Google Git
Sign in
android / platform / docs / source.android.com / eea9cc73ff9c12570ba21be21ab482d2dc938fea / . / src / security / bulletin / 2016-08-01.jd
blob: 3d15c8fd83c824f8af806ff69d71cc78df585ca1 [file] [log] [blame]
page.title=Android Security Bulletin—August 2016
@jd:body
<!--
Copyright 2016 The Android Open Source Project
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<p><em>Published August 01, 2016 | Updated October 21, 2016</em></p>
<p>
The Android Security Bulletin contains details of security vulnerabilities
affecting Android devices. Alongside the bulletin, we have released a security
update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware
images have also been released to the <a
href="https://developers.google.com/android/nexus/images">Google Developer
site</a>. Security Patch Levels of August 05, 2016 or later address these
issues. Refer to the <a
href="https://support.google.com/nexus/answer/4457705#nexus_devices">documentation</a>
to learn how to check the security patch level.
</p>
<p>
Partners were notified about the issues described in the bulletin on July 06,
2016 or earlier. Where applicable, source code patches for these issues have
been released to the Android Open Source Project (AOSP) repository. This
bulletin also includes links to patches outside of AOSP.
</p>
<p>
The most severe of these issues is a Critical security vulnerability that could
enable remote code execution on an affected device through multiple methods such
as email, web browsing, and MMS when processing media files.
</p>
<p>
We have had no reports of active customer exploitation or abuse of these newly
reported issues. Refer to the
<a href="#mitigations">Android and Google service mitigations</a>
section for details on the
<a href="{@docRoot}security/enhancements/index.html">Android
security platform protections</a> and service protections such as SafetyNet,
which improve the security of the Android platform.
</p>
<p>
We encourage all customers to accept these updates to their devices.
</p>
<h2 id="announcements">Announcements</h2>
<ul>
<li>Bulletin revised to correct CVE-2016-3856 to CVE-2016-2060.</li>
<li>This bulletin has two security patch level strings to provide Android
partners with the flexibility to move more quickly to fix a subset of
vulnerabilities that are similar across all Android devices. See <a
href="#common-questions-and-answers">Common questions and answers</a> for
additional information:
<ul>
<li><strong>2016-08-01</strong>: Partial security patch level string. This
security patch level string indicates that all issues associated with 2016-08-01
(and all previous security patch level strings) are addressed.</li>
<li><strong>2016-08-05</strong>: Complete security patch level string. This
security patch level string indicates that all issues associated with 2016-08-01
and 2016-08-05 (and all previous security patch level strings) are addressed.</li>
</ul>
</li>
<li>Supported Nexus devices will receive a single OTA update with the August 05,
2016 security patch level.</li>
</ul>
<h2 id="security-vulnerability-summary">Security vulnerability summary</h2>
<p>
The tables below contain a list of security vulnerabilities, the Common
Vulnerability and Exposures ID (CVE), the assessed severity, and whether or not
Nexus devices are affected. The <a
href="{@docRoot}security/overview/updates-resources.html#severity">severity
assessment</a> is based on the effect that exploiting the vulnerability would
possibly have on an affected device, assuming the platform and service
mitigations are disabled for development purposes or are successfully bypassed.
</p>
<h3 id="2016-08-01-security-patch-level-vulnerability-summary">2016-08-01
security patch level—Vulnerability summary</h3>
<p>
Security patch levels of 2016-08-01 or later must address the following issues.
</p>
<table>
<col width="55%">
<col width="20%">
<col width="13%">
<col width="12%">
<tr>
<th>Issue</th>
<th>CVE</th>
<th>Severity</th>
<th>Affects Nexus?</th>
</tr>
<tr>
<td>Remote code execution vulnerability in Mediaserver</td>
<td>CVE-2016-3819, CVE-2016-3820, CVE-2016-3821</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Remote code execution vulnerability in libjhead</td>
<td>CVE-2016-3822</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Mediaserver</td>
<td>CVE-2016-3823, CVE-2016-3824, CVE-2016-3825, CVE-2016-3826</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Denial of service vulnerability in Mediaserver</td>
<td>CVE-2016-3827, CVE-2016-3828, CVE-2016-3829, CVE-2016-3830</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Denial of service vulnerability in system clock</td>
<td>CVE-2016-3831</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in framework APIs</td>
<td>CVE-2016-3832</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Shell</td>
<td>CVE-2016-3833</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in OpenSSL</td>
<td>CVE-2016-2842</td>
<td>Moderate</td>
<td>No*</td>
</tr>
<tr>
<td>Information disclosure vulnerability in camera APIs</td>
<td>CVE-2016-3834</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in Mediaserver</td>
<td>CVE-2016-3835</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in SurfaceFlinger</td>
<td>CVE-2016-3836</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in Wi-Fi</td>
<td>CVE-2016-3837</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Denial of service vulnerability in system UI</td>
<td>CVE-2016-3838</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Denial of service vulnerability in Bluetooth</td>
<td>CVE-2016-3839</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
</table>
<p>* Supported Nexus devices that have installed all available updates are not
affected by this vulnerability.</p>
<h3 id="2016-08-05-security-patch-level-vulnerability-summary">2016-08-05
security patch level—Vulnerability summary</h3>
<p>
Security patch levels of 2016-08-05 or later must address all of the 2016-08-01
issues as well as the following issues.
