security/bulletin/2016-05-01.html

<html devsite>
  <head>
    <title>   Android  2016.</title>
    <meta name="project_path" value="/_project.yaml" />
    <meta name="book_path" value="/_book.yaml" />
  </head>
  <body>
  <!--
      Copyright 2017 The Android Open Source Project

      Licensed under the Apache License, Version 2.0 (the "License");
      you may not use this file except in compliance with the License.
      You may obtain a copy of the License at

          http://www.apache.org/licenses/LICENSE-2.0

      Unless required by applicable law or agreed to in writing, software
      distributed under the License is distributed on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
      See the License for the specific language governing permissions and
      limitations under the License.
  -->


<p><em> 2 2016. |  4 2016.</em></p>

<p>
 Android.
    Nexus     Nexus
 <a href="https://developers.google.com/android/nexus/images">  </a>.

 1 2016   .  ,
  ,   <a href="https://support.google.com/nexus/answer/4457705"> Nexus</a>.</p>

<p>     4 2016  .
      Android Open Source Project (AOSP).</p>

<p>
      (,
  ,
 MMS).</p>

<p>   .   <a href="#mitigations"> </a>
,  <a href="/security/enhancements/index.html"> </a>    ,
 SafetyNet,      Android.</p>

<p>        .</p>

<h2 id="announcements"></h2>


<ul>
  <li>      Nexus
         Android.
       ,      Android,
            Nexus.</li>
  <li>   ,    6,
       <a href="/security/overview/updates-resources.html#severity"> </a> .

          .</li>
</ul>

<h2 id="security_vulnerability_summary"> </h2>


<p>    ,   (CVE)
  ,   ,     Nexus.

<a href="/security/overview/updates-resources.html#severity"> </a>   ,
    ,
  .</p>
<table>
  <col width="55%">
  <col width="20%">
  <col width="13%">
  <col width="12%">
 <tr>
    <th></th>
    <th>CVE</th>
    <th> </th>
    <th>  Nexus?</th>
 </tr>
 <tr>
    <td>    mediaserver</td>
    <td>CVE-2016-2428<br>
        CVE-2016-2429</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Debuggerd</td>
    <td>CVE-2016-2430</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   TrustZone  Qualcomm </td>
    <td>CVE-2016-2431<br>
        CVE-2016-2432</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi- Qualcomm</td>
    <td>CVE-2015-0569<br>
        CVE-2015-0570</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>    NVIDIA </td>
    <td>CVE-2016-2434<br>
        CVE-2016-2435<br>
        CVE-2016-2436<br>
        CVE-2016-2437</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   </td>
    <td>CVE-2015-1805</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>    </td>
    <td>CVE-2016-2438</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>      Qualcomm</td>
    <td>CVE-2016-2060</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>    Bluetooth</td>
    <td>CVE-2016-2439</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Binder</td>
    <td>CVE-2016-2440</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Buspm- Qualcomm</td>
    <td>CVE-2016-2441<br>
        CVE-2016-2442</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   MDP- Qualcomm</td>
    <td>CVE-2016-2443</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi- Qualcomm</td>
    <td>CVE-2015-0571</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>    NVIDIA</td>
    <td>CVE-2016-2444<br>
        CVE-2016-2445<br>
        CVE-2016-2446</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi</td>
    <td>CVE-2016-4477</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   mediaserver</td>
    <td>CVE-2016-2448<br>
        CVE-2016-2449<br>
        CVE-2016-2450<br>
        CVE-2016-2451<br>
        CVE-2016-2452</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi- MediaTek</td>
    <td>CVE-2016-2453</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>      Qualcomm</td>
    <td>CVE-2016-2454</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Conscrypt</td>
    <td>CVE-2016-2461<br>
        CVE-2016-2462</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   OpenSSL  BoringSSL</td>
    <td>CVE-2016-0705</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi- MediaTek</td>
    <td>CVE-2016-2456</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   Wi-Fi</td>
    <td>CVE-2016-2457</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>     AOSP </td>
    <td>CVE-2016-2458</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>   mediaserver</td>
    <td>CVE-2016-2459<br>
        CVE-2016-2460</td>
    <td></td>
    <td></td>
 </tr>
 <tr>
    <td>    </td>
    <td>CVE-2016-0774</td>
    <td></td>
    <td></td>
 </tr>
</table>


<h2 id="android_and_google_service_mitigations"> </h2>


<p> ,  <a href="/security/enhancements/index.html"> </a>    ,
 SafetyNet,      Android.</p>

<ul>
  <li>        Android,

       .</li>
  <li> ,    Android,
          <a href="/security/reports/Google_Android_Security_2015_Report_Final.pdf">   SafetyNet</a>.

