1 <html devsite> 2 <head> 3 <title>Android Security BulletinDecember 2016</title> 4 <meta name="project_path" value="/_project.yaml" /> 5 <meta name="book_path" value="/_book.yaml" /> 6 </head> 7 <body> 8 <!-- 9 Copyright 2017 The Android Open Source Project 10 11 Licensed under the Apache License, Version 2.0 (the "License"); 12 you may not use this file except in compliance with the License. 13 You may obtain a copy of the License at 14 15 http://www.apache.org/licenses/LICENSE-2.0 16 17 Unless required by applicable law or agreed to in writing, software 18 distributed under the License is distributed on an "AS IS" BASIS, 19 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 20 See the License for the specific language governing permissions and 21 limitations under the License. 22 --> 23 24 25 26 <p><em>Published December 05, 2016 | Updated December 21, 2016</em></p> 27 <p> 28 The Android Security Bulletin contains details of security vulnerabilities 29 affecting Android devices. Alongside the bulletin, we have released a security 30 update to Google devices through an over-the-air (OTA) update. The Google device 31 firmware images have also been released to the <a 32 href="https://developers.google.com/android/nexus/images">Google Developer 33 site</a>. Security patch levels of December 05, 2016 or later address all of 34 these issues. Refer to the <a 35 href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel 36 and Nexus update schedule</a> to learn how to check a device's security patch 37 level. 38 </p> 39 <p> 40 Partners were notified of the issues described in the bulletin on November 07, 41 2016 or earlier. Source code patches for these issues have been released to the 42 Android Open Source Project (AOSP) repository and linked from this bulletin. 43 This bulletin also includes links to patches outside of AOSP. 44 </p> 45 <p> 46 The most severe of these issues are Critical security vulnerabilities in 47 device-specific code that could enable arbitrary code execution within the 48 context of the kernel, leading to the possibility of a local permanent device 49 compromise, which may require reflashing the operating system to repair the 50 device. The 51 <a href="/security/overview/updates-resources.html#severity">severity 52 assessment</a> is based on the effect that exploiting the vulnerability would 53 possibly have on an affected device, assuming the platform and service 54 mitigations are disabled for development purposes or if successfully bypassed. 55 </p> 56 <p> 57 We have had no reports of active customer exploitation or abuse of these newly 58 reported issues. Refer to the <a href="#mitigations">Android and Google service 59 mitigations</a> section for details on the <a 60 href="/security/enhancements/index.html">Android 61 security platform protections</a> and service protections such as <a 62 href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>, 63 which improve the security of the Android platform. 64 </p> 65 <p> 66 We encourage all customers to accept these updates to their devices. 67 </p> 68 <h2 id="announcements">Announcements</h2> 69 <ul> 70 <li>This bulletin has two security patch level strings to provide Android 71 partners with the flexibility to more quickly fix a subset of vulnerabilities 72 that are similar across all Android devices. See 73 <a href="#common-questions-and-answers">Common 74 questions and answers</a> for additional information: 75 <ul> 76 <li><strong>2016-12-01</strong>: Partial security patch level string. This 77 security patch level string indicates that all issues associated with 2016-12-01 78 (and all previous security patch level strings) are addressed.</li> 79 <li><strong>2016-12-05</strong>: Complete security patch level string. This 80 security patch level string indicates that all issues associated with 2016-12-01 81 and 2016-12-05 (and all previous security patch level strings) are addressed.</li> 82 </ul> 83 </li> 84 <li>Supported Google devices will receive a single OTA update with the December 85 05, 2016 security patch level.</li> 86 </ul> 87 <h2 id="mitigations">Android and Google service mitigations</h2> 88 <p> 89 This is a summary of the mitigations provided by the <a 90 href="/security/enhancements/index.html">Android 91 security platform</a> and service protections, such as SafetyNet. These 92 capabilities reduce the likelihood that security vulnerabilities could be 93 successfully exploited on Android. 94 </p> 95 <ul> 96 <li>Exploitation for many issues on Android is made more difficult by 97 enhancements in newer versions of the Android platform. We encourage all users 98 to update to the latest version of Android where possible.</li> 99 <li>The Android Security team actively monitors for abuse with 100 <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify 101 Apps and SafetyNet</a>, which are designed to warn users about 102 <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially 103 Harmful Applications</a>. Verify Apps is enabled by default on devices with <a 104 href="http://www.android.com/gms">Google Mobile Services</a> and is especially 105 important for users who install applications from outside of Google Play. Device 106 rooting tools are prohibited within Google Play, but Verify Apps warns users 107 when they attempt to install a detected rooting applicationno matter where it 108 comes from. Additionally, Verify Apps attempts to identify and block 109 installation of known malicious applications that exploit a privilege escalation 110 vulnerability. If such an application has already been installed, Verify Apps 111 will notify the user and attempt to remove the detected application.</li> 112 <li>As appropriate, Google Hangouts and Messenger applications do not 113 automatically pass media to processes such as Mediaserver.</li> 114 </ul> 115 116 <h2 id="acknowledgements">Acknowledgements</h2> 117 <p> 118 We would like to thank these researchers for their contributions: 119 </p> 120 121 <ul> 122 <li>Baozeng Ding, Chengming Yang, Peng Xiao, Ning You, Yang Dong, Chao Yang, 123 Yi Zhang, and Yang Song of Alibaba Mobile Security Group: CVE-2016-6783, 124 CVE-2016-6784, CVE-2016-6785</li> 125 <li><a href="mailto:zc1991 (a] mail.ustc.edu.cn">Chi Zhang</a>, Mingjian Zhou (<a 126 href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu (<a 127 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 128 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6789, CVE-2016-6790</li> 129 <li>Christian Seel: CVE-2016-6769</li> 130 <li>David Benjamin and Kenny Root of Google: CVE-2016-6767</li> 131 <li>Di Shen (<a href="https://twitter.com/returnsme">@returnsme</a>) of KeenLab 132 (<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2016-6776, 133 CVE-2016-6787</li> 134 <li>En He (<a href="https://twitter.com/heeeeen4x">@heeeeen4x</a>) of <a 135 href="http://www.ms509.com">MS509Team</a>: CVE-2016-6763</li> 136 <li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>), 137 <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360 Technology 138 Co. Ltd.: CVE-2016-6779, CVE-2016-6778, CVE-2016-8401, CVE-2016-8402, 139 CVE-2016-8403, CVE-2016-8409, CVE-2016-8408, CVE-2016-8404</li> 140 <li>Jianqiang Zhao (<a 141 href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and <a 142 href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360 Technology Co. 143 Ltd: CVE-2016-6788, CVE-2016-6781, CVE-2016-6782, CVE-2016-8396</li> 144 <li><a href="mailto:zlbzlb815 (a] 163.com">Lubo Zhang</a>, <a 145 href="mailto:segfault5514 (a] gmail.com">Tong Lin</a>, <a 146 href="mailto:computernik (a] gmail.com">Yuan-Tsung Lo</a>, Chiachih Wu (<a 147 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 148 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6791, CVE-2016-8391, 149 CVE-2016-8392</li> 150 <li>Mark Brand of Project Zero: CVE-2016-6772</li> 151 <li><a href="https://github.com/michalbednarski">Micha Bednarski</a>: 152 CVE-2016-6770, CVE-2016-6774</li> 153 <li>Mingjian Zhou (<a 154 href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), <a 155 href="mailto:zc1991 (a] mail.ustc.edu.cn">Chi Zhang</a>, Chiachih Wu (<a 156 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 157 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6761, CVE-2016-6759, 158 CVE-2016-8400</li> 159 <li>Mingjian Zhou (<a 160 href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu (<a 161 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 162 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6760</li> 163 <li>Mingjian Zhou (<a 164 href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), <a 165 href="mailto:arnow117 (a] gmail.com">Hanxiang Wen</a>, Chiachih Wu (<a 166 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 167 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6759</li> 168 <li>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>) of 169 Tesla Motors Product Security Team: CVE-2016-6915, CVE-2016-6916, CVE-2016-6917</li> 170 <li>Nightwatch Cybersecurity Research (<a 171 href="https://twitter.com/nightwatchcyber">@nightwatchcyber</a>): CVE-2016-5341</li> 172 <li>Pengfei Ding (), Chenfu Bao (), Lenx Wei () of Baidu X-Lab: 173 CVE-2016-6755, CVE-2016-6756</li> 174 <li>Peter Pi (<a href="https://twitter.com/heisecode">@heisecode</a>) of Trend 175 Micro: CVE-2016-8397, CVE-2016-8405, CVE-2016-8406, CVE-2016-8407</li> 176 <li>Qidan He () (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) 177 of KeenLab, Tencent (): CVE-2016-8399, CVE-2016-8395</li> 178 <li>Qidan He () (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) 179 and Marco Grassi (<a href="https://twitter.com/marcograss">@marcograss</a>) of 180 KeenLab, Tencent (): CVE-2016-6768</li> 181 <li>Richard Shupak: CVE-2016-5341</li> 182 <li>Sagi Kedmi of IBM X-Force Research: CVE-2016-8393, CVE-2016-8394</li> 183 <li>Seven Shen (<a href="https://twitter.com/lingtongshen">@lingtongshen</a>) of 184 Mobile Threat Research Team, Trend Micro Inc.: CVE-2016-6757</li> 185 <li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of 186 Alibaba Inc.: CVE-2016-6773</li> 187 <li><a href="mailto:vancouverdou (a] gmail.com">Wenke Dou</a>, <a 188 href="mailto:zc1991 (a] mail.ustc.edu.cn">Chi Zhang</a>, Chiachih Wu (<a 189 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 190 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6765</li> 191 <li>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) (<a 192 href="http://weibo.com/wishlinux"></a>) of <a 193 href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile/">Mobile 194 Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro 195 Inc.</a>: CVE-2016-6704</li> 196 <li><a href="mailto:computernik (a] gmail.com">Yuan-Tsung Lo</a>, <a 197 href="mailto:segfault5514 (a] gmail.com">Tong Lin</a>, Chiachih Wu (<a 198 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 199 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6786, CVE-2016-6780, 200 CVE-2016-6775</li> 201 <li><a href="mailto:computernik (a] gmail.com">Yuan-Tsung Lo</a>, <a 202 href="mailto:wisedd (a] gmail.com">Xiaodong Wang</a>, Chiachih Wu (<a 203 href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a 204 href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6777</li> 205 <li>Yuxiang Li of Tencent Security Platform Department: CVE-2016-6771</li> 206 <li>Zhe Jin () of Chengdu Security Response Center, Qihoo 360 Technology Co. 207 Ltd.: CVE-2016-6764, CVE-2016-6766</li> 208 <li><a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of Chengdu Security 209 Response Center of Qihoo 360 Technology Co. Ltd.: CVE-2016-6762</li> 210 </ul> 211 <p> 212 Additional thanks to thank MengLuo Gou (<a 213 href="https://twitter.com/idhyt3r">@idhyt3r</a>) of Bottle Tech, Yong Wang () 214 (<a href="https://twitter.com/ThomasKing2014">@ThomasKing2014</a>), and Zubin 215 Mithra of Google for their contributions to this security bulletin. 216 </p> 217 218 <h2 id="2016-12-01-details">2016-12-01 security patch levelVulnerability 219 details</h2> 220 <p> 221 In the sections below, we provide details for each of the security 222 vulnerabilities that apply to the 2016-12-01 patch level. There is a description of 223 the issue, a severity rationale, and a table with the CVE, associated 224 references, severity, updated Google devices, updated AOSP versions (where 225 applicable), and date reported. When available, we will link the public change 226 that addressed the issue to the bug ID, like the AOSP change list. When multiple 227 changes relate to a single bug, additional references are linked to numbers 228 following the bug ID.</p> 229 230 231 <h3 id="rce-in-curl-libcurl">Remote code execution vulnerability in 232 CURL/LIBCURL</h3> 233 <p> 234 The table contains security vulnerabilities affecting the CURL and LIBCURL 235 libraries. The most severe issue could enable a man-in-the-middle attacker 236 using a forged certificate to execute arbitrary code within the context of a 237 privileged process. This issue is rated as High due to the attacker needing a 238 forged certificate. 239 </p> 240 241 <table> 242 <col width="18%"> 243 <col width="18%"> 244 <col width="10%"> 245 <col width="19%"> 246 <col width="17%"> 247 <col width="17%"> 248 <tr> 249 <th>CVE</th> 250 <th>References</th> 251 <th>Severity</th> 252 <th>Updated Google devices</th> 253 <th>Updated AOSP versions</th> 254 <th>Date reported</th> 255 </tr> 256 <tr> 257 <td>CVE-2016-5419</td> 258 <td>A-31271247</td> 259 <td>High</td> 260 <td>All</td> 261 <td>7.0</td> 262 <td>Aug 3, 2016</td> 263 </tr> 264 <tr> 265 <td>CVE-2016-5420</td> 266 <td>A-31271247</td> 267 <td>High</td> 268 <td>All</td> 269 <td>7.0</td> 270 <td>Aug 3, 2016</td> 271 </tr> 272 <tr> 273 <td>CVE-2016-5421</td> 274 <td>A-31271247</td> 275 <td>High</td> 276 <td>All</td> 277 <td>7.0</td> 278 <td>Aug 3, 2016</td> 279 </tr> 280 </table> 281 282 283 <h3 id="eop-in-libziparchive">Elevation of privilege vulnerability in 284 libziparchive</h3> 285 <p> 286 An elevation of privilege vulnerability in the libziparchive library could 287 enable a local malicious application to execute arbitrary code within the 288 context of a privileged process. This issue is rated as High because it could 289 be used to gain local access to elevated capabilities, which are not normally 290 accessible to a third-party application. 291 </p> 292 293 <table> 294 <col width="18%"> 295 <col width="18%"> 296 <col width="10%"> 297 <col width="19%"> 298 <col width="17%"> 299 <col width="17%"> 300 <tr> 301 <th>CVE</th> 302 <th>References</th> 303 <th>Severity</th> 304 <th>Updated Google devices</th> 305 <th>Updated AOSP versions</th> 306 <th>Date reported</th> 307 </tr> 308 <tr> 309 <td>CVE-2016-6762</td> 310 <td><a href="https://android.googlesource.com/platform/system/core/+/1ee4892e66ba314131b7ecf17e98bb1762c4b84c"> 311 A-31251826</a> 312 [<a href="https://android.googlesource.com/platform/bionic/+/3656958a16590d07d1e25587734e000beb437740">2</a>] 313 </td> 314 <td>High</td> 315 <td>All</td> 316 <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 317 <td>Aug 28, 2016</td> 318 </tr> 319 </table> 320 321 322 <h3 id="dos-in-telephony">Denial of service vulnerability in Telephony</h3> 323 <p> 324 A denial of service vulnerability in Telephony could enable a local malicious 325 application to use a specially crafted file to cause a device hang or reboot. 326 This issue is rated as High due to the possibility of local permanent denial of 327 service. 328 </p> 329 330 <table> 331 <col width="18%"> 332 <col width="18%"> 333 <col width="10%"> 334 <col width="19%"> 335 <col width="17%"> 336 <col width="17%"> 337 <tr> 338 <th>CVE</th> 339 <th>References</th> 340 <th>Severity</th> 341 <th>Updated Google devices</th> 342 <th>Updated AOSP versions</th> 343 <th>Date reported</th> 344 </tr> 345 <tr> 346 <td>CVE-2016-6763</td> 347 <td><a href="https://android.googlesource.com/platform/packages/services/Telephony/+/1294620627b1e9afdf4bd0ad51c25ed3daf80d84"> 348 A-31530456</a></td> 349 <td>High</td> 350 <td>All</td> 351 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 352 <td>Sep 12, 2016</td> 353 </tr> 354 </table> 355 356 357 <h3 id="dos-in-mediaserver">Denial of service vulnerability in Mediaserver</h3> 358 <p> 359 A denial of service vulnerability in Mediaserver could enable an attacker to 360 use a specially crafted file to cause a device hang or reboot. This issue is 361 rated as High due to the possibility of remote denial of service. 362 </p> 363 364 <table> 365 <col width="18%"> 366 <col width="18%"> 367 <col width="10%"> 368 <col width="19%"> 369 <col width="17%"> 370 <col width="17%"> 371 <tr> 372 <th>CVE</th> 373 <th>References</th> 374 <th>Severity</th> 375 <th>Updated Google devices</th> 376 <th>Updated AOSP versions</th> 377 <th>Date reported</th> 378 </tr> 379 <tr> 380 <td>CVE-2016-6766 </td> 381 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/0d13824315b0491d44e9c6eb5db06489ab0fcc20"> 382 A-31318219</a></td> 383 <td>High</td> 384 <td>All</td> 385 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 386 <td>Sep 5, 2016</td> 387 </tr> 388 <tr> 389 <td>CVE-2016-6765</td> 390 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/fd9cc97d4dfe2a2fbce2c0f1704d7a27ce7cbc44"> 391 A-31449945</a></td> 392 <td>High</td> 393 <td>All</td> 394 <td>4.4.4, 5.0.2, 5.1.1, 7.0</td> 395 <td>Sep 13, 2016</td> 396 </tr> 397 <tr> 398 <td>CVE-2016-6764</td> 399 <td><a href="https://android.googlesource.com/platform/frameworks/av/+/0d13824315b0491d44e9c6eb5db06489ab0fcc20"> 400 A-31681434</a></td> 401 <td>High</td> 402 <td>All</td> 403 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 404 <td>Sep 22, 2016</td> 405 </tr> 406 <tr> 407 <td>CVE-2016-6767</td> 408 <td>A-31833604</td> 409 <td>High</td> 410 <td>None*</td> 411 <td>4.4.4</td> 412 <td>Google internal</td> 413 </tr> 414 </table> 415 416 <p> 417 * Supported Google devices on Android 7.0 or later that have installed all 418 available updates are not affected by this vulnerability. 