the organization to which the reference value 2337 belongs. These prefixes map as follows: 2338 </p> 2339 <table> 2340 <tr> 2341 <th>Prefix</th> 2342 <th>Reference</th> 2343 </tr> 2344 <tr> 2345 <td>A-</td> 2346 <td>Android bug ID</td> 2347 </tr> 2348 <tr> 2349 <td>QC-</td> 2350 <td>Qualcomm reference number</td> 2351 </tr> 2352 <tr> 2353 <td>M-</td> 2354 <td>MediaTek reference number</td> 2355 </tr> 2356 <tr> 2357 <td>N-</td> 2358 <td>NVIDIA reference number</td> 2359 </tr> 2360 <tr> 2361 <td>B-</td> 2362 <td>Broadcom reference number</td> 2363 </tr> 2364 </table> 2365 2366 <h2 id="revisions">Revisions</h2> 2367 <ul> 2368 <li>November 07, 2016: Bulletin published.</li> 2369 <li>November 08: Bulletin revised to include AOSP links and updated 2370 description for CVE-2016-6709.</li> 2371 <li>November 17: Bulletin revised to include attribution for CVE-2016-6828.</li> 2372 <li>December 21: Updated researcher credit.</li> 2373 </ul> 2374 2375 </body> 2376 </html> 2377