</p>
<table>
<col width="55%">
<col width="20%">
<col width="13%">
<col width="12%">
<tr>
<th>Issue</th>
<th>CVE</th>
<th>Severity</th>
<th>Affects Nexus?</th>
</tr>
<tr>
<td>Remote code execution vulnerability in Qualcomm Qualcomm Wi-Fi driver</td>
<td>CVE-2014-9902</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Remote code execution vulnerability in Conscrypt</td>
<td>CVE-2016-3840</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Qualcomm components</td>
<td>CVE-2014-9863, CVE-2014-9864, CVE-2014-9865, CVE-2014-9866,
CVE-2014-9867, CVE-2014-9868, CVE-2014-9869, CVE-2014-9870,
CVE-2014-9871, CVE-2014-9872, CVE-2014-9873, CVE-2014-9874,
CVE-2014-9875, CVE-2014-9876, CVE-2014-9877, CVE-2014-9878,
CVE-2014-9879, CVE-2014-9880, CVE-2014-9881, CVE-2014-9882,
CVE-2014-9883, CVE-2014-9884, CVE-2014-9885, CVE-2014-9886,
CVE-2014-9887, CVE-2014-9888, CVE-2014-9889, CVE-2014-9890,
CVE-2014-9891, CVE-2015-8937, CVE-2015-8938, CVE-2015-8939,
CVE-2015-8940, CVE-2015-8941, CVE-2015-8942, CVE-2015-8943</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel networking component</td>
<td>CVE-2015-2686, CVE-2016-3841</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Qualcomm GPU driver</td>
<td>CVE-2016-2504, CVE-2016-3842</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Qualcomm performance component</td>
<td>CVE-2016-3843</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel</td>
<td>CVE-2016-3857</td>
<td>Critical</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel memory system</td>
<td>CVE-2015-1593, CVE-2016-3672</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel sound component</td>
<td>CVE-2016-2544, CVE-2016-2546, CVE-2014-9904</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel file system</td>
<td>CVE-2012-6701</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Mediaserver</td>
<td>CVE-2016-3844</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel video driver</td>
<td>CVE-2016-3845</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Serial Peripheral Interface
driver</td>
<td>CVE-2016-3846</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in NVIDIA media driver</td>
<td>CVE-2016-3847, CVE-2016-3848</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in ION driver</td>
<td>CVE-2016-3849</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Qualcomm bootloader</td>
<td>CVE-2016-3850</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in kernel performance subsystem</td>
<td>CVE-2016-3843</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in LG Electronics bootloader</td>
<td>CVE-2016-3851</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in Qualcomm components</td>
<td>CVE-2014-9892, CVE-2014-9893 CVE-2014-9894, CVE-2014-9895 CVE-2014-9896,
CVE-2014-9897 CVE-2014-9898, CVE-2014-9899 CVE-2014-9900, CVE-2015-8944</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in kernel scheduler</td>
<td>CVE-2014-9903</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in MediaTek Wi-Fi driver</td>
<td>CVE-2016-3852</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in USB driver</td>
<td>CVE-2016-4482</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Denial of service vulnerability in Qualcomm components</td>
<td>CVE-2014-9901</td>
<td>High</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Google Play services</td>
<td>CVE-2016-3853</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Elevation of privilege vulnerability in Framework APIs</td>
<td>CVE-2016-2497</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in kernel networking component</td>
<td>CVE-2016-4486</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Information disclosure vulnerability in kernel sound component</td>
<td>CVE-2016-4569, CVE-2016-4578</td>
<td>Moderate</td>
<td>Yes</td>
</tr>
<tr>
<td>Vulnerabilities in Qualcomm components</td>
<td>CVE-2016-3854, CVE-2016-3855, CVE-2016-2060</td>
<td>High</td>
<td>No</td>
</tr>
</table>
<h2 id="mitigations">Android and Google service mitigations</h2>
<p>
This is a summary of the mitigations provided by the <a
href="{@docRoot}security/enhancements/index.html">Android
security platform</a> and service protections such as SafetyNet. These
capabilities reduce the likelihood that security vulnerabilities could be
successfully exploited on Android.
</p>
<ul>
<li>Exploitation for many issues on Android is made more difficult by
enhancements in newer versions of the Android platform. We encourage all users
to update to the latest version of Android where possible.</li>
<li>The Android Security team actively monitors for abuse with <a
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
Apps and SafetyNet</a>, which are designed to warn users about <a
href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
Harmful Applications</a>. Verify Apps is enabled by default on devices with <a
href="http://www.android.com/gms">Google Mobile Services</a>, and is especially
important for users who install applications from outside of Google Play. Device
rooting tools are prohibited within Google Play, but Verify Apps warns users
when they attempt to install a detected rooting application—no matter where it
comes from. Additionally, Verify Apps attempts to identify and block
installation of known malicious applications that exploit a privilege escalation
vulnerability. If such an application has already been installed, Verify Apps
will notify the user and attempt to remove the detected application.</li>
<li>As appropriate, Google Hangouts and Messenger applications do not
automatically pass media to processes such as Mediaserver.</li>
</ul>
<h2 id="acknowledgements">Acknowledgements</h2>
<p>
We would like to thank these researchers for their contributions:
</p>
<ul>
<li>Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security
Team: CVE-2016-3821, CVE-2016-3837</li>
<li>Adam Donenfeld et al. of Check Point Software Technologies Ltd.:
CVE-2016-2504</li>
<li>Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>),
Mingjian Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
and Xuxian Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3844</li>
<li>Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>),
Yuan-Tsung Lo (<a
href="mailto:[email protected]">computernik@gmail.com)</a>, and Xuxian Jiang
of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3857</li>
<li>David Benjamin and Kenny Root of Google: CVE-2016-3840</li>
<li>Dawei Peng (<a href="http://weibo.com/u/5622360291">Vinc3nt4H</a>) of <a
href="http://jaq.alibaba.com">Alibaba Mobile Security Team</a>: CVE-2016-3822</li>
<li>Di Shen (<a href="https://twitter.com/returnsme">@returnsme</a>) of KeenLab
(<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent: CVE-2016-3842</li>
<li>Dianne Hackborn of Google: CVE-2016-2497</li>
<li>Dmitry Vyukov of Google Dynamic Tools team: CVE-2016-3841</li>
<li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>),
pjf (<a href="http://weibo.com/jfpan">weibo.com/jfpan</a>) of IceSword Lab, <a
href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-3852</li>
<li>Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>)
of Alpha Team, <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.:
CVE-2016-3834</li>
<li>Kai Lu (<a href="https://twitter.com/K3vinLuSec">@K3vinLuSec</a>) of
Fortinet's FortiGuard Labs: CVE-2016-3820</li>
<li>Kandala Shivaram reddy, DS, and Uppi: CVE-2016-3826</li>
<li>Mingjian Zhou (<a
href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu (<a
href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of <a
href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3823, CVE-2016-3835,
CVE-2016-3824, CVE-2016-3825</li>
<li>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>) of
Tesla Motors Product Security Team: CVE-2016-3847, CVE-2016-3848</li>
<li>Peng Xiao, Chengming Yang, Ning You, Chao Yang, and Yang song of Alibaba
Mobile Security Group: CVE-2016-3845</li>
<li>Peter Pi (<a href="https://twitter.com/heisecode">@heisecode</a>) of Trend
Micro: CVE-2016-3849</li>
<li>Qianwei Hu (<a href="mailto:[email protected]">[email protected]</a>) of <a
href="http://www.wooyun.org/">WooYun TangLab</a>: CVE-2016-3846</li>
<li>Qidan He (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) of
KeenLab (<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent:
CVE-2016-3832</li>
<li>Sharvil Nanavati of Google: CVE-2016-3839</li>
<li>Shinjo Park (<a href="https://twitter.com/ad_ili_rai">@ad_ili_rai</a>) and
Altaf Shaik of <a
href="http://www.isti.tu-berlin.de/security_in_telecommunications">Security in
Telecommunications</a>: CVE-2016-3831</li>
<li>Tom Rootjunky: CVE-2016-3853</li>
<li>Vasily Vasiliev: CVE-2016-3819</li>
<li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of
Alibaba Inc.: CVE-2016-3827, CVE-2016-3828, CVE-2016-3829</li>
<li>Wish Wu (<a href="http://weibo.com/wishlinux">吴潍浠</a>) (<a
href="https://twitter.com/wish_wu">@wish_wu</a>) of <a
href="http://blog.trendmicro.com/trendlabs-security-intelligence/author/wishwu/">Trend
Micro Inc</a>.: CVE-2016-3843</li>
<li>Yongke Wang (<a href="https://twitter.com/rudykewang">@Rudykewang</a>) of
Tencent's Xuanwu LAB: CVE-2016-3836</li>
</ul>
<p>
We would like to thank Daniel Micay of Copperhead Security, Jeff Vander Stoep,
and Yabin Cui of Google for their contribution of platform level updates to
mitigate a class of vulnerabilities such as CVE-2016-3843. This mitigation is
based on work by Brad Spengler of Grsecurity.