419 </p> 420 421 422 <h3 id="rce-in-framesequence-library">Remote Code Execution vulnerability in 423 Framesequence library</h3> 424 <p> 425 A remote code execution vulnerability in the Framesequence library could enable 426 an attacker using a specially crafted file to execute arbitrary code in the 427 context of an unprivileged process. This issue is rated as High due to the 428 possibility of remote code execution in an application that uses the 429 Framesequence library. 430 </p> 431 432 <table> 433 <col width="18%"> 434 <col width="18%"> 435 <col width="10%"> 436 <col width="19%"> 437 <col width="17%"> 438 <col width="17%"> 439 <tr> 440 <th>CVE</th> 441 <th>References</th> 442 <th>Severity</th> 443 <th>Updated Google devices</th> 444 <th>Updated AOSP versions</th> 445 <th>Date reported</th> 446 </tr> 447 <tr> 448 <td>CVE-2016-6768</td> 449 <td><a href="https://android.googlesource.com/platform/frameworks/ex/+/0ada9456d0270cb0e357a43d9187a6418d770760"> 450 A-31631842</a></td> 451 <td>High</td> 452 <td>All</td> 453 <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 454 <td>Sep 19, 2016</td> 455 </tr> 456 </table> 457 458 459 <h3 id="eop-in-smart-lock">Elevation of privilege vulnerability in Smart 460 Lock</h3> 461 <p> 462 An elevation of privilege vulnerability in Smart Lock could enable a local 463 malicious user to access Smart Lock settings without a PIN. This issue is rated 464 as Moderate because it first requires physical access to an unlocked device 465 where Smart Lock was the last settings pane accessed by the user. 466 </p> 467 468 <table> 469 <col width="18%"> 470 <col width="18%"> 471 <col width="10%"> 472 <col width="19%"> 473 <col width="17%"> 474 <col width="17%"> 475 <tr> 476 <th>CVE</th> 477 <th>References</th> 478 <th>Severity</th> 479 <th>Updated Google devices</th> 480 <th>Updated AOSP versions</th> 481 <th>Date reported</th> 482 </tr> 483 <tr> 484 <td>CVE-2016-6769</td> 485 <td>A-29055171</td> 486 <td>Moderate</td> 487 <td>None*</td> 488 <td>5.0.2, 5.1.1, 6.0, 6.0.1</td> 489 <td>May 27, 2016</td> 490 </tr> 491 </table> 492 <p> 493 * Supported Google devices on Android 7.0 or later that have installed all 494 available updates are not affected by this vulnerability. 495 </p> 496 497 498 <h3 id="eop-in-framework-apis">Elevation of privilege vulnerability in 499 Framework APIs</h3> 500 <p> 501 An elevation of privilege vulnerability in the Framework API could enable a 502 local malicious application to access system functions beyond its access level. 503 This issue is rated as Moderate because it is a local bypass of restrictions on 504 a constrained process. 505 </p> 506 507 <table> 508 <col width="18%"> 509 <col width="18%"> 510 <col width="10%"> 511 <col width="19%"> 512 <col width="17%"> 513 <col width="17%"> 514 <tr> 515 <th>CVE</th> 516 <th>References</th> 517 <th>Severity</th> 518 <th>Updated Google devices</th> 519 <th>Updated AOSP versions</th> 520 <th>Date reported</th> 521 </tr> 522 <tr> 523 <td>CVE-2016-6770</td> 524 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/2c61c57ac53cbb270b4e76b9d04465f8a3f6eadc"> 525 A-30202228</a></td> 526 <td>Moderate</td> 527 <td>All</td> 528 <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 529 <td>Jul 16, 2016</td> 530 </tr> 531 </table> 532 533 534 <h3 id="eop-in-telephony">Elevation of privilege vulnerability in 535 Telephony</h3> 536 <p> 537 An elevation of privilege vulnerability in Telephony could enable a local 538 malicious application to access system functions beyond its access level. This 539 issue is rated as Moderate because it is a local bypass of restrictions on a 540 constrained process. 541 </p> 542 543 <table> 544 <col width="18%"> 545 <col width="18%"> 546 <col width="10%"> 547 <col width="19%"> 548 <col width="17%"> 549 <col width="17%"> 550 <tr> 551 <th>CVE</th> 552 <th>References</th> 553 <th>Severity</th> 554 <th>Updated Google devices</th> 555 <th>Updated AOSP versions</th> 556 <th>Date reported</th> 557 </tr> 558 <tr> 559 <td>CVE-2016-6771</td> 560 <td><a href="https://android.googlesource.com/platform/packages/services/Telephony/+/a39ff9526aee6f2ea4f6e02412db7b33d486fd7d"> 561 A-31566390</a></td> 562 <td>Moderate</td> 563 <td>All</td> 564 <td>6.0, 6.0.1, 7.0</td> 565 <td>Sep 17, 2016</td> 566 </tr> 567 </table> 568 569 570 <h3 id="eop-in-wi-fi">Elevation of privilege vulnerability in Wi-Fi</h3> 571 <p> 572 An elevation of privilege vulnerability in Wi-Fi could enable a local malicious 573 application to execute arbitrary code within the context of a privileged 574 process. This issue is rated as Moderate because it first requires compromising 575 a privileged process. 576 </p> 577 578 <table> 579 <col width="18%"> 580 <col width="18%"> 581 <col width="10%"> 582 <col width="19%"> 583 <col width="17%"> 584 <col width="17%"> 585 <tr> 586 <th>CVE</th> 587 <th>References</th> 588 <th>Severity</th> 589 <th>Updated Google devices</th> 590 <th>Updated AOSP versions</th> 591 <th>Date reported</th> 592 </tr> 593 <tr> 594 <td>CVE-2016-6772</td> 595 <td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/a5a18239096f6faee80f15f3fff39c3311898484"> 596 A-31856351</a> 597 [<a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/29a2baf3195256bab6a0a4a2d07b7f2efa46b614">2</a>]</td> 598 <td>Moderate</td> 599 <td>All</td> 600 <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td> 601 <td>Sep 30, 2016</td> 602 </tr> 603 </table> 604 605 606 <h3 id="id-in-mediaserver">Information disclosure vulnerability in 607 Mediaserver</h3> 608 <p> 609 An information disclosure vulnerability in Mediaserver could enable a local 610 malicious application to access data outside of its permission levels. This 611 issue is rated as Moderate because it could be used to access sensitive data 612 without permission. 613 </p> 614 615 <table> 616 <col width="18%"> 617 <col width="18%"> 618 <col width="10%"> 619 <col width="19%"> 620 <col width="17%"> 621 <col width="17%"> 622 <tr> 623 <th>CVE</th> 624 <th>References</th> 625 <th>Severity</th> 626 <th>Updated Google devices</th> 627 <th>Updated AOSP versions</th> 628 <th>Date reported</th> 629 </tr> 630 <tr> 631 <td>CVE-2016-6773</td> 632 <td><a href="https://android.googlesource.com/platform/external/libavc/+/026745ef046e646b8d04f4f57d8320042f6b29b0"> 633 A-30481714</a> 634 [<a href="https://android.googlesource.com/platform/external/libavc/+/6676aeb4195e7c7379915c0972f3d209410f0641">2</a>]</td> 635 <td>Moderate</td> 636 <td>All</td> 637 <td>6.0, 6.0.1, 7.0</td> 638 <td>Jul 27, 2016</td> 639 </tr> 640 </table> 641 642 643 <h3 id="id-in-package-manager">Information disclosure vulnerability in Package 644 Manager</h3> 645 <p> 646 An information disclosure vulnerability in Package Manager could enable a local 647 malicious application to bypass operating system protections that isolate 648 application data from other applications. This issue is rated as Moderate 649 because it first requires compromising a privileged process. 650 </p> 651 652 <table> 653 <col width="18%"> 654 <col width="18%"> 655 <col width="10%"> 656 <col width="19%"> 657 <col width="17%"> 658 <col width="17%"> 659 <tr> 660 <th>CVE</th> 661 <th>References</th> 662 <th>Severity</th> 663 <th>Updated Google devices</th> 664 <th>Updated AOSP versions</th> 665 <th>Date reported</th> 666 </tr> 667 <tr> 668 <td>CVE-2016-6774</td> 669 <td><a href="https://android.googlesource.com/platform/frameworks/base/+/e2d4f5fc313ecb4ba587b20fff6d346f8cd51775"> 670 A-31251489</a></td> 671 <td>Moderate</td> 672 <td>All</td> 673 <td>7.0</td> 674 <td>Aug 29, 2016</td> 675 </tr> 676 </table> 677 678 679 <h2 id="2016-12-05-details">2016-12-05 security patch levelVulnerability 680 details</h2> 681 <p> 682 In the sections below, we provide details for each of the security 683 vulnerabilities that apply to the 2016-12-05 patch level. There is a description of 684 the issue, a severity rationale, and a table with the CVE, associated 685 references, severity, updated Google devices, updated AOSP versions (where 686 applicable), and date reported. When available, we will link the public change 687 that addressed the issue to the bug ID, like the AOSP change list. When multiple 688 changes relate to a single bug, additional references are linked to numbers 689 following the bug ID.