       <a href="/security/reports/Google_Android_Security_PHA_classifications.pdf">  </a>.
             <a href="http://www.android.com/gms">  Google</a>.
         ,
       .   Google Play    ,
            .
         ,    .
         ,      ,
           ,
        .        ,
              .</li>
  <li>  Google Hangouts  Messenger
       ,  mediaserver, .</li>
</ul>

<h2 id="acknowledgements"></h2>


<p> ,    :</p>

<ul>
  <li>  ,
        Google Chrome: CVE-2016-2454
  <li>   (<a href="https://twitter.com/ticarpi">@ticarpi</a>)
       <a href="https://www.e2e-assure.com">e2e-assure</a>: CVE-2016-2457
  <li>   (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>)
          <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2441,
       CVE-2016-2442
  <li>
       (<a href="http://www.linkedin.com/in/dzima">www.linkedin.com/in/dzima</a>): CVE-2016-2458
  <li>  : CVE-2016-2431
  <li>    Vulpecker Team, Qihoo360 Technology Co. Ltd: CVE-2016-2456
  <li>    Mandiant,   FireEye: CVE-2016-2060
  <li>   (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>)
        pjf (<a href="http://weibo.com/jfpan">weibo.com/jfpan</a>)  IceSword Lab,
       Qihoo360 Technology Co. Ltd: CVE-2016-2434, CVE-2016-2435, CVE-2016-2436,
       CVE-2016-2441, CVE-2016-2442, CVE-2016-2444, CVE-2016-2445, CVE-2016-2446
  <li>    <a href="http://www.search-lab.hu">Search-Lab Ltd.</a>: CVE-2016-4477
  <li>    Google: CVE-2016-2461
  <li>    Google: CVE-2016-2462
  <li>   (<a href="https://twitter.com/marcograss">@marcograss</a>)  KeenLab
       (<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2016-2443
  <li>
       (<a href="https://github.com/michalbednarski">https://github.com/michalbednarski</a>): CVE-2016-2440
  <li>   (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
         (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>)
         <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2450, CVE-2016-2448,
       CVE-2016-2449, CVE-2016-2451, CVE-2016-2452
  <li>   (<a href="https://twitter.com/heisecode">@heisecode</a>)  Trend Micro:
       CVE-2016-2459, CVE-2016-2460
  <li>   (<a href="https://twitter.com/sunblate">@sunblate</a>)  Alibaba Inc.:
       CVE-2016-2428, CVE-2016-2429
  <li> <a href="mailto:computernik (a] gmail.com">- </a>,
       <a href="mailto:zlbzlb815 (a] 163.com"> </a>,   (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>)
           <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-2437
  <li>     ()   Baidu X-Lab: CVE-2016-2439
  <li>   (<a href="https://twitter.com/ebeip90">@ebeip90</a>)
        Android: CVE-2016-2430
</li></li></li></li></li></li></li></li></li></li></li></li></li></li></li></li></li></li></li></ul>

<h2 id="security_vulnerability_details"> </h2>


<p>         <a href="#security_vulnerability_summary"> </a>
: ,  ,     CVE,
 ,  ,   Nexus   AOSP
( )     .
 ,
     AOSP,    ,
     .</p>

<h3 id="remote_code_execution_vulnerability_in_mediaserver">
    mediaserver</h3>


<p>

      mediaserver.</p>

<p>     .
 ,  MMS-
  ,    .</p>

<p>     -
      mediaserver.
 -  ,    ,
.</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2428</td>
    <td><a href="https://android.googlesource.com/platform/external/aac/+/5d4405f601fa11a8955fd7611532c982420e4206">
        26751339</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>22 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2429</td>
    <td><a href="https://android.googlesource.com/platform/external/flac/+/b499389da21d89d32deff500376c5ee4f8f0b04c">
        27211885</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>16 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_debuggerd">
   Debuggerd</h3>