</p>
<h2
id="2016-08-01-security-patch-level-security-vulnerability-details">
2016-08-01 security patch level—Security vulnerability details</h2>
<p>
In the sections below, we provide details for each of the security
vulnerabilities listed in the <a
href="#2016-08-01-security-patch-level-vulnerability-summary">2016-08-01
security patch level—Vulnerability summary</a> above. There is a description of
the issue, a severity rationale, and a table with the CVE, associated
references, severity, updated Nexus devices, updated AOSP versions (where
applicable), and date reported. When available, we will link the public change
that addressed the issue to the bug ID, such as the AOSP change list. When
multiple changes relate to a single bug, additional references are linked to
numbers following the bug ID.
</p>
<h3 id="remote-code-execution-vulnerability-in-mediaserver">
Remote code execution vulnerability in Mediaserver</h3>
<p>
A remote code execution vulnerability in Mediaserver could enable an attacker
using a specially crafted file to cause memory corruption during media file and
data processing. This issue is rated as Critical due to the possibility of
remote code execution within the context of the Mediaserver process. The
Mediaserver process has access to audio and video streams, as well as access to
privileges that third-party apps could not normally access.
</p>
<p>
The affected functionality is provided as a core part of the operating system
and there are multiple applications that allow it to be reached with remote
content, most notably MMS and browser playback of media.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3819</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/590d1729883f700ab905cdc9ad850f3ddd7e1f56">
A-28533562</a></td>
<td>Critical</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 2, 2016</td>
</tr>
<tr>
<td>CVE-2016-3820</td>
<td><a href="https://android.googlesource.com/platform/external/libavc/+/a78887bcffbc2995cf9ed72e0697acf560875e9e">
A-28673410</a></td>
<td>Critical</td>
<td>All Nexus</td>
<td>6.0, 6.0.1</td>
<td>May 6, 2016</td>
</tr>
<tr>
<td>CVE-2016-3821</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/42a25c46b844518ff0d0b920c20c519e1417be69">
A-28166152</a></td>
<td>Critical</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="remote-code-execution-vulnerability-in-libjhead">
Remote code execution vulnerability in libjhead</h3>
<p>
A remote code execution vulnerability in libjhead could enable an attacker using
a specially crafted file to execute arbitrary code in the context of an
unprivileged process. This issue is rated as High due to the possibility of
remote code execution in applications that use this library.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3822</td>
<td><a href="https://android.googlesource.com/platform/external/jhead/+/bae671597d47b9e5955c4cb742e468cebfd7ca6b">
A-28868315</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-mediaserver">
Elevation of privilege vulnerability in Mediaserver</h3>
<p>
An elevation of privilege vulnerability in Mediaserver could enable a local
malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3823</td>
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95">
A-28815329</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 17, 2016</td>
</tr>
<tr>
<td>CVE-2016-3824</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/b351eabb428c7ca85a34513c64601f437923d576">
A-28816827</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 17, 2016</td>
</tr>
<tr>
<td>CVE-2016-3825</td>
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/d575ecf607056d8e3328ef2eb56c52e98f81e87d">
A-28816964</a></td>
<td>High</td>
<td>All Nexus</td>
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 17, 2016</td>
</tr>
<tr>
<td>CVE-2016-3826</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/9cd8c3289c91254b3955bd7347cf605d6fa032c6">
A-29251553</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Jun 9, 2016</td>
</tr>
</table>
<h3 id="denial-of-service-vulnerability-in-mediaserver">
Denial of service vulnerability in Mediaserver</h3>
<p>
A denial of service vulnerability in Mediaserver could enable an attacker using
a specially crafted file to cause a device hang or reboot. This issue is rated
as High due to the possibility of a temporary remote denial of service.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3827</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/a4567c66f4764442c6cb7b5c1858810194480fb5">
A-28816956</a></td>
<td>High</td>
<td>All Nexus</td>
<td>6.0.1</td>
<td>May 16, 2016</td>
</tr>
<tr>
<td>CVE-2016-3828</td>
<td><a href="https://android.googlesource.com/platform/external/libavc/+/7554755536019e439433c515eeb44e701fb3bfb2">
A-28835995</a></td>
<td>High</td>
<td>All Nexus</td>
<td>6.0, 6.0.1</td>
<td>May 17, 2016</td>
</tr>
<tr>
<td>CVE-2016-3829</td>
<td><a href="https://android.googlesource.com/platform/external/libavc/+/326fe991a4b7971e8aeaf4ac775491dd8abd85bb">
A-29023649</a></td>
<td>High</td>
<td>All Nexus</td>
<td>6.0, 6.0.1</td>
<td>May 27, 2016</td>
</tr>
<tr>
<td>CVE-2016-3830</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/8e438e153f661e9df8db0ac41d587e940352df06">
A-29153599</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="denial-of-service-vulnerability-in-system-clock">
Denial of service vulnerability in system clock</h3>
<p>
A denial of service vulnerability in the system clock could enable a remote
attacker to crash the device. This issue is rated as High due to the possibility
of a temporary remote denial of service.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3831</td>
<td><a href="https://android.googlesource.com/platform/frameworks/opt/telephony/+/f47bc301ccbc5e6d8110afab5a1e9bac1d4ef058">
A-29083635</a></td>
<td>High</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 31, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-framework-apis">
Elevation of privilege vulnerability in framework APIs</h3>
<p>
An elevation of privilege vulnerability in the framework APIs could enable a
local malicious application to bypass operating system protections that isolate
application data from other applications. This issue is rated as Moderate
because it could be used to gain access to data that is outside of the
application’s permission levels.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="18%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3832</td>
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/e7cf91a198de995c7440b3b64352effd2e309906">
A-28795098</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 15, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-shell">
Elevation of privilege vulnerability in Shell</h3>
<p>
An elevation of privilege in the Shell could enable a local malicious
application to bypass device constraints such as user restrictions. This issue
is rated as Moderate because it is a local bypass of user permissions.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="18%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3833</td>