</p> 690 691 <h3 id="eop-in-kernel-memory-subsystem">Elevation of privilege vulnerability in 692 kernel memory subsystem</h3> 693 <p> 694 An elevation of privilege vulnerability in the kernel memory subsystem could 695 enable a local malicious application to execute arbitrary code within the 696 context of the kernel. This issue is rated as Critical due to the possibility 697 of a local permanent device compromise, which may require reflashing the 698 operating system to repair the device. 699 </p> 700 701 <table> 702 <col width="19%"> 703 <col width="20%"> 704 <col width="10%"> 705 <col width="23%"> 706 <col width="17%"> 707 <tr> 708 <th>CVE</th> 709 <th>References</th> 710 <th>Severity</th> 711 <th>Updated Google devices</th> 712 <th>Date reported</th> 713 </tr> 714 <tr> 715 <td>CVE-2016-4794</td> 716 <td>A-31596597<br> 717 <a href="http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=6710e594f71ccaad8101bc64321152af7cd9ea28"> 718 Upstream kernel</a> 719 [<a href="http://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=4f996e234dad488e5d9ba0858bc1bae12eff82c3">2</a>]</td> 720 <td>Critical</td> 721 <td>Pixel C, Pixel, Pixel XL</td> 722 <td>Apr 17, 2016</td> 723 </tr> 724 <tr> 725 <td>CVE-2016-5195</td> 726 <td>A-32141528<br> 727 <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=9691eac5593ff1e2f82391ad327f21d90322aec1"> 728 Upstream kernel</a> 729 [<a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=e45a502bdeae5a075257c4f061d1ff4ff0821354">2</a>]</td> 730 <td>Critical</td> 731 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 732 Player, Pixel, Pixel XL</td> 733 <td>Oct 12, 2016</td> 734 </tr> 735 </table> 736 737 738 <h3 id="eop-in-nvidia-gpu-driver">Elevation of privilege vulnerability in 739 NVIDIA GPU driver</h3> 740 <p> 741 An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a 742 local malicious application to execute arbitrary code within the context of the 743 kernel. This issue is rated as Critical due to the possibility of a local 744 permanent device compromise, which may require reflashing the operating system 745 to repair the device. 746 </p> 747 748 <table> 749 <col width="19%"> 750 <col width="20%"> 751 <col width="10%"> 752 <col width="23%"> 753 <col width="17%"> 754 <tr> 755 <th>CVE</th> 756 <th>References</th> 757 <th>Severity</th> 758 <th>Updated Google devices</th> 759 <th>Date reported</th> 760 </tr> 761 <tr> 762 <td>CVE-2016-6775</td> 763 <td>A-31222873*<br>N-CVE-2016-6775</td> 764 <td>Critical</td> 765 <td>Nexus 9</td> 766 <td>Aug 25, 2016</td> 767 </tr> 768 <tr> 769 <td>CVE-2016-6776</td> 770 <td>A-31680980*<br>N-CVE-2016-6776</td> 771 <td>Critical</td> 772 <td>Nexus 9</td> 773 <td>Sep 22, 2016</td> 774 </tr> 775 <tr> 776 <td>CVE-2016-6777</td> 777 <td>A-31910462*<br>N-CVE-2016-6777</td> 778 <td>Critical</td> 779 <td>Nexus 9</td> 780 <td>Oct 3, 2016</td> 781 </tr> 782 </table> 783 <p> 784 * The patch for this issue is not publicly available. The update is contained in 785 the latest binary drivers for Google devices available from the <a 786 href="https://developers.google.com/android/nexus/drivers">Google Developer 787 site</a>. 788 </p> 789 790 <h3 id="eop-in-kernel">Elevation of privilege vulnerability in kernel</h3> 791 <p> 792 An elevation of privilege vulnerability in the kernel could enable a local 793 malicious application to execute arbitrary code within the context of the 794 kernel. This issue is rated as Critical due to the possibility of a local 795 permanent device compromise, which may require reflashing the operating system 796 to repair the device. 797 </p> 798 799 <table> 800 <col width="19%"> 801 <col width="20%"> 802 <col width="10%"> 803 <col width="23%"> 804 <col width="17%"> 805 <tr> 806 <th>CVE</th> 807 <th>References</th> 808 <th>Severity</th> 809 <th>Updated Google devices</th> 810 <th>Date reported</th> 811 </tr> 812 <tr> 813 <td>CVE-2015-8966</td> 814 <td>A-31435731<br> 815 <a 816 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=76cc404bfdc0d419c720de4daaf2584542734f42"> 817 Upstream kernel</a></td> 818 <td>Critical</td> 819 <td>None*</td> 820 <td>Sep 10, 2016</td> 821 </tr> 822 </table> 823 <p> 824 * Supported Google devices on Android 7.0 or later that have installed all 825 available updates are not affected by this vulnerability. 826 </p> 827 828 829 <h3 id="eop-in-nvidia-video-driver">Elevation of privilege vulnerability in 830 NVIDIA video driver</h3> 831 <p> 832 An elevation of privilege vulnerability in the NVIDIA video driver could enable 833 a local malicious application to execute arbitrary code within the context of 834 the kernel. This issue is rated as Critical due to the possibility of a local 835 permanent device compromise, which may require reflashing the operating system 836 to repair the device. 837 </p> 838 839 <table> 840 <col width="19%"> 841 <col width="20%"> 842 <col width="10%"> 843 <col width="23%"> 844 <col width="17%"> 845 <tr> 846 <th>CVE</th> 847 <th>References</th> 848 <th>Severity</th> 849 <th>Updated Google devices</th> 850 <th>Date reported</th> 851 </tr> 852 <tr> 853 <td>CVE-2016-6915</td> 854 <td>A-31471161* 855 <br>N-CVE-2016-6915</td> 856 <td>Critical</td> 857 <td>Nexus 9</td> 858 <td>Sep 13, 2016</td> 859 </tr> 860 <tr> 861 <td>CVE-2016-6916</td> 862 <td>A-32072350* 863 <br>N-CVE-2016-6916</td> 864 <td>Critical</td> 865 <td>Nexus 9, Pixel C</td> 866 <td>Sep 13, 2016</td> 867 </tr> 868 <tr> 869 <td>CVE-2016-6917</td> 870 <td>A-32072253* 871 <br>N-CVE-2016-6917</td> 872 <td>Critical</td> 873 <td>Nexus 9</td> 874 <td>Sep 13, 2016</td> 875 </tr> 876 </table> 877 <p> 878 * The patch for this issue is not publicly available. The update is contained in 879 the latest binary drivers for Google devices available from the <a 880 href="https://developers.google.com/android/nexus/drivers">Google Developer 881 site</a>. 882 </p> 883 884 <h3 id="eop-in-kernel-ion-driver">Elevation of privilege vulnerability in 885 kernel ION driver</h3> 886 <p> 887 An elevation of privilege vulnerability in the kernel ION driver could enable a 888 local malicious application to execute arbitrary code within the context of the 889 kernel. This issue is rated as Critical due to the possibility of a local 890 permanent device compromise, which may require reflashing the operating system 891 to repair the device. 892 </p> 893 894 <table> 895 <col width="19%"> 896 <col width="20%"> 897 <col width="10%"> 898 <col width="23%"> 899 <col width="17%"> 900 <tr> 901 <th>CVE</th> 902 <th>References</th> 903 <th>Severity</th> 904 <th>Updated Google devices</th> 905 <th>Date reported</th> 906 </tr> 907 <tr> 908 <td>CVE-2016-9120</td> 909 <td>A-31568617<br> 910 <a 911 href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9590232bb4f4cc824f3425a6e1349afbe6d6d2b7"> 912 Upstream kernel</a></td> 913 <td>Critical</td> 914 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel C, Nexus Player</td> 915 <td>Sep 16, 2016</td> 916 </tr> 917 </table> 918 919 <h3 id="vulnerabilities-in-qc-components">Vulnerabilities in Qualcomm components</h3> 920 <p> 921 The following vulnerabilities affects Qualcomm components and is described in 922 further detail in Qualcomm AMSS November 2015 security bulletin. 923 </p> 924 <table> 925 <col width="19%"> 926 <col width="20%"> 927 <col width="10%"> 928 <col width="23%"> 929 <col width="17%"> 930 <tr> 931 <th>CVE</th> 932 <th>References</th> 933 <th>Severity*</th> 934 <th>Updated Google devices</th> 935 <th>Date reported</th> 936 </tr> 937 <tr> 938 <td>CVE-2016-8411</td> 939 <td>A-31805216**</td> 940 <td>Critical</td> 941 <td>Nexus 6, Nexus 6P, Android One</td> 942 <td>Qualcomm internal</td> 943 </tr> 944 </table> 945 <p>* The severity rating for these vulnerabilities was determined by the vendor.</p> 946 <p>** The patch for this issue is not publicly available. The update is contained in 947 the latest binary drivers for Google devices available from the <a 948 href="https://developers.google.com/android/nexus/drivers">Google Developer 949 site</a>. 950 </p> 951 952 <h3 id="eop-in-kernel-file-system">Elevation of privilege vulnerability in 953 kernel file system</h3> 954 <p> 955 An elevation of privilege vulnerability in the kernel file system could enable 956 a local malicious application to bypass operating system protections that 957 isolate application data from other applications. This issue is rated as High 958 because it could be used to gain local access to elevated capabilities, which 959 are not normally accessible to a third-party application. 