<p>
   Android.     ,
 -     . ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2430</td>
    <td><a href="https://android.googlesource.com/platform/system/core/+/ad54cfed4516292654c997910839153264ae00a0">
        27299236</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>22 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_qualcomm_trustzone">
   TrustZone  Qualcomm </h3>


<p>
   TrustZone.     ,
 -     . ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2431</td>
    <td>24968809*</td>
    <td></td>
    <td>Nexus5, Nexus6, Nexus7 (2013), AndroidOne</td>
    <td>15 2015.</td>
 </tr>
 <tr>
    <td>CVE-2016-2432</td>
    <td>25913059*</td>
    <td></td>
    <td>Nexus6, AndroidOne</td>
    <td>28 2015.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_qualcomm_wi-fi_driver">
   Wi-Fi- Qualcomm</h3>


<p>
       .
  ,  -
 . ,
 .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2015-0569</td>
    <td>26754117*</td>
    <td></td>
    <td>Nexus5X, Nexus7 (2013)</td>
    <td>23 2016.</td>
 </tr>
 <tr>
    <td>CVE-2015-0570</td>
    <td>26764809*</td>
    <td></td>
    <td>Nexus5X, Nexus7 (2013)</td>
    <td>25 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_nvidia_video_driver">
    NVIDIA</h3>


<p>
   .     ,
-     . ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2434</td>
    <td>27251090*</td>
    <td></td>
    <td>Nexus9</td>
    <td>17 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2435</td>
    <td>27297988*</td>
    <td></td>
    <td>Nexus9</td>
    <td>20 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2436</td>
    <td>27299111*</td>
    <td></td>
    <td>Nexus9</td>
    <td>22 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2437</td>
    <td>27436822*</td>
    <td></td>
    <td>Nexus9</td>
    <td>1 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_kernel">
   </h3>


<p>
       .
  ,  -
 . ,
  .
 <a href="/security/advisory/2016-03-18.html">   Android</a>  18 2016.</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2015-1805</td>
    <td>27275324*</td>
    <td></td>
    <td>Nexus5, Nexus5X, Nexus6, Nexus6P, Nexus7 (2013), Nexus9</td>
    <td>19 2016.</td>
 </tr>
</table>
<p>*   AOSP    :
<a href="https://android.googlesource.com/kernel/common/+/bf010e99c9bc48002f6bfa1ad801a59bf996270f">3.14</a>
<a href="https://android.googlesource.com/kernel/common/+/4a5a45669796c5b4617109182e25b321f9f00beb">3.10</a>
<a href="https://android.googlesource.com/kernel/common/+/f7ebfe91b806501808413c8473a300dff58ddbb5">3.4</a></p>

<h3 id="remote_code_execution_vulnerability_in_kernel">
    </h3>


<p>
    .  ,
  ,
   ,   ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2438</td>
    <td>26636060*</td>
    <td></td>
    <td>Nexus9 </td>
    <td>   Google</td>
 </tr>
</table>
<p>*   <a href="https://github.com/torvalds/linux/commit/b5a663aa426f4884c71cd8580adae73f33570f0d"> Linux</a>.</p>

<h3 id="information_disclosure_vulnerability_in_qualcomm_tethering_controller">
      Qualcomm</h3>


<p>
  ,      .
     ,
  ,
(, <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a>  <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>).</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2060</td>
    <td>27942588*</td>
    <td></td>
    <td></td>
    <td>23 2016.</td>
 </tr>
</table>
<p>*    AOSP.
    ,    .</p>

<h3 id="remote_code_execution_vulnerability_in_bluetooth">
    Bluetooth</h3>


<p>
      Bluetooth. -
    .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2439</td>
    <td><a href="https://android.googlesource.com/platform/system/bt/+/9b534de2aca5d790c2a1c4d76b545f16137d95dd">
        27411268</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>28 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_binder">
   Binder</h3>


<p>
     (  ). -
    .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2440</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/native/+/a59b827869a2ea04022dd225007f29af8d61837a">
        27252896</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>18 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_qualcomm_buspm_driver">
   Buspm- Qualcomm</h3>


<p>
   .  ,
 ,
,  ,      .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2441</td>
    <td>26354602*</td>
    <td></td>
    <td>Nexus5X, Nexus6, Nexus6P</td>
    <td>30 2015.</td>
 </tr>
 <tr>
    <td>CVE-2016-2442</td>
    <td>26494907*</td>
    <td></td>
    <td>Nexus5X, Nexus6, Nexus6P</td>
    <td>30 2015.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_qualcomm_mdp_driver">
   MDP- Qualcomm</h3>