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/01875b0274e74f97edf6b0d5c92de822e0555d03">
A-29189712</a>
[<a href="https://android.googlesource.com/platform/frameworks/base/+/4e4743a354e26467318b437892a9980eb9b8328a">2</a>]</td>
<td>Moderate</td>
<td>All Nexus</td>
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-openssl">
Information disclosure vulnerability in OpenSSL</h3>
<p>
An information disclosure vulnerability in OpenSSL could allow a local malicious
application to access data outside of its permission levels. This issue is rated
as Moderate because it could be used to access sensitive data without
permission.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-2842</td>
<td>A-29060514</td>
<td>None*</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1</td>
<td>Mar 29, 2016</td>
</tr>
</table>
<p>* Supported Nexus devices that have installed all available updates are not
affected by this vulnerability</p>
<h3 id="information-disclosure-vulnerability-in-camera-apis">
Information disclosure vulnerability in camera APIs</h3>
<p>
An information disclosure vulnerability in the camera APIs could allow a local
malicious application to access data structures outside of its permission levels. This
issue is rated as Moderate because it could be used to access sensitive data
without permission.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="18%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3834</td>
<td><a href="https://android.googlesource.com/platform/frameworks/av/+/1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc">
A-28466701</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Apr 28, 2016</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-mediaserver">
Information disclosure vulnerability in Mediaserver</h3>
<p>
An information disclosure vulnerability in Mediaserver could allow a local
malicious application to access data outside of its permission levels. This
issue is rated as Moderate because it could be used to access sensitive data
without permission.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="18%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3835</td>
<td><a href="https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95">
A-28920116</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 23, 2016</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-surfaceflinger">
Information disclosure vulnerability in SurfaceFlinger</h3>
<p>
An information disclosure vulnerability in the SurfaceFlinger service could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as Moderate because it could be used to access
sensitive data without explicit user permission.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3836</td>
<td><a href="https://android.googlesource.com/platform/frameworks/native/+/3bcf0caa8cca9143443814b36676b3bae33a4368">
A-28592402</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>May 4, 2016</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-wi-fi">
Information disclosure vulnerability in Wi-Fi</h3>
<p>
An information disclosure vulnerability in Wi-Fi could allow a local malicious
application to to access data outside of its permission levels. This issue is
rated Moderate because it could be used to access sensitive data without
permission.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3837</td>
<td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/a209ff12ba9617c10550678ff93d01fb72a33399">
A-28164077</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="denial-of-service-vulnerability-in-system-ui">
Denial of service vulnerability in system UI</h3>
<p>
A denial of service vulnerability in the system UI could enable a local
malicious application to prevent 911 calls from a locked screen. This issue is
rated as Moderate due to the possibility of a denial of service on a critical
function.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3838</td>
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/468651c86a8adb7aa56c708d2348e99022088af3">
A-28761672</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="denial-of-service-vulnerability-in-bluetooth">
Denial of service vulnerability in Bluetooth</h3>
<p>
A denial of service vulnerability in Bluetooth could enable a local malicious
application to prevent 911 calls from a Bluetooth device. This issue is rated as
Moderate due to the possibility of a denial of service on a critical function.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="18%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3839</td>
<td><a href="https://android.googlesource.com/platform/system/bt/+/472271b153c5dc53c28beac55480a8d8434b2d5c">
A-28885210</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h2 id="2016-08-05-security-patch-level-vulnerability-details">
2016-08-05 security patch level—Vulnerability details</h2>
<p>
In the sections below, we provide details for each of the security
vulnerabilities listed in the <a
href="#2016-08-05-security-patch-level-vulnerability-summary">2016-08- 05
security patch level—Vulnerability summary</a> above. There is a description of
the issue, a severity rationale, and a table with the CVE, associated
references, severity, updated Nexus devices, updated AOSP versions (where
applicable), and date reported. When available, we will link the public change
that addressed the issue to the bug ID, like the AOSP change list. When multiple
changes relate to a single bug, additional references are linked to numbers
following the bug ID.
</p>
<h3 id="remote-code-execution-vulnerability-in-qualcomm-wi-fi-driver">
Remote code execution vulnerability in Qualcomm Wi-Fi driver</h3>
<p>
A remote code execution vulnerability in the Qualcomm Wi-Fi driver could enable
a remote attacker to execute arbitrary code within the context of the kernel.
This issue is rated as Critical due to the possibility of a local permanent
device compromise.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2014-9902</td>
<td>A-28668638
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50">
QC-CR#553937</a><br />
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50">
QC-CR#553941</a>
</p>
</td>
<td>Critical</td>
<td>Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
</table>
<h3 id="remote-code-execution-vulnerability-in-conscrypt">Remote code execution
vulnerability in Conscrypt</h3>
<p>
A remote code execution vulnerability in Conscrypt could enable a remote
attacker to execute arbitrary code within the context of a privileged process.
This issue is rated as Critical due to the possibility of remote code execution.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3840</td>
<td><a href="https://android.googlesource.com/platform/external/conscrypt/+/5af5e93463f4333187e7e35f3bd2b846654aa214">
A-28751153</a></td>
<td>Critical</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-components">
Elevation of privilege vulnerability in Qualcomm components</h3>
<p>
The table below contains security vulnerabilities affecting Qualcomm components,
potentially including the bootloader, camera driver, character drive,
networking, sound driver, and video driver.