960 </p> 961 962 <table> 963 <col width="19%"> 964 <col width="20%"> 965 <col width="10%"> 966 <col width="23%"> 967 <col width="17%"> 968 <tr> 969 <th>CVE</th> 970 <th>References</th> 971 <th>Severity</th> 972 <th>Updated Google devices</th> 973 <th>Date reported</th> 974 </tr> 975 <tr> 976 <td>CVE-2014-4014</td> 977 <td>A-31252187<br> 978 <a 979 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23adbe12ef7d3d4195e80800ab36b37bee28cd03"> 980 Upstream kernel</a></td> 981 <td>High</td> 982 <td>Nexus 6, Nexus Player</td> 983 <td>Jun 10, 2014</td> 984 </tr> 985 </table> 986 987 988 <h3 id="eop-in-kernel-2">Elevation of privilege vulnerability in kernel</h3> 989 <p> 990 An elevation of privilege vulnerability in the kernel could enable a local 991 malicious application to to execute arbitrary code within the context of the 992 kernel. This issue is rated as High because it first requires exploitation of a 993 separate vulnerability. 994 </p> 995 996 <table> 997 <col width="19%"> 998 <col width="20%"> 999 <col width="10%"> 1000 <col width="23%"> 1001 <col width="17%"> 1002 <tr> 1003 <th>CVE</th> 1004 <th>References</th> 1005 <th>Severity</th> 1006 <th>Updated Google devices</th> 1007 <th>Date reported</th> 1008 </tr> 1009 <tr> 1010 <td>CVE-2015-8967</td> 1011 <td>A-31703084<br> 1012 <a 1013 href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c623b33b4e9599c6ac5076f7db7369eb9869aa04"> 1014 Upstream kernel</a></td> 1015 <td>High</td> 1016 <td>Nexus 5X, Nexus 6P, Nexus 9, Pixel C, Pixel, Pixel XL</td> 1017 <td>Jan 8, 2015</td> 1018 </tr> 1019 </table> 1020 1021 1022 <h3 id="eop-in-htc-sound-codec-driver">Elevation of privilege vulnerability in 1023 HTC sound codec driver</h3> 1024 <p> 1025 An elevation of privilege vulnerability in the HTC sound codec driver could 1026 enable a local malicious application to execute arbitrary code within the 1027 context of the kernel. This issue is rated as High because it first requires 1028 compromising a privileged process. 1029 </p> 1030 1031 <table> 1032 <col width="19%"> 1033 <col width="20%"> 1034 <col width="10%"> 1035 <col width="23%"> 1036 <col width="17%"> 1037 <tr> 1038 <th>CVE</th> 1039 <th>References</th> 1040 <th>Severity</th> 1041 <th>Updated Google devices</th> 1042 <th>Date reported</th> 1043 </tr> 1044 <tr> 1045 <td>CVE-2016-6778</td> 1046 <td>A-31384646*</td> 1047 <td>High</td> 1048 <td>Nexus 9</td> 1049 <td>Feb 25, 2016</td> 1050 </tr> 1051 <tr> 1052 <td>CVE-2016-6779</td> 1053 <td>A-31386004*</td> 1054 <td>High</td> 1055 <td>Nexus 9</td> 1056 <td>Feb 25, 2016</td> 1057 </tr> 1058 <tr> 1059 <td>CVE-2016-6780</td> 1060 <td>A-31251496*</td> 1061 <td>High</td> 1062 <td>Nexus 9</td> 1063 <td>Aug 30, 2016</td> 1064 </tr> 1065 </table> 1066 <p> 1067 * The patch for this issue is not publicly available. The update is contained in 1068 the latest binary drivers for Google devices available from the <a 1069 href="https://developers.google.com/android/nexus/drivers">Google Developer 1070 site</a>. 1071 </p> 1072 1073 <h3 id="eop-in-mediatek-driver">Elevation of privilege vulnerability in 1074 MediaTek driver</h3> 1075 <p> 1076 An elevation of privilege vulnerability in the MediaTek driver could enable a 1077 local malicious application to execute arbitrary code within the context of the 1078 kernel. This issue is rated as High because it first requires compromising a 1079 privileged process. 1080 </p> 1081 1082 <table> 1083 <col width="19%"> 1084 <col width="20%"> 1085 <col width="10%"> 1086 <col width="23%"> 1087 <col width="17%"> 1088 <tr> 1089 <th>CVE</th> 1090 <th>References</th> 1091 <th>Severity</th> 1092 <th>Updated Google devices</th> 1093 <th>Date reported</th> 1094 </tr> 1095 <tr> 1096 <td>CVE-2016-6492</td> 1097 <td>A-28175122<br>MT-ALPS02696413</td> 1098 <td>High</td> 1099 <td>None*</td> 1100 <td>Apr 11, 2016</td> 1101 </tr> 1102 <tr> 1103 <td>CVE-2016-6781</td> 1104 <td>A-31095175<br>MT-ALPS02943455</td> 1105 <td>High</td> 1106 <td>None*</td> 1107 <td>Aug 22, 2016</td> 1108 </tr> 1109 <tr> 1110 <td>CVE-2016-6782</td> 1111 <td>A-31224389<br>MT-ALPS02943506</td> 1112 <td>High</td> 1113 <td>None*</td> 1114 <td>Aug 24, 2016</td> 1115 </tr> 1116 <tr> 1117 <td>CVE-2016-6783</td> 1118 <td>A-31350044<br>MT-ALPS02943437</td> 1119 <td>High</td> 1120 <td>None*</td> 1121 <td>Sep 6, 2016</td> 1122 </tr> 1123 <tr> 1124 <td>CVE-2016-6784</td> 1125 <td>A-31350755<br>MT-ALPS02961424</td> 1126 <td>High</td> 1127 <td>None*</td> 1128 <td>Sep 6, 2016</td> 1129 </tr> 1130 <tr> 1131 <td>CVE-2016-6785</td> 1132 <td>A-31748056<br>MT-ALPS02961400</td> 1133 <td>High</td> 1134 <td>None*</td> 1135 <td>Sep 25, 2016</td> 1136 </tr> 1137 </table> 1138 <p> 1139 * Supported Google devices on Android 7.0 or later that have installed all 1140 available updates are not affected by this vulnerability. 1141 </p> 1142 1143 1144 <h3 id="eop-in-qualcomm-media-codecs">Elevation of privilege vulnerability in 1145 Qualcomm media codecs</h3> 1146 <p> 1147 An elevation of privilege vulnerability in Qualcomm media codecs could enable a 1148 local malicious application to execute arbitrary code within the context of a 1149 privileged process. This issue is rated as High because it could be used to 1150 gain local access to elevated capabilities, which are not normally accessible 1151 to a third-party application. 1152 </p> 1153 1154 <table> 1155 <col width="19%"> 1156 <col width="20%"> 1157 <col width="10%"> 1158 <col width="23%"> 1159 <col width="17%"> 1160 <tr> 1161 <th>CVE</th> 1162 <th>References</th> 1163 <th>Severity</th> 1164 <th>Updated Google devices</th> 1165 <th>Date reported</th> 1166 </tr> 1167 <tr> 1168 <td>CVE-2016-6761</td> 1169 <td>A-29421682* 1170 <br>QC-CR#1055792</td> 1171 <td>High</td> 1172 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player, Pixel, 1173 Pixel XL</td> 1174 <td>Jun 16, 2016</td> 1175 </tr> 1176 <tr> 1177 <td>CVE-2016-6760</td> 1178 <td>A-29617572* 1179 <br>QC-CR#1055783</td> 1180 <td>High</td> 1181 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player, Pixel, 1182 Pixel XL</td> 1183 <td>Jun 23, 2016</td> 1184 </tr> 1185 <tr> 1186 <td>CVE-2016-6759</td> 1187 <td>A-29982686* 1188 <br>QC-CR#1055766</td> 1189 <td>High</td> 1190 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player, Pixel, 1191 Pixel XL</td> 1192 <td>Jul 4, 2016</td> 1193 </tr> 1194 <tr> 1195 <td>CVE-2016-6758</td> 1196 <td>A-30148882* 1197 <br>QC-CR#1071731</td> 1198 <td>High</td> 1199 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player, Pixel, 1200 Pixel XL</td> 1201 <td>Jul 13, 2016</td> 1202 </tr> 1203 </table> 1204 <p> 1205 * The patch for this issue is not publicly available. The update is contained in 1206 the latest binary drivers for Google devices available from the <a 1207 href="https://developers.google.com/android/nexus/drivers">Google Developer 1208 site</a>. 1209 </p> 1210 1211 <h3 id="eop-in-qualcomm-camera-driver">Elevation of privilege vulnerability in 1212 Qualcomm camera driver</h3> 1213 <p> 1214 An elevation of privilege vulnerability in the Qualcomm camera driver could 1215 enable a local malicious application to execute arbitrary code within the 1216 context of the kernel. This issue is rated as High because it first requires 1217 compromising a privileged process. 1218 </p> 1219 1220 <table> 1221 <col width="19%"> 1222 <col width="20%"> 1223 <col width="10%"> 1224 <col width="23%"> 1225 <col width="17%"> 1226 <tr> 1227 <th>CVE</th> 1228 <th>References</th> 1229 <th>Severity</th> 1230 <th>Updated Google devices</th> 1231 <th>Date reported</th> 1232 </tr> 1233 <tr> 1234 <td>CVE-2016-6755</td> 1235 <td>A-30740545<br> 1236 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=b5df02edbcdf53dbbab77903d28162772edcf6e0"> 1237 QC-CR#1065916</a></td> 1238 <td>High</td> 1239 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1240 <td>Aug 3, 2016</td> 1241 </tr> 1242 </table> 1243 1244 1245 <h3 id="eop-in-kernel-performance-subsystem">Elevation of privilege 1246 vulnerability in kernel performance subsystem</h3> 1247 <p> 1248 An elevation of privilege vulnerability in the kernel performance subsystem 1249 could enable a local malicious application to execute arbitrary code within the 1250 context of the kernel. This issue is rated as High because it first requires 1251 compromising a privileged process. 