<p>
   .  ,
  ,
  ,  ,
 .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2443</td>
    <td>26404525*</td>
    <td></td>
    <td>Nexus5, Nexus7 (2013)</td>
    <td>5 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_qualcomm_wi-fi_driver">
   Wi-Fi- Qualcomm</h3>


<p>

 .     ,
     ,
(, <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a>  <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>).</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2015-0571</td>
    <td>26763920*</td>
    <td></td>
    <td>Nexus5X, Nexus7 (2013)</td>
    <td>25 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_nvidia_video_driver">
    NVIDIA</h3>


<p>
   .  ,
 ,
 ,  ,
   .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2444</td>
    <td>27208332*</td>
    <td></td>
    <td>Nexus9</td>
    <td>16 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2445</td>
    <td>27253079*</td>
    <td></td>
    <td>Nexus9</td>
    <td>17 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2446</td>
    <td>27441354*</td>
    <td></td>
    <td>Nexus9</td>
    <td>1 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_wi-fi">
   Wi-Fi</h3>


<p>
      .
 ,       ,
   (, <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a>  <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>).</p>

<p><strong>.</strong>    MITRE   (CVE)    CVE-2016-2447  CVE-2016-4477.</p>

<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-4477</td>
    <td><a href="https://android.googlesource.com/platform/external/wpa_supplicant_8/+/b79e09574e50e168dd5f19d540ae0b9a05bd1535">
        27371366</a>
        [<a href="https://android.googlesource.com/platform/external/wpa_supplicant_8/+/b845b81ec6d724bd359cdb77f515722dd4066cf8">2</a>]
    </td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>24 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_mediaserver">
   mediaserver</h3>


<p>

.     ,
     ,
 (, <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">Signature</a>  <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">SignatureOrSystem</a>).</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2448</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/a2d1d85726aa2a3126e9c331a8e00a8c319c9e2b">
        27533704</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>7 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2449</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/b04aee833c5cfb6b31b8558350feb14bb1a0f353">
        27568958</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>9 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2450</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/7fd96ebfc4c9da496c59d7c45e1f62be178e626d">
        27569635</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>9 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2451</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/f9ed2fe6d61259e779a37d4c2d7edb33a1c1f8ba">
        27597103</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>10 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2452</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/44749eb4f273f0eb681d0fa013e3beef754fa687">
        27662364</a>
        [<a href="https://android.googlesource.com/platform/frameworks/av/+/65756b4082cd79a2d99b2ccb5b392291fd53703f">2</a>]
        [<a href="https://android.googlesource.com/platform/frameworks/av/+/daa85dac2055b22dabbb3b4e537597e6ab73a866">3</a>]
    </td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>14 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_mediatek_wi-fi_driver">
   Wi-Fi- MediaTek</h3>


<p>
   .  ,
 ,
,  ,      .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2453</td>
    <td>27549705*</td>
    <td></td>
    <td>AndroidOne</td>
    <td>8 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="remote_denial_of_service_vulnerability_in_qualcomm_hardware_codec">
      Qualcomm</h3>


<p>
      ,
  .     ,
      .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2454</td>
    <td>26221024*</td>
    <td></td>
    <td>Nexus5</td>
    <td>16 2015.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_conscrypt">
   Conscrypt</h3>


<p>       .
     ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2461</td>
    <td><a href="https://android.googlesource.com/platform/external/conscrypt/+/50d0447566db4a77d78d592f1c1b5d31096fac8f">
        27324690</a>
        [<a href="https://android.googlesource.com/platform/external/conscrypt/+/1638945d4ed9403790962ec7abed1b7a232a9ff8">2</a>]
    </td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>6.0, 6.0.1</td>
    <td>   Google</td>
 </tr>
 <tr>
    <td>CVE-2016-2462</td>
    <td><a href="https://android.googlesource.com/platform/external/conscrypt/+/8bec47d2184fca7e8b7337d2a65b2b75a9bc8f54">
        27371173</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>6.0, 6.0.1</td>
    <td>   Google</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_openssl_&amp;_boringssl">
   OpenSSL  BoringSSL</h3>