</p>
<p>
The most severe of these issues is rated as Critical due to possibility that a
local malicious application could execute arbitrary code within the context of
the kernel leading to a local permanent device compromise, which may require
reflashing the operating system to repair the device.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2014-9863</td>
<td>A-28768146
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=75eac48a48562f819f50eeff8369b296d89102d7">
QC-CR#549470</a>
</p>
</td>
<td>Critical</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9864</td>
<td>A-28747998
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=a1124defc680055e2f2a8c8e3da4a94ca2ec842e">
QC-CR#561841</a>
</p></td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 27, 2014</td>
</tr>
<tr>
<td>CVE-2014-9865</td>
<td>A-28748271
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=e65a876a155de945e306f2726f3a557415e6044e">
QC-CR#550013</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 27, 2014</td>
</tr>
<tr>
<td>CVE-2014-9866</td>
<td>A-28747684
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8e6daae70422ad35146a87700e6634a747d1ff5d">
QC-CR#511358</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9867</td>
<td>A-28749629
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=322c518689a7f820165ca4c5d6b750b02ac34665">
QC-CR#514702</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9868</td>
<td>A-28749721
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=1f274b74c00187ba1c379971503f51944148b22f">
QC-CR#511976</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9869</td>
<td>A-28749728
<p>
<a
href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8d1f7531ff379befc129a6447642061e87562bca">
QC-CR#514711</a>
[<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=7a26934e4196b4aa61944081989189d59b108768">2</a>]
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9870</td>
<td>A-28749743
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=4f57652fcd2dce7741f1ac6dc0417e2f265cd1de">
QC-CR#561044</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9871</td>
<td>A-28749803
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f615e40c706708f74cd826d5b19c63025f54c041">
QC-CR#514717</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9872</td>
<td>A-28750155
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=fc787ebd71fa231cc7dd2a0d5f2208da0527096a">
QC-CR#590721</a>
</p>
</td>
<td>High</td>
<td>Nexus 5</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9873</td>
<td>A-28750726
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ef29ae1d40536fef7fb95e4d5bb5b6b57bdf9420">
QC-CR#556860</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9874</td>
<td>A-28751152
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=56ff68b1f93eaf22e5e0284648fd862dc08c9236">
QC-CR#563086</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 5X, Nexus 6P, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9875</td>
<td>A-28767589
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=b77c694b88a994d077316c157168c710696f8805">
QC-CR#483310</a>
</p>
</td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9876</td>
<td>A-28767796
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=7efd393ca08ac74b2e3d2639b0ad77da139e9139">
QC-CR#483408</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9877</td>
<td>A-28768281
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f0c0112a6189747a3f24f20210157f9974477e03">
QC-CR#547231</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9878</td>
<td>A-28769208
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=96a62c1de93a44e6ca69514411baf4b3d67f6dee">
QC-CR#547479</a>
</p>
</td>
<td>High</td>
<td>Nexus 5</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9879</td>
<td>A-28769221
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=ecc8116e1befb3a764109f47ba0389434ddabbe4">
QC-CR#524490</a>
</p>
</td>
<td>High</td>
<td>Nexus 5</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9880</td>
<td>A-28769352
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f2a3f5e63e15e97a66e8f5a300457378bcb89d9c">
QC-CR#556356</a>
</p>
</td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9881</td>
<td>A-28769368
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=ba3f404a10b3bb7e9c20440837df3cd35c5d0c4b">
QC-CR#539008</a>
</p>
</td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9882</td>
<td>A-28769546
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=3a4ebaac557a9e3fbcbab4561650abac8298a4d9">
QC-CR#552329</a>
[<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=0f6afe815b1b3f920f3502be654c848bdfe5ef38">2</a>]</p>
</td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9883</td>
<td>A-28769912
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=cbf79a67348e48557c0d0bb9bc58391b3f84bc46">
QC-CR#565160</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9884</td>
<td>A-28769920
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f4948193c46f75e16d4382c4472485ab12b7bd17">
QC-CR#580740</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9885</td>
<td>A-28769959
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=a1d5a4cbd5aa8656bc23b40c7cc43941e10f89c3">
QC-CR#562261</a>
</p>
</td>
<td>High</td>
<td>Nexus 5</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9886</td>
<td>A-28815575
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=80be0e249c906704085d13d4ae446f73913fc225">
QC-CR#555030</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9887</td>
<td>A-28804057
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=b1bc773cf61265e0e3871b2e52bd6b3270ffc6c3">
QC-CR#636633</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Jul 3, 2014</td>
</tr>
<tr>
<td>CVE-2014-9888</td>
<td>A-28803642
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=f044936caab337a4384fbfe64a4cbae33c7e22a1">
QC-CR#642735</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Aug 29, 2014</td>
</tr>
<tr>
<td>CVE-2014-9889</td>
<td>A-28803645
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit?id=f4e2f2d4ef58c88340774099dff3324ec8baa24a">
QC-CR#674712</a>
</p></td>
<td>High</td>
<td>Nexus 5</td>
<td>Oct 31, 2014</td>
</tr>
<tr>
<td>CVE-2015-8937</td>
<td>A-28803962
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=c66202b9288cc4ab1c38f7c928fa1005c285c170">
QC-CR#770548</a>
</p>
</td>
<td>High</td>
<td>Nexus 5, Nexus 6, Nexus 7 (2013)</td>
<td>Mar 31, 2015</td>
</tr>
<tr>
<td>CVE-2015-8938</td>
<td>A-28804030
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=51c39420e3a49d1a7f05a77c64369b7623088238">
QC-CR#766022</a></p></td>
<td>High</td>
<td>Nexus 6</td>
<td>Mar 31, 2015</td>
</tr>
<tr>
<td>CVE-2015-8939</td>
<td>A-28398884
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=884cff808385788fa620833c7e2160a4b98a21da">
QC-CR#779021</a></p></td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Apr 30, 2015</td>
</tr>
<tr>
<td>CVE-2015-8940</td>
<td>A-28813987
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e13ebd727d161db7003be6756e61283dce85fa3b">
QC-CR#792367</a></p></td>
<td>High</td>
<td>Nexus 6</td>
<td>Apr 30, 2015</td>
</tr>
<tr>
<td>CVE-2015-8941</td>
<td>A-28814502
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=d4d4d1dd626b21e68e78395bab3382c1eb04877f">
QC-CR#792473</a></p></td>
<td>High</td>
<td>Nexus 6, Nexus 7 (2013)</td>
<td>May 29, 2015</td>
</tr>
<tr>
<td>CVE-2015-8942</td>
<td>A-28814652
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=9ec380c06bbd79493828fcc3c876d8a53fd3369f">
QC-CR#803246</a></p></td>
<td>High</td>
<td>Nexus 6</td>
<td>Jun 30, 2015</td>
</tr>
<tr>
<td>CVE-2015-8943</td>
<td>A-28815158
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ad376e4053b87bd58f62f45b6df2c5544bc21aee">
QC-CR#794217</a></p>
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=ad376e4053b87bd58f62f45b6df2c5544bc21aee">
QC-CR#836226</a></p></td>
<td>High</td>
<td>Nexus 5</td>
<td>Sep 11, 2015</td>
</tr>
<tr>
<td>CVE-2014-9891</td>
<td>A-28749283
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=c10f03f191307f7114af89933f2d91b830150094">
QC-CR#550061</a></p></td>
<td>Moderate</td>
<td>Nexus 5</td>
<td>Mar 13, 2014</td>
</tr>
<tr>
<td>CVE-2014-9890</td>
<td>A-28770207
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=14e0c8614d2715589583d8a95e33c422d110eb6f">
QC-CR#529177</a></p></td>
<td>Moderate</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Jun 2, 2014</td>
</tr>
</table>
<h3
id="elevation-of-privilege-vulnerability-in-kernel-networking-component">
Elevation of privilege vulnerability in kernel networking component</h3>
<p>
An elevation of privilege vulnerability in the kernel networking component could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Critical due to the possibility of
a local permanent device compromise, which may require reflashing the operating
system to repair the device.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2015-2686</td>
<td>A-28759139
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4de930efc23b92ddf88ce91c405ee645fe6e27ea">
Upstream kernel</a></p></td>
<td>Critical</td>
<td>All Nexus</td>
<td>Mar 23, 2015</td>
</tr>
<tr>
<td>CVE-2016-3841</td>
<td>A-28746669
<p>
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=45f6fad84cc305103b28d73482b344d7f5b76f39">
Upstream kernel</a></p></td>
<td>Critical</td>
<td>All Nexus</td>
<td>Dec 3, 2015</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-gpu-driver">
Elevation of privilege vulnerability in Qualcomm GPU driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm GPU driver could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as Critical due to the possibility of a local
permanent device compromise, which may require reflashing the operating system
to repair the device.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-2504</td>
<td>A-28026365
<p>QC-CR#1002974</p></td>
<td>Critical</td>
<td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013)</td>
<td>Apr 5, 2016</td>
</tr>
<tr>
<td>CVE-2016-3842</td>
<td>A-28377352
<p>
QC-CR#1002974</p></td>
<td>Critical</td>
<td>Nexus 5X, Nexus 6, Nexus 6P</td>
<td>Apr 25, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-performance-component">
Elevation of privilege vulnerability in Qualcomm performance component</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm performance component
could enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Critical due to the possibility of
a local permanent device compromise, which may require reflashing the operating
system to repair the device.