1252 </p> 1253 1254 <table> 1255 <col width="19%"> 1256 <col width="20%"> 1257 <col width="10%"> 1258 <col width="23%"> 1259 <col width="17%"> 1260 <tr> 1261 <th>CVE</th> 1262 <th>References</th> 1263 <th>Severity</th> 1264 <th>Updated Google devices</th> 1265 <th>Date reported</th> 1266 </tr> 1267 <tr> 1268 <td>CVE-2016-6786</td> 1269 <td>A-30955111 1270 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b">Upstream kernel</a></td> 1271 <td>High</td> 1272 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1273 Player, Pixel, Pixel XL</td> 1274 <td>Aug 18, 2016</td> 1275 </tr> 1276 <tr> 1277 <td>CVE-2016-6787</td> 1278 <td>A-31095224 1279 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f63a8daa5812afef4f06c962351687e1ff9ccb2b">Upstream kernel</a></td> 1280 <td>High</td> 1281 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1282 Player, Pixel, Pixel XL</td> 1283 <td>Aug 22, 2016</td> 1284 </tr> 1285 </table> 1286 1287 1288 <h3 id="eop-in-mediatek-i2c-driver">Elevation of privilege vulnerability in 1289 MediaTek I2C driver</h3> 1290 <p> 1291 An elevation of privilege vulnerability in the MediaTek I2C driver could enable 1292 a local malicious application to execute arbitrary code within the context of 1293 the kernel. This issue is rated as High because it first requires compromising 1294 a privileged process. 1295 </p> 1296 1297 <table> 1298 <col width="19%"> 1299 <col width="20%"> 1300 <col width="10%"> 1301 <col width="23%"> 1302 <col width="17%"> 1303 <tr> 1304 <th>CVE</th> 1305 <th>References</th> 1306 <th>Severity</th> 1307 <th>Updated Google devices</th> 1308 <th>Date reported</th> 1309 </tr> 1310 <tr> 1311 <td>CVE-2016-6788</td> 1312 <td>A-31224428<br>MT-ALPS02943467</td> 1313 <td>High</td> 1314 <td>None*</td> 1315 <td>Aug 24, 2016</td> 1316 </tr> 1317 </table> 1318 <p> 1319 * Supported Google devices on Android 7.0 or later that have installed all 1320 available updates are not affected by this vulnerability. 1321 </p> 1322 1323 1324 <h3 id="eop-in-nvidia-libomx-library">Elevation of privilege vulnerability in 1325 NVIDIA libomx library</h3> 1326 <p> 1327 An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) 1328 could enable a local malicious application to execute arbitrary code within the 1329 context of a privileged process. This issue is rated as High because it could 1330 be used to gain local access to elevated capabilities, which are not normally 1331 accessible to a third-party application. 1332 </p> 1333 1334 <table> 1335 <col width="19%"> 1336 <col width="20%"> 1337 <col width="10%"> 1338 <col width="23%"> 1339 <col width="17%"> 1340 <tr> 1341 <th>CVE</th> 1342 <th>References</th> 1343 <th>Severity</th> 1344 <th>Updated Google devices</th> 1345 <th>Date reported</th> 1346 </tr> 1347 <tr> 1348 <td>CVE-2016-6789</td> 1349 <td>A-31251973* 1350 <br>N-CVE-2016-6789</td> 1351 <td>High</td> 1352 <td>Pixel C</td> 1353 <td>Aug 29, 2016</td> 1354 </tr> 1355 <tr> 1356 <td>CVE-2016-6790</td> 1357 <td>A-31251628* 1358 <br>N-CVE-2016-6790</td> 1359 <td>High</td> 1360 <td>Pixel C</td> 1361 <td>Aug 28, 2016</td> 1362 </tr> 1363 </table> 1364 <p> 1365 * The patch for this issue is not publicly available. The update is contained in 1366 the latest binary drivers for Google devices available from the <a 1367 href="https://developers.google.com/android/nexus/drivers">Google Developer 1368 site</a>. 1369 </p> 1370 1371 <h3 id="eop-in-qualcomm-sound-driver">Elevation of privilege vulnerability in 1372 Qualcomm sound driver</h3> 1373 <p> 1374 An elevation of privilege vulnerability in the Qualcomm sound driver could 1375 enable a local malicious application to execute arbitrary code within the 1376 context of the kernel. This issue is rated as High because it first requires 1377 compromising a privileged process. 1378 </p> 1379 1380 <table> 1381 <col width="19%"> 1382 <col width="20%"> 1383 <col width="10%"> 1384 <col width="23%"> 1385 <col width="17%"> 1386 <tr> 1387 <th>CVE</th> 1388 <th>References</th> 1389 <th>Severity</th> 1390 <th>Updated Google devices</th> 1391 <th>Date reported</th> 1392 </tr> 1393 <tr> 1394 <td>CVE-2016-6791</td> 1395 <td>A-31252384<br> 1396 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=62580295210b6c0bd809cde7088b45ebb65ace79"> 1397 QC-CR#1071809</a></td> 1398 <td>High</td> 1399 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1400 <td>Aug 31, 2016</td> 1401 </tr> 1402 <tr> 1403 <td>CVE-2016-8391</td> 1404 <td>A-31253255<br> 1405 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=62580295210b6c0bd809cde7088b45ebb65ace79"> 1406 QC-CR#1072166</a></td> 1407 <td>High</td> 1408 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1409 <td>Aug 31, 2016</td> 1410 </tr> 1411 <tr> 1412 <td>CVE-2016-8392</td> 1413 <td>A-31385862<br> 1414 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=62580295210b6c0bd809cde7088b45ebb65ace79"> 1415 QC-CR#1073136</a></td> 1416 <td>High</td> 1417 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1418 <td>Sep 8, 2016</td> 1419 </tr> 1420 </table> 1421 1422 1423 <h3 id="eop-in-kernel-security-subsystem">Elevation of privilege vulnerability 1424 in kernel security subsystem</h3> 1425 <p> 1426 An elevation of privilege vulnerability in the kernel security subsystem could 1427 enable a local malicious application to execute arbitrary code within the 1428 context of the kernel. This issue is rated as High because it first requires 1429 compromising a privileged process. 1430 </p> 1431 1432 <table> 1433 <col width="19%"> 1434 <col width="20%"> 1435 <col width="10%"> 1436 <col width="23%"> 1437 <col width="17%"> 1438 <tr> 1439 <th>CVE</th> 1440 <th>References</th> 1441 <th>Severity</th> 1442 <th>Updated Google devices</th> 1443 <th>Date reported</th> 1444 </tr> 1445 <tr> 1446 <td>CVE-2015-7872</td> 1447 <td>A-31253168<br> 1448 <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61"> 1449 Upstream kernel</a></td> 1450 <td>High</td> 1451 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Nexus Player, Pixel, 1452 Pixel XL</td> 1453 <td>Aug 31, 2016</td> 1454 </tr> 1455 </table> 1456 1457 1458 <h3 id="eop-in-synaptics-touchscreen-driver">Elevation of privilege 1459 vulnerability in Synaptics touchscreen driver</h3> 1460 <p> 1461 An elevation of privilege vulnerability in the Synaptics touchscreen driver 1462 could enable a local malicious application to execute arbitrary code within the 1463 context of the kernel. This issue is rated as High because it first requires 1464 compromising a privileged process. 1465 </p> 1466 1467 <table> 1468 <col width="19%"> 1469 <col width="20%"> 1470 <col width="10%"> 1471 <col width="23%"> 1472 <col width="17%"> 1473 <tr> 1474 <th>CVE</th> 1475 <th>References</th> 1476 <th>Severity</th> 1477 <th>Updated Google devices</th> 1478 <th>Date reported</th> 1479 </tr> 1480 <tr> 1481 <td>CVE-2016-8393</td> 1482 <td>A-31911920*</td> 1483 <td>High</td> 1484 <td>Nexus 5X, Nexus 6P, Nexus 9, Android One, Pixel, Pixel XL</td> 1485 <td>Sep 8, 2016</td> 1486 </tr> 1487 <tr> 1488 <td>CVE-2016-8394</td> 1489 <td>A-31913197*</td> 1490 <td>High</td> 1491 <td>Nexus 9, Android One</td> 1492 <td>Sep 8, 2016</td> 1493 </tr> 1494 </table> 1495 <p> 1496 * The patch for this issue is not publicly available. The update is contained in 1497 the latest binary drivers for Google devices available from the <a 1498 href="https://developers.google.com/android/nexus/drivers">Google Developer 1499 site</a>. 1500 </p> 1501 1502 <h3 id="eop-in-broadcom-wi-fi-driver">Elevation of privilege vulnerability in 1503 Broadcom Wi-Fi driver</h3> 1504 <p> 1505 An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could 1506 enable a local malicious application to execute arbitrary code within the 1507 context of the kernel. This issue is rated as High because it first requires 1508 compromising a privileged process. 1509 </p> 1510 1511 <table> 1512 <col width="19%"> 1513 <col width="20%"> 1514 <col width="10%"> 1515 <col width="23%"> 1516 <col width="17%"> 1517 <tr> 1518 <th>CVE</th> 1519 <th>References</th> 1520 <th>Severity</th> 1521 <th>Updated Google devices</th> 1522 <th>Date reported</th> 1523 </tr> 1524 <tr> 1525 <td>CVE-2014-9909</td> 1526 <td>A-31676542<br>B-RB#26684</td> 1527 <td>High</td> 1528 <td>None*</td> 1529 <td>Sep 21, 2016</td> 1530 </tr> 1531 <tr> 1532 <td>CVE-2014-9910</td> 1533 <td>A-31746399<br>B-RB#26710</td> 1534 <td>High</td> 1535 <td>None*</td> 1536 <td>Sep 26, 2016</td> 1537 </tr> 1538 </table> 1539 <p> 1540 * Supported Google devices on Android 7.0 or later that have installed all 1541 available updates are not affected by this vulnerability. 1542 </p> 1543 1544 1545 <h3 id="id-in-mediatek-video-driver">Information disclosure vulnerability in 1546 MediaTek video driver</h3> 1547 <p> 1548 An information disclosure vulnerability in the MediaTek video driver could 1549 enable a local malicious application to access data outside of its permission 1550 levels. This issue is rated as High because it could be used to access 1551 sensitive data without explicit user permission. 