<p>
   .
 ,
  ,
  ,  .
  .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-0705</td>
    <td><a href="https://android.googlesource.com/platform/external/boringssl/+/591be84e89682622957c8f103ca4be3a5ed0f800">
        27449871</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>7 2016.</td>
 </tr>
</table>


<h3 id="elevation_of_privilege_vulnerability_in_mediatek_wi-fi_driver">
   Wi-Fi- MediaTek</h3>


<p>        .
  ,      ,
          ,
     .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2456</td>
    <td>27275187*</td>
    <td></td>
    <td>AndroidOne</td>
    <td>19 2016.</td>
 </tr>
</table>
<p>*    AOSP.
      Nexus,
   <a href="https://developers.google.com/android/nexus/drivers">  </a>.</p>

<h3 id="elevation_of_privilege_vulnerability_in_wi-fi">
   Wi-Fi</h3>


<p>      Wi-Fi
.     ,
       <a href="http://developer.android.com/guide/topics/manifest/permission-element.html#plevel">dangerous</a> ().</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2457</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/12332e05f632794e18ea8c4ac52c98e82532e5db">
        27411179</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>29 2016.</td>
 </tr>
</table>


<h3 id="information_disclosure_vulnerability_in_aosp_mail">
     AOSP</h3>


<p>
    . -
  .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2458</td>
    <td><a href="https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/a55168330d9326ff2120285763c818733590266a">
        27335139</a>
        [<a href="https://android.googlesource.com/platform/packages/apps/Email/+/2791f0b33b610247ef87278862e66c6045f89693">2</a>]
    </td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>23 2016.</td>
 </tr>
</table>


<h3 id="information_disclosure_vulnerability_in_mediaserver">
   mediaserver</h3>


<p>
  . -
.</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>  AOSP</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-2459</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73">
        27556038</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>7 2016.</td>
 </tr>
 <tr>
    <td>CVE-2016-2460</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/native/+/a30d7d90c4f718e46fb41a99b3d52800e1011b73">
        27555981</a></td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>7 2016.</td>
 </tr>
</table>


<h3 id="denial_of_service_vulnerability_in_kernel">
    </h3>


<p>
.     ,
    .</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="27%">
  <col width="16%">
 <tr>
    <th>CVE</th>
    <th> Android</th>
    <th> </th>
    <th>  Nexus</th>
    <th>   </th>
 </tr>
 <tr>
    <td>CVE-2016-0774</td>
    <td>27721803*</td>
    <td></td>
    <td><a href="#nexus_devices"> </a></td>
    <td>17 2016.</td>
 </tr>
</table>
<p>*   <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/fs/pipe.c?id=b381fbc509052d07ccf8641fd7560a25d46aaf1e"> Linux</a>.</p>

<h2 id="common_questions_and_answers">  </h2>


<p>      ,
  .</p>

<p><strong>1.  ,     ,     ?</strong></p>

<p>      1 2016
  .  ,
 ,   <a href="https://support.google.com/nexus/answer/4457705"> Nexus</a>.
,    ,
 [ro.build.version.security_patch]:[2016-05-01].</p>

<p id="nexus_devices"><strong>2.  ,    Nexus  ?</strong></p>

<p>     <a href="security_vulnerability_details"> </a>   "  Nexus".   ,     .</p>

<ul>
  <li> <strong> .</strong>   <em></em>

       <a href="https://support.google.com/nexus/answer/4457705#nexus_devices">  Nexus</a>: Nexus5, Nexus5X, Nexus6,
       Nexus6P, Nexus7 (2013), Nexus9, AndroidOne, Nexus Player
       PixelC.
  <li> <strong> .</strong> <em></em> ,
.</li>
  <li> <strong>.</strong>        Nexus.<em></em></li>
</li></ul>

<p><strong>3.         CVE-2015-1805?</strong></p>
<p><a href="/security/advisory/2016-03-18.html">   Android</a>  18 2016       <a href="2016-04-02.html">   Nexus</a>. -    ,      1 2016,        ,    CVE-2015-1805.         ,           1 2016.</p>
<h2 id="revisions"></h2>


<ul>
  <li> 2 2016.  .</li>
  <li> 4 2016.
    <ul>
      <li>    AOSP.
      <li> ,      Nexus Player  PixelC.
      <li>    MITRE  CVE-2016-2447   CVE-2016-4477.
    </li></li></li></ul>
  </li>
</ul>

  </body>
</html>