</p>
<p class="note">
<strong>Note:</strong> There is also a platform-level update in this bulletin
under A-29119870 that is designed to mitigate this class of vulnerabilities.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3843</td>
<td>A-28086229*
<p>
QC-CR#1011071</p></td>
<td>Critical</td>
<td>Nexus 5X, Nexus 6P</td>
<td>Apr 7, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-kernel">
Elevation of privilege vulnerability in kernel</h3>
<p>
An elevation of privilege vulnerability in the kernel could enable a local
malicious application to execute arbitrary code within the context of the
kernel. This issue is rated as Critical due to the possibility of a local
permanent device compromise, which may require reflashing the operating system
to repair the device.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3857</td>
<td>A-28522518*</td>
<td>Critical</td>
<td>Nexus 7 (2013)</td>
<td>May 2, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-kernel-memory-system">
Elevation of privilege vulnerability in kernel memory system</h3>
<p>
An elevation of privilege vulnerability in the kernel memory system could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2015-1593</td>
<td>A-29577822
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4e7c22d447bb6d7e37bfe39ff658486ae78e8d77">
Upstream kernel</a></p></td>
<td>High</td>
<td>Nexus Player</td>
<td>Feb 13, 2015</td>
</tr>
<tr>
<td>CVE-2016-3672</td>
<td>A-28763575
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8b8addf891de8a00e4d39fc32f93f7c5eb8feceb">
Upstream kernel</a></p></td>
<td>High</td>
<td>Nexus Player</td>
<td>Mar 25, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-kernel-sound-component">
Elevation of privilege vulnerability in kernel sound component</h3>
<p>
An elevation of privilege vulnerability in the kernel sound component could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-2544</td>
<td>A-28695438
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3567eb6af614dac436c4b16a8d426f9faed639b3">
Upstream kernel</a></p></td>
<td>High</td>
<td>All Nexus</td>
<td>Jan 19, 2016</td>
</tr>
<tr>
<td>CVE-2016-2546</td>
<td>A-28694392
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af368027a49a751d6ff4ee9e3f9961f35bb4fede">
Upstream kernel</a></p></td>
<td>High</td>
<td>Pixel C</td>
<td>Jan 19, 2016</td>
</tr>
<tr>
<td>CVE-2014-9904</td>
<td>A-28592007
<p>
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205">
Upstream kernel</a></p></td>
<td>High</td>
<td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player</td>
<td>May 4, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-kernel-file-system">
Elevation of privilege vulnerability in kernel file system</h3>
<p>
An elevation of privilege vulnerability in the kernel file system could enable a
local malicious application to execute arbitrary code within the context of the
kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2012-6701</td>
<td>A-28939037
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a70b52ec1aaeaf60f4739edb1b422827cb6f3893">
Upstream kernel</a></p></td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 2, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-mediaserver">
Elevation of privilege vulnerability in Mediaserver</h3>
<p>
An elevation of privilege vulnerability in Mediaserver could enable a local
malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not accessible to a third-party
application.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3844</td>
<td>A-28299517*
<p>
N-CVE-2016-3844</p></td>
<td>High</td>
<td>Nexus 9, Pixel C</td>
<td>Apr 19, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3>Elevation of privilege vulnerability in kernel video driver</h3>
<p>
An elevation of privilege vulnerability in the kernel video driver could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3845</td>
<td>A-28399876*</td>
<td>High</td>
<td>Nexus 5</td>
<td>Apr 20, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-serial-peripheral-interface-driver">
Elevation of privilege vulnerability in Serial Peripheral Interface driver</h3>
<p>
An elevation of privilege vulnerability in the Serial Peripheral Interface
driver could enable a local malicious application to execute arbitrary code
within the context of the kernel. This issue is rated as High because it first
requires compromising a privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3846</td>
<td>A-28817378*</td>
<td>High</td>
<td>Nexus 5X, Nexus 6P</td>
<td>May 17, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-nvidia-media-driver">
Elevation of privilege vulnerability in NVIDIA media driver</h3>
<p>
An elevation of privilege vulnerability in the NVIDIA media driver could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3847</td>
<td>A-28871433*
<p>
N-CVE-2016-3847</p></td>
<td>High</td>
<td>Nexus 9</td>
<td>May 19, 2016</td>
</tr>
<tr>
<td>CVE-2016-3848</td>
<td>A-28919417*
<p>
N-CVE-2016-3848</p></td>
<td>High</td>
<td>Nexus 9</td>
<td>May 19, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-ion-driver">
Elevation of privilege vulnerability in ION driver</h3>
<p>
An elevation of privilege vulnerability in the ION driver could enable a local
malicious application to execute arbitrary code within the context of the
kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3849</td>
<td>A-28939740</td>
<td>High</td>
<td>Pixel C</td>
<td>May 24, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-qualcomm-bootloader">Elevation
of privilege vulnerability in Qualcomm bootloader</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm bootloader could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="26%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3850</td>
<td>A-27917291
<p>
<a href="https://source.codeaurora.org/quic/la/kernel/lk/commit/?id=030371d45a9dcda4d0cc3c76647e753a1cc1b782">
QC-CR#945164</a></p></td>
<td>High</td>
<td>Nexus 5, Nexus 5X, Nexus 6P, Nexus 7 (2013)</td>
<td>Mar 28, 2016</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-kernel-performance">
Elevation of privilege vulnerability in kernel performance subsystem</h3>
<p>
Elevation of privilege vulnerabilities in the kernel performance subsystem could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because of the kernel attack
surface available for attackers to exploit.
</p>
<p class="note">
<strong>Note:</strong> This is a platform level update designed to mitigate a
class of vulnerabilities such as CVE-2016-3843 (A-28086229).