1552 </p> 1553 1554 <table> 1555 <col width="19%"> 1556 <col width="20%"> 1557 <col width="10%"> 1558 <col width="23%"> 1559 <col width="17%"> 1560 <tr> 1561 <th>CVE</th> 1562 <th>References</th> 1563 <th>Severity</th> 1564 <th>Updated Google devices</th> 1565 <th>Date reported</th> 1566 </tr> 1567 <tr> 1568 <td>CVE-2016-8396</td> 1569 <td>A-31249105</td> 1570 <td>High</td> 1571 <td>None*</td> 1572 <td>Aug 26, 2016</td> 1573 </tr> 1574 </table> 1575 <p> 1576 * Supported Google devices on Android 7.0 or later that have installed all 1577 available updates are not affected by this vulnerability. 1578 </p> 1579 1580 1581 <h3 id="id-in-nvidia-video-driver">Information disclosure vulnerability in 1582 NVIDIA video driver</h3> 1583 <p> 1584 An information disclosure vulnerability in the NVIDIA video driver could enable 1585 a local malicious application to access data outside of its permission levels. 1586 This issue is rated as High because it could be used to access sensitive data 1587 without explicit user permission. 1588 </p> 1589 1590 <table> 1591 <col width="19%"> 1592 <col width="20%"> 1593 <col width="10%"> 1594 <col width="23%"> 1595 <col width="17%"> 1596 <tr> 1597 <th>CVE</th> 1598 <th>References</th> 1599 <th>Severity</th> 1600 <th>Updated Google devices</th> 1601 <th>Date reported</th> 1602 </tr> 1603 <tr> 1604 <td>CVE-2016-8397</td> 1605 <td>A-31385953*<br> 1606 N-CVE-2016-8397</td> 1607 <td>High</td> 1608 <td>Nexus 9</td> 1609 <td>Sep 8, 2016</td> 1610 </tr> 1611 </table> 1612 <p> 1613 * The patch for this issue is not publicly available. The update is contained in 1614 the latest binary drivers for Google devices available from the <a 1615 href="https://developers.google.com/android/nexus/drivers">Google Developer 1616 site</a>. 1617 </p> 1618 1619 <h3 id="dos-in-gps">Denial of service vulnerability in GPS</h3> 1620 <p> 1621 A denial of service vulnerability in the Qualcomm GPS component could enable a 1622 remote attacker to cause a device hang or reboot. This issue is rated as High 1623 due to the possibility of a temporary remote denial of service. 1624 </p> 1625 1626 <table> 1627 <col width="19%"> 1628 <col width="20%"> 1629 <col width="10%"> 1630 <col width="23%"> 1631 <col width="17%"> 1632 <tr> 1633 <th>CVE</th> 1634 <th>References</th> 1635 <th>Severity</th> 1636 <th>Updated Google devices</th> 1637 <th>Date reported</th> 1638 </tr> 1639 <tr> 1640 <td>CVE-2016-5341</td> 1641 <td>A-31470303*</td> 1642 <td>High</td> 1643 <td>Nexus 6, Nexus 5X, Nexus 6P, Nexus 9, Android One, Pixel, 1644 Pixel XL</td> 1645 <td>Jun 21, 2016</td> 1646 </tr> 1647 </table> 1648 <p> 1649 * The patch for this issue is not publicly available. The update is contained in 1650 the latest binary drivers for Google devices available from the <a 1651 href="https://developers.google.com/android/nexus/drivers">Google Developer 1652 site</a>. 1653 </p> 1654 1655 <h3 id="dos-in-nvidia-camera-driver">Denial of service vulnerability in NVIDIA 1656 camera driver</h3> 1657 <p> 1658 A denial of service vulnerability in the NVIDIA camera driver could enable an 1659 attacker to cause a local permanent denial of service, which may require 1660 reflashing the operating system to repair the device. This issue is rated as 1661 High due to the possibility of local permanent denial of service. 1662 </p> 1663 1664 <table> 1665 <col width="19%"> 1666 <col width="20%"> 1667 <col width="10%"> 1668 <col width="23%"> 1669 <col width="17%"> 1670 <tr> 1671 <th>CVE</th> 1672 <th>References</th> 1673 <th>Severity</th> 1674 <th>Updated Google devices</th> 1675 <th>Date reported</th> 1676 </tr> 1677 <tr> 1678 <td>CVE-2016-8395</td> 1679 <td>A-31403040* 1680 <br>N-CVE-2016-8395</td> 1681 <td>High</td> 1682 <td>Pixel C</td> 1683 <td>Sep 9, 2016</td> 1684 </tr> 1685 </table> 1686 <p> 1687 * The patch for this issue is not publicly available. The update is contained in 1688 the latest binary drivers for Google devices available from the <a 1689 href="https://developers.google.com/android/nexus/drivers">Google Developer 1690 site</a>. 1691 </p> 1692 1693 <h3 id="eop-in-kernel-networking-subsystem">Elevation of privilege 1694 vulnerability in kernel networking subsystem</h3> 1695 <p> 1696 An elevation of privilege vulnerability in the kernel networking subsystem 1697 could enable a local malicious application to execute arbitrary code within the 1698 context of the kernel. This issue is rated as Moderate because it first 1699 requires compromising a privileged process and current compiler optimizations 1700 restrict access to the vulnerable code. 1701 </p> 1702 1703 <table> 1704 <col width="19%"> 1705 <col width="20%"> 1706 <col width="10%"> 1707 <col width="23%"> 1708 <col width="17%"> 1709 <tr> 1710 <th>CVE</th> 1711 <th>References</th> 1712 <th>Severity</th> 1713 <th>Updated Google devices</th> 1714 <th>Date reported</th> 1715 </tr> 1716 <tr> 1717 <td>CVE-2016-8399</td> 1718 <td>A-31349935*</td> 1719 <td>Moderate</td> 1720 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1721 Player, Pixel, Pixel XL</td> 1722 <td>Sep 5, 2016</td> 1723 </tr> 1724 </table> 1725 <p> 1726 * The patch for this issue is not publicly available. The update is contained in 1727 the latest binary drivers for Google devices available from the <a 1728 href="https://developers.google.com/android/nexus/drivers">Google Developer 1729 site</a>. 1730 </p> 1731 1732 <h3 id="id-in-qualcomm-components">Information disclosure vulnerability in 1733 Qualcomm components</h3> 1734 <p> 1735 An information disclosure vulnerability in Qualcomm components including the 1736 camera driver and video driver could enable a local malicious application to 1737 access data outside of its permission levels. This issue is rated as Moderate 1738 because it first requires compromising a privileged process. 1739 </p> 1740 1741 <table> 1742 <col width="19%"> 1743 <col width="20%"> 1744 <col width="10%"> 1745 <col width="23%"> 1746 <col width="17%"> 1747 <tr> 1748 <th>CVE</th> 1749 <th>References</th> 1750 <th>Severity</th> 1751 <th>Updated Google devices</th> 1752 <th>Date reported</th> 1753 </tr> 1754 <tr> 1755 <td>CVE-2016-6756</td> 1756 <td>A-29464815<br> 1757 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=f91d28dcba304c9f3af35b5bebaa26233c8c13a5"> 1758 QC-CR#1042068</a> 1759 [<a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=3a214ef870dc97437c7de79a1507dfe5079dce88">2</a>]</td> 1760 <td>Moderate</td> 1761 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1762 <td>Jun 17, 2016</td> 1763 </tr> 1764 <tr> 1765 <td>CVE-2016-6757</td> 1766 <td>A-30148242<br> 1767 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=cd99d3bbdb16899a425716e672485e0cdc283245"> 1768 QC-CR#1052821</a></td> 1769 <td>Moderate</td> 1770 <td>Nexus 5X, Nexus 6, Nexus 6P, Pixel, Pixel XL</td> 1771 <td>Jul 13, 2016</td> 1772 </tr> 1773 </table> 1774 1775 1776 <h3 id="id-in-nvidia-librm-library">Information disclosure vulnerability in 1777 NVIDIA librm library</h3> 1778 <p> 1779 An information disclosure vulnerability in the NVIDIA librm library (libnvrm) 1780 could enable a local malicious application to access data outside of its 1781 permission levels. This issue is rated as Moderate because it could be used to 1782 access sensitive data without permission. 1783 </p> 1784 1785 <table> 1786 <col width="19%"> 1787 <col width="20%"> 1788 <col width="10%"> 1789 <col width="23%"> 1790 <col width="17%"> 1791 <tr> 1792 <th>CVE</th> 1793 <th>References</th> 1794 <th>Severity</th> 1795 <th>Updated Google devices</th> 1796 <th>Date reported</th> 1797 </tr> 1798 <tr> 1799 <td>CVE-2016-8400</td> 1800 <td>A-31251599* 1801 <br>N-CVE-2016-8400</td> 1802 <td>Moderate</td> 1803 <td>Pixel C</td> 1804 <td>Aug 29, 2016</td> 1805 </tr> 1806 </table> 1807 <p> 1808 * The patch for this issue is not publicly available. The update is contained in 1809 the latest binary drivers for Google devices available from the <a 1810 href="https://developers.google.com/android/nexus/drivers">Google Developer 1811 site</a>. 1812 </p> 1813 1814 <h3 id="id-in-kernel-components">Information disclosure vulnerability in kernel 1815 components</h3> 1816 <p> 1817 An information disclosure vulnerability in kernel components including the ION 1818 subsystem, Binder, USB driver and networking subsystem could enable a local 1819 malicious application to access data outside of its permission levels. This 1820 issue is rated as Moderate because it first requires compromising a privileged 1821 process. 