page.title=Android Security Bulletin—October 2016
@jd:body

<!--
    Copyright 2016 The Android Open Source Project

    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at

        http://www.apache.org/licenses/LICENSE-2.0

    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
-->
<p><em>Published October 03, 2016 | Updated October 04, 2016</em>
</p>
<p>
The Android Security Bulletin contains details of security vulnerabilities
affecting Android devices. Alongside the bulletin, we have released a security
update to Nexus devices through an over-the-air (OTA) update. The Nexus firmware
images have also been released to the
<a href="https://developers.google.com/android/nexus/images">Google Developer
site</a>. Security Patch Levels of October 05, 2016 or later address these
issues. Refer to the
<a href="https://support.google.com/nexus/answer/4457705#nexus_devices">documentation</a>
to learn how to check the security patch level. Supported Nexus devices will
receive a single OTA update with the October 05, 2016 security patch level.
</p>
<p>
Partners were notified about the issues described in the bulletin on September
06, 2016 or earlier.  Where applicable, source code patches for these issues
have been released to the Android Open Source Project (AOSP) repository. This
bulletin also includes links to patches outside of AOSP.
</p>
<p>
The most severe of these issues are Critical security vulnerabilities in
device-specific code that could enable remote code execution within the context
of the kernel, leading to the possibility of a local permanent device
compromise, which may require reflashing the operating system to repair the
device.
</p>
<p>
We have had no reports of active customer exploitation or abuse of these newly
reported issues. Refer to the <a href="#mitigations">Android and Google service
mitigations</a> section for details on the
<a href="{@docRoot}security/enhancements/index.html">Android
security platform protections</a> and service protections such as
<a href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>,
which improve the security of the Android platform.
</p>
<p>
We encourage all customers to accept these updates to their devices.
</p>
<h2 id="announcements">Announcements</h2>
<ul>
  <li>This bulletin has two security patch level strings to provide Android
  partners with the flexibility to more quickly fix a subset of vulnerabilities
  that are similar across all Android devices. See
  <a href="#common-questions-and-answers">Common questions and answers</a> for
  additional information:
    <ul>
       <li><strong>2016-10-01</strong>: Partial security patch level string. This
      security patch level string indicates that all issues associated with 2016-10-01
      (and all previous security patch level strings) are addressed.</li>
       <li><strong>2016-10-05</strong>: Complete security patch level string. This
      security patch level string indicates that all issues associated with 2016-10-01
      and 2016-10-05 (and all previous security patch level strings) are addressed.</li>
    </ul>
  </li>
  <li>Supported Nexus devices will receive a single OTA update with the October
  05, 2016 security patch level.</li>
</ul>
<h2 id="security-vulnerability-summary">Security vulnerability summary</h2>
<p>
The tables below contains a list of security vulnerabilities, the Common
Vulnerability and Exposures ID (CVE), the assessed severity, and whether or not
Nexus devices are affected. The
<a href="{@docRoot}security/overview/updates-resources.html#severity">severity
assessment</a> is based on the effect that exploiting the vulnerability would
possibly have on an affected device, assuming the platform and service
mitigations are disabled for development purposes or if successfully bypassed.
</p>
<h3 id="2016-10-01-security-patch-level-vulnerability-summary">2016-10-01
security patch level—Vulnerability summary</h3>
<p>
Security patch levels of 2016-10-01 or later must address the following issues.
</p>
<table>
  <col width="55%">
  <col width="20%">
  <col width="13%">
  <col width="12%">
  <tr>
   <th>Issue</th>
   <th>CVE</th>
   <th>Severity</th>
   <th>Affects Nexus?</th>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in ServiceManager</td>
   <td>CVE-2016-3900</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Lock Settings Service</td>
   <td>CVE-2016-3908</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Mediaserver</td>
   <td>CVE-2016-3909, CVE-2016-3910, CVE-2016-3913</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Zygote process</td>
   <td>CVE-2016-3911</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in framework APIs</td>
   <td>CVE-2016-3912</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Telephony</td>
   <td>CVE-2016-3914</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Camera service</td>
   <td>CVE-2016-3915, CVE-2016-3916</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in fingerprint login</td>
   <td>CVE-2016-3917</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in AOSP Mail</td>
   <td>CVE-2016-3918</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in Wi-Fi</td>
   <td>CVE-2016-3882</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in GPS</td>
   <td>CVE-2016-5348</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in Mediaserver</td>
   <td>CVE-2016-3920</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Framework Listener</td>
   <td>CVE-2016-3921</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Telephony</td>
   <td>CVE-2016-3922</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Accessibility services</td>
   <td>CVE-2016-3923</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in Mediaserver</td>
   <td>CVE-2016-3924</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in Wi-Fi</td>
   <td>CVE-2016-3925</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
</table>
<h3 id="2016-10-05-security-patch-level-vulnerability-summary">2016-10-05
security patch level—Vulnerability summary</h3>
<p>
Security patch levels of 2016-10-05 or later must address all of the 2016-10-01
issues as well as the following issues.
</p>
<table>
  <col width="55%">
  <col width="20%">
  <col width="13%">
  <col width="12%">
  <tr>
   <th>Issue</th>
   <th>CVE</th>
   <th>Severity</th>
   <th>Affects Nexus?</th>
  </tr>
  <tr>
   <td>Remote code execution vulnerability in kernel ASN.1 decoder</td>
   <td>CVE-2016-0758</td>
   <td>Critical</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Remote code execution vulnerability in kernel networking subsystem</td>
   <td>CVE-2016-7117</td>
   <td>Critical</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in MediaTek video driver</td>
   <td>CVE-2016-3928</td>
   <td>Critical</td>
   <td>No</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in kernel shared memory driver</td>
   <td>CVE-2016-5340</td>
   <td>Critical</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Vulnerabilities in Qualcomm components</td>
   <td>CVE-2016-3926, CVE-2016-3927, CVE-2016-3929</td>
   <td>Critical</td>
   <td>Yes</td>
  </tr>