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3843</td>
<td>A-29119870*</td>
<td>High</td>
<td>All Nexus</td>
<td>6.0, 6.1</td>
<td>Google internal</td>
</tr>
</table>
<p>
* A patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3
id="elevation-of-privilege-vulnerability-in-lg-electronics-bootloader">
Elevation of privilege vulnerability in LG Electronics bootloader</h3>
<p>
An elevation of privilege vulnerability in the LG Electronics bootloader could
enable an attacker to execute arbitrary code within the context of the kernel.
This issue is rated as High because it first requires compromising a privileged
process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3851</td>
<td>A-29189941*</td>
<td>High</td>
<td>Nexus 5X</td>
<td>Google internal</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-qualcomm-components">
Information disclosure vulnerability in Qualcomm components</h3>
<p>
The table below contains security vulnerabilities affecting Qualcomm components,
potentially including the bootloader, camera driver, character driver,
networking, sound driver and video driver.
</p>
<p>
The most severe of these issues is rated as High due to the possibility that a
local malicious application could access data outside of its permission levels
such as sensitive data without explicit user permission.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2014-9892</td>
<td>A-28770164
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=591b1f455c32206704cbcf426bb30911c260c33e">
QC-CR#568717</a></p></td>
<td>High</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Jun 2, 2014</td>
</tr>
<tr>
<td>CVE-2015-8944</td>
<td>A-28814213
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=e758417e7c31b975c862aa55d0ceef28f3cc9104">
QC-CR#786116</a></p></td>
<td>High</td>
<td>Nexus 6, Nexus 7 (2013)</td>
<td>Apr 30, 2015</td>
</tr>
<tr>
<td>CVE-2014-9893</td>
<td>A-28747914
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=bfc6eee5e30a0c20bc37495233506f4f0cc4991d">
QC-CR#542223</a></p></td>
<td>Moderate</td>
<td>Nexus 5</td>
<td>Mar 27, 2014</td>
</tr>
<tr>
<td>CVE-2014-9894</td>
<td>A-28749708
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=83214431cd02674c70402b160b16b7427e28737f">
QC-CR#545736</a></p></td>
<td>Moderate</td>
<td>Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9895</td>
<td>A-28750150
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm/commit/?id=cc4b26575602e492efd986e9a6ffc4278cee53b5">
QC-CR#570757</a></p></td>
<td>Moderate</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
<tr>
<td>CVE-2014-9896</td>
<td>A-28767593
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=89f2bcf1ac860b0b380e579e9a8764013f263a7d">
QC-CR#551795</a></p></td>
<td>Moderate</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9897</td>
<td>A-28769856
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=46135d80765cb70a914f02a6e7b6abe64679ec86">
QC-CR#563752</a></p></td>
<td>Moderate</td>
<td>Nexus 5</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9898</td>
<td>A-28814690
<p>
<a href="https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=80be0e249c906704085d13d4ae446f73913fc225">
QC-CR#554575</a></p></td>
<td>Moderate</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Apr 30, 2014</td>
</tr>
<tr>
<td>CVE-2014-9899</td>
<td>A-28803909
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=8756624acb1e090b45baf07b2a8d0ebde114000e">
QC-CR#547910</a></p></td>
<td>Moderate</td>
<td>Nexus 5</td>
<td>Jul 3, 2014</td>
</tr>
<tr>
<td>CVE-2014-9900</td>
<td>A-28803952
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.10/commit/?id=63c317dbee97983004dffdd9f742a20d17150071">
QC-CR#570754</a></p></td>
<td>Moderate</td>
<td>Nexus 5, Nexus 7 (2013)</td>
<td>Aug 8, 2014</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-kernel-scheduler">
Information disclosure vulnerability in kernel scheduler</h3>
<p>
An information disclosure vulnerability in the kernel scheduler could enable a
local malicious application to access data outside of its permission levels.
This issue is rated as High because it could be used to access sensitive data
without explicit user permission.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2014-9903</td>
<td>A-28731691
<p>
<a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4efbc454ba68def5ef285b26ebfcfdb605b52755">
Upstream kernel</a></p></td>
<td>High</td>
<td>Nexus 5X, Nexus 6P</td>
<td>Feb 21, 2014</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-mediatek-wi-fi-driver-device-specific">
Information disclosure vulnerability in MediaTek Wi-Fi driver (device specific)</h3>
<p>
An information disclosure vulnerability in the MediaTek Wi-Fi driver could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as High because it could be used to access sensitive
data without explicit user permission.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3852</td>
<td>A-29141147*
<p>
M-ALPS02751738</p></td>
<td>High</td>
<td>Android One</td>
<td>Apr 12, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-usb-driver">Information
disclosure vulnerability in USB driver</h3>
<p>
An information disclosure vulnerability in the USB driver could enable a local
malicious application to access data outside of its permission levels. This
issue is rated as High because it could be used to access sensitive data without
explicit user permission.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-4482</td>
<td>A-28619695
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=681fef8380eb818c0b845fca5d2ab1dcbab114ee">
Upstream kernel</a></p></td>
<td>High</td>
<td>All Nexus</td>
<td>May 3, 2016</td>
</tr>
</table>
<h3 id="denial-of-service-vulnerability-in-qualcomm-components">
Denial of service vulnerability in Qualcomm components</h3>
<p>
The table below contains security vulnerabilities affecting Qualcomm components,
potentially including the Wi-Fi driver.
</p>
<p>
The most severe of these issues is rated as High due to the possibility that an
attacker could cause a temporary remote denial of service resulting in a device
hang or reboot.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2014-9901</td>
<td>A-28670333
<p>
<a href="https://us.codeaurora.org/cgit/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=637f0f7931dd7265ac1c250dc2884d6389c66bde">
QC-CR#548711</a></p></td>
<td>High</td>
<td>Nexus 7 (2013)</td>
<td>Mar 31, 2014</td>
</tr>
</table>
<h3 id="elevation-of-privilege-vulnerability-in-google-play-services">
Elevation of privilege vulnerability in Google Play services</h3>
<p>
An elevation of privilege vulnerability in Google Play services could allow a
local attacker to bypass the Factory Reset Protection and gain access to the
device. This is rated as Moderate due to the possibility of bypassing Factory
Reset Protection, which could lead to successfully resetting the device and
erasing all its data.
</p>
<table>
<col width="18%">
<col width="18%">
<col width="10%">
<col width="19%">
<col width="17%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3853</td>
<td>A-26803208*</td>
<td>Moderate</td>
<td>All Nexus</td>
<td>None</td>
<td>May 4, 2016</td>
</tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the <a
href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="elevation-of-privilege-vulnerability-in-framework-apis-2">
Elevation of privilege vulnerability in Framework APIs</h3>
<p>
An elevation of privilege vulnerability in the framework APIs could enable a
pre-installed application to increase its intent filter priority when the
application is being updated without the user being notified. This issue is
rated as Moderate because it could be used to gain elevated capabilities without
explicit user permission.