1822 </p> 1823 1824 <table> 1825 <col width="19%"> 1826 <col width="20%"> 1827 <col width="10%"> 1828 <col width="23%"> 1829 <col width="17%"> 1830 <tr> 1831 <th>CVE</th> 1832 <th>References</th> 1833 <th>Severity</th> 1834 <th>Updated Google devices</th> 1835 <th>Date reported</th> 1836 </tr> 1837 <tr> 1838 <td>CVE-2016-8401</td> 1839 <td>A-31494725*</td> 1840 <td>Moderate</td> 1841 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1842 Player, Pixel, Pixel XL</td> 1843 <td>Sep 13, 2016</td> 1844 </tr> 1845 <tr> 1846 <td>CVE-2016-8402</td> 1847 <td>A-31495231*</td> 1848 <td>Moderate</td> 1849 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1850 Player, Pixel, Pixel XL</td> 1851 <td>Sep 13, 2016</td> 1852 </tr> 1853 <tr> 1854 <td>CVE-2016-8403</td> 1855 <td>A-31495348*</td> 1856 <td>Moderate</td> 1857 <td>Nexus 9</td> 1858 <td>Sep 13, 2016</td> 1859 </tr> 1860 <tr> 1861 <td>CVE-2016-8404</td> 1862 <td>A-31496950*</td> 1863 <td>Moderate</td> 1864 <td>Nexus 9</td> 1865 <td>Sep 13, 2016</td> 1866 </tr> 1867 <tr> 1868 <td>CVE-2016-8405</td> 1869 <td>A-31651010*</td> 1870 <td>Moderate</td> 1871 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1872 Player, Pixel, Pixel XL</td> 1873 <td>Sep 21, 2016</td> 1874 </tr> 1875 <tr> 1876 <td>CVE-2016-8406</td> 1877 <td>A-31796940*</td> 1878 <td>Moderate</td> 1879 <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus 1880 Player, Pixel, Pixel XL</td> 1881 <td>Sep 27, 2016</td> 1882 </tr> 1883 <tr> 1884 <td>CVE-2016-8407</td> 1885 <td>A-31802656*</td> 1886 <td>Moderate</td> 1887 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td> 1888 <td>Sep 28, 2016</td> 1889 </tr> 1890 </table> 1891 <p> 1892 * The patch for this issue is not publicly available. The update is contained in 1893 the latest binary drivers for Google devices available from the <a 1894 href="https://developers.google.com/android/nexus/drivers">Google Developer 1895 site</a>. 1896 </p> 1897 1898 <h3 id="id-in-nvidia-video-driver-2">Information disclosure vulnerability in 1899 NVIDIA video driver</h3> 1900 <p> 1901 An information disclosure vulnerability in the NVIDIA video driver could enable 1902 a local malicious application to access data outside of its permission levels. 1903 This issue is rated as Moderate because it first requires compromising a 1904 privileged process. 1905 </p> 1906 1907 <table> 1908 <col width="19%"> 1909 <col width="20%"> 1910 <col width="10%"> 1911 <col width="23%"> 1912 <col width="17%"> 1913 <tr> 1914 <th>CVE</th> 1915 <th>References</th> 1916 <th>Severity</th> 1917 <th>Updated Google devices</th> 1918 <th>Date reported</th> 1919 </tr> 1920 <tr> 1921 <td>CVE-2016-8408</td> 1922 <td>A-31496571* 1923 <br>N-CVE-2016-8408</td> 1924 <td>Moderate</td> 1925 <td>Nexus 9</td> 1926 <td>Sep 13, 2016</td> 1927 </tr> 1928 <tr> 1929 <td>CVE-2016-8409</td> 1930 <td>A-31495687* 1931 <br>N-CVE-2016-8409</td> 1932 <td>Moderate</td> 1933 <td>Nexus 9</td> 1934 <td>Sep 13, 2016</td> 1935 </tr> 1936 </table> 1937 <p> 1938 * The patch for this issue is not publicly available. The update is contained in 1939 the latest binary drivers for Google devices available from the <a 1940 href="https://developers.google.com/android/nexus/drivers">Google Developer 1941 site</a>. 1942 </p> 1943 1944 <h3 id="id-in-qualcomm-sound-driver">Information disclosure vulnerability in 1945 Qualcomm sound driver</h3> 1946 <p> 1947 An information disclosure vulnerability in the Qualcomm sound driver could 1948 enable a local malicious application to access data outside of its permission 1949 levels. This issue is rated as Moderate because it first requires compromising 1950 a privileged process. 1951 </p> 1952 1953 <table> 1954 <col width="19%"> 1955 <col width="20%"> 1956 <col width="10%"> 1957 <col width="23%"> 1958 <col width="17%"> 1959 <tr> 1960 <th>CVE</th> 1961 <th>References</th> 1962 <th>Severity</th> 1963 <th>Updated Google devices</th> 1964 <th>Date reported</th> 1965 </tr> 1966 <tr> 1967 <td>CVE-2016-8410</td> 1968 <td>A-31498403<br> 1969 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?h=e2bbf665187a1f0a1248e4a088823cb182153ba9"> 1970 QC-CR#987010</a></td> 1971 <td>Moderate</td> 1972 <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td> 1973 <td>Google internal</td> 1974 </tr> 1975 </table> 1976 1977 <h2 id="common-questions-and-answers">Common Questions and Answers</h2> 1978 <p> 1979 This section answers common questions that may occur after reading this 1980 bulletin. 1981 </p> 1982 <p> 1983 <strong>1. How do I determine if my device is updated to address these issues? 1984 </strong> 1985 </p> 1986 <p> 1987 To learn how to check a device's security patch level, read the instructions on 1988 the <a 1989 href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel 1990 and Nexus update schedule</a>. 1991 </p> 1992 <ul> 1993 <li>Security patch levels of 2016-12-01 or later address all issues associated 1994 with the 2016-12-01 security patch level.</li> 1995 <li>Security patch levels of 2016-12-05 or later address all issues associated 1996 with the 2016-12-05 security patch level and all previous patch levels.</li> 1997 </ul> 1998 <p> 1999 Device manufacturers that include these updates should set the patch string 2000 level to: 2001 </p> 2002 <ul> 2003 <li>[ro.build.version.security_patch]:[2016-12-01]</li> 2004 <li>[ro.build.version.security_patch]:[2016-12-05]</li> 2005 </ul> 2006 <p> 2007 <strong>2. Why does this bulletin have two security patch levels?</strong> 2008 </p> 2009 <p> 2010 This bulletin has two security patch levels so that Android partners have the 2011 flexibility to fix a subset of vulnerabilities that are similar across all 2012 Android devices more quickly. Android partners are encouraged to fix all issues 2013 in this bulletin and use the latest security patch level. 2014 </p> 2015 <ul> 2016 <li>Devices that use the December 1, 2016 security patch level must include all 2017 issues associated with that security patch level, as well as fixes for all 2018 issues reported in previous security bulletins.</li> 2019 <li>Devices that use the security patch level of December 5, 2016 or newer must 2020 include all applicable patches in this (and previous) security 2021 bulletins.</li> 2022 </ul> 2023 <p> 2024 Partners are encouraged to bundle the fixes for all issues they are addressing 2025 in a single update. 2026 </p> 2027 <p> 2028 <strong>3. How do I determine which Google devices are affected by each 2029 issue?</strong> 2030 </p> 2031 <p> 2032 In the <a 2033 href="#2016-12-01-details">2016-12-01</a> and 2034 <a href="#2016-12-05-details">2016-12-05</a> 2035 security vulnerability details sections, each table has an <em>Updated Google 2036 devices</em> column that covers the range of affected Google devices updated for 2037 each issue. This column has a few options: 2038 </p> 2039 <ul> 2040 <li><strong>All Google devices</strong>: If an issue affects All and Pixel 2041 devices, the table will have "All" in the <em>Updated Google devices</em> 2042 column. "All" encapsulates the following <a 2043 href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported 2044 devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, 2045 Android One, Nexus Player, Pixel C, Pixel, and Pixel XL.</li> 2046 <li><strong>Some Google devices</strong>: If an issue doesn't affect all Google 2047 devices, the affected Google devices are listed in the <em>Updated Google 2048 devices</em> column.</li> 2049 <li><strong>No Google devices</strong>: If no Google devices running Android 7.0 2050 are affected by the issue, the table will have "None" in the <em>Updated Google 2051 devices</em> column.</li> 2052 </ul> 2053 <p> 2054 <strong>4. What do the entries in the references column map to?</strong> 2055 </p> 2056 <p> 2057 Entries under the <em>References</em> column of the vulnerability details table 2058 may contain a prefix identifying the organization to which the reference value 2059 belongs. These prefixes map as follows: 2060 </p> 2061 <table> 2062 <tr> 2063 <th>Prefix</th> 2064 <th>Reference</th> 2065 </tr> 2066 <tr> 2067 <td>A-</td> 2068 <td>Android bug ID</td> 2069 </tr> 2070 <tr> 2071 <td>QC-</td> 2072 <td>Qualcomm reference number</td> 2073 </tr> 2074 <tr> 2075 <td>M-</td> 2076 <td>MediaTek reference number</td> 2077 </tr> 2078 <tr> 2079 <td>N-</td> 2080 <td>NVIDIA reference number</td> 2081 </tr> 2082 <tr> 2083 <td>B-</td> 2084 <td>Broadcom reference number</td> 2085 </tr> 2086 </table> 2087 <h2 id="revisions">Revisions</h2> 2088 <ul> 2089 <li>December 05, 2016: Bulletin published.</li> 2090 <li>December 07, 2016: Bulletin revised to include AOSP links and updated 2091 attribution for CVE-2016-6915, CVE-2016-6916 and CVE-2016-6917.</li> 2092 <li>December 21, 2016: Corrected typos in CVE-2016-8411 description and 2093 Common Questions and Answers.</li> 2094 </ul> 2095 2096 </body> 2097 </html> 2098