</p>
<table>
<col width="18%">
<col width="17%">
<col width="10%">
<col width="19%">
<col width="18%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Updated AOSP versions</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-2497</td>
<td><a href="https://android.googlesource.com/platform/frameworks/base/+/a75537b496e9df71c74c1d045ba5569631a16298">
A-27450489</a></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
<td>Google internal</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-kernel-networking-component">
Information disclosure vulnerability in kernel networking component</h3>
<p>
An information disclosure vulnerability in the kernel networking component could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as Moderate because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-4486</td>
<td>A-28620102
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5f8e44741f9f216e33736ea4ec65ca9ac03036e6">
Upstream kernel</a></p></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>May 3, 2016</td>
</tr>
</table>
<h3 id="information-disclosure-vulnerability-in-kernel-sound-component">
Information disclosure vulnerability in kernel sound component</h3>
<p>
An information disclosure vulnerability in the kernel sound component could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as Moderate because it first requires compromising a
privileged process.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-4569</td>
<td>A-28980557
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cec8f96e49d9be372fdb0c3836dcf31ec71e457e">
Upstream kernel</a></p></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>May 9, 2016</td>
</tr>
<tr>
<td>CVE-2016-4578</td>
<td>A-28980217
<p>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e4ec8cc8039a7063e24204299b462bd1383184a5">
Upstream kernel</a>
[<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9a47e9cff994f37f7f0dbd9ae23740d0f64f9fe6">2</a>]</p></td>
<td>Moderate</td>
<td>All Nexus</td>
<td>May 11, 2016</td>
</tr>
</table>
<h3 id="vulnerabilities-in-qualcomm-components">
Vulnerabilities in Qualcomm components</h3>
<p>
The table below contains security vulnerabilities affecting Qualcomm components,
potentially including the bootloader, camera driver, character driver,
networking, sound driver, and video driver.
</p>
<table>
<col width="19%">
<col width="20%">
<col width="10%">
<col width="23%">
<col width="17%">
<tr>
<th>CVE</th>
<th>References</th>
<th>Severity</th>
<th>Updated Nexus devices</th>
<th>Date reported</th>
</tr>
<tr>
<td>CVE-2016-3854</td>
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm/commit/?h=LA.AF.1.2.1_rb1.5&id=cc96def76dfd18fba88575065b29f2ae9191fafa">
QC-CR#897326</a></td>
<td>High</td>
<td>None</td>
<td>Feb 2016</td>
</tr>
<tr>
<td>CVE-2016-3855</td>
<td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=ab3f46119ca10de87a11fe966b0723c48f27acd4">
QC-CR#990824</a></td>
<td>High</td>
<td>None</td>
<td>May 2016</td>
</tr>
<tr>
<td>CVE-2016-2060</td>
<td><a href="https://source.codeaurora.org/quic/la/platform/system/netd/commit/?id=e9925f5acb4401588e23ea8a27c3e318f71b5cf8">
QC-CR#959631</a></td>
<td>Moderate</td>
<td>None</td>
<td>Apr 2016</td>
</tr>
</table>
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
<p>
This section answers common questions that may occur after reading this
bulletin.
</p>
<p>
<strong>1. How do I determine if my device is updated to address these issues?
</strong>
</p>
<p>
Security Patch Levels of 2016-08-01 or later address all issues associated with
the 2016-08-01 security patch string level. Security Patch Levels of 2016-08-05
or later address all issues associated with the 2016-08-05 security patch string
level. Refer to the <a
href="https://support.google.com/nexus/answer/4457705">help center</a> for
instructions on how to check the security patch level. Device manufacturers that
include these updates should set the patch string level to:
[ro.build.version.security_patch]:[2016-08-01] or
[ro.build.version.security_patch]:[2016-08-05].
</p>
<p>
<strong>2. Why does this bulletin have two security patch level
strings?</strong>
</p>
<p>
This bulletin has two security patch level strings in order to provide Android
partners with the flexibility to move more quickly to fix a subset of
vulnerabilities that are similar across all Android devices. Android partners
are encouraged to fix all issues in this bulletin and use the latest security
patch level string.
</p>
<p>
Devices that use the security patch level of August 5, 2016 or newer must
include all applicable patches in this (and previous) security bulletins.
</p>
<p>
Devices that use the August 1, 2016 security patch level must include all issues
associated with that security patch level, as well as fixes for all issues
reported in previous security bulletins. Devices that use August 1, 2016
security patch level may also include a subset of fixes associated with the
August 5, 2016 security patch level.
</p>
<p>
3<strong>. How do I determine which Nexus devices are affected by each
issue?</strong>
</p>
<p>
In the <a
href="#2016-08-01-security-patch-level-security-vulnerability-details">2016-08-01</a>
and <a
href="#2016-08-05-security-patch-level-vulnerability-details">2016-08-05</a>
security vulnerability details sections, each table has an Updated Nexus devices
column that covers the range of affected Nexus devices updated for each issue.
This column has a few options:
</p>
<ul>
<li><strong>All Nexus devices</strong>: If an issue affects all Nexus devices,
the table will have “All Nexus” in the <em>Updated Nexus devices</em> column.
“All Nexus” encapsulates the following <a
href="https://support.google.com/nexus/answer/4457705#nexus_devices">supported
devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9,
Android One, Nexus Player, and Pixel C.</li>
<li><strong>Some Nexus devices</strong>: If an issue doesn’t affect all Nexus
devices, the affected Nexus devices are listed in the <em>Updated Nexus
devices</em> column.</li>
<li><strong>No Nexus devices</strong>: If no Nexus devices are affected by the
issue, the table will have “None” in the <em>Updated Nexus devices</em> column.
</li>
</ul>
<p>
<strong>4. What do the entries in the references column map to?</strong>
</p>
<p>
Entries under the <em>References</em> column of the vulnerability details table
may contain a prefix identifying the organization to which the reference value
belongs. These prefixes map as follows:
</p>
<table>
<tr>
<th>Prefix</th>
<th>Reference</th>
</tr>
<tr>
<td>A-</td>
<td>Android bug ID</td>
</tr>
<tr>
<td>QC-</td>
<td>Qualcomm reference number</td>
</tr>
<tr>
<td>M-</td>
<td>MediaTek reference number</td>
</tr>
<tr>
<td>N-</td>
<td>NVIDIA reference number</td>
</tr>
</table>
<h2 id="revisions">Revisions</h2>
<ul>
<li>August 01, 2016: Bulletin published.</li>
<li>August 02, 2016: Bulletin revised to include AOSP links.</li>
<li>August 16, 2016: CVE-2016-3856 corrected to CVE-2016-2060 and updated the
reference URL.</li>
<li>October 21, 2016: Corrected typo in CVE-2016-4486.</li>
</ul>