  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm networking component</td>
   <td>CVE-2016-2059</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in NVIDIA MMC test driver</td>
   <td>CVE-2016-3930</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm Secure Execution
Environment Communicator driver</td>
   <td>CVE-2016-3931</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Mediaserver</td>
   <td>CVE-2016-3932, CVE-2016-3933</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm camera driver</td>
   <td>CVE-2016-3903, CVE-2016-3934</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm sound driver</td>
   <td>CVE-2015-8951</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm crypto engine driver</td>
   <td>CVE-2016-3901, CVE-2016-3935</td>
   <td>High</td>
   <td>No</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in MediaTek video driver</td>
   <td>CVE-2016-3936, CVE-2016-3937</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm video driver</td>
   <td>CVE-2016-3938, CVE-2016-3939</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Synaptics touchscreen driver</td>
   <td>CVE-2016-3940, CVE-2016-6672</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in NVIDIA camera driver</td>
   <td>CVE-2016-6673</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in system_server</td>
   <td>CVE-2016-6674</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm Wi-Fi driver</td>
   <td>CVE-2016-3905, CVE-2016-6675, CVE-2016-6676, CVE-2016-5342</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in kernel performance subsystem</td>
   <td>CVE-2015-8955</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in kernel ION subsystem</td>
   <td>CVE-2015-8950</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in NVIDIA GPU driver</td>
   <td>CVE-2016-6677</td>
   <td>High</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Elevation of privilege vulnerability in Qualcomm character driver</td>
   <td>CVE-2015-0572</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in Qualcomm sound driver</td>
   <td>CVE-2016-3860</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in Motorola USBNet driver</td>
   <td>CVE-2016-6678</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in Qualcomm components</td>
   <td>CVE-2016-6679, CVE-2016-3902, CVE-2016-6680, CVE-2016-6681, CVE-2016-6682</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in kernel components</td>
   <td>CVE-2016-6683, CVE-2016-6684, CVE-2015-8956, CVE-2016-6685</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in NVIDIA profiler</td>
   <td>CVE-2016-6686, CVE-2016-6687, CVE-2016-6688</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Information disclosure vulnerability in kernel</td>
   <td>CVE-2016-6689</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in kernel networking subsystem</td>
   <td>CVE-2016-5696</td>
   <td>Moderate</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Denial of service vulnerability in kernel sound driver</td>
   <td>CVE-2016-6690</td>
   <td>Low</td>
   <td>Yes</td>
  </tr>
  <tr>
   <td>Vulnerabilities in Qualcomm components</td>
   <td>CVE-2016-6691, CVE-2016-6692, CVE-2016-6693, CVE-2016-6694,
       CVE-2016-6695, CVE-2016-6696, CVE-2016-5344, CVE-2016-5343</td>
   <td>High</td>
   <td>No</td>
  </tr>
</table>

<h2 id="mitigations">Android and Google service mitigations</h2>
<p>
This is a summary of the mitigations provided by the
<a href="{@docRoot}security/enhancements/index.html">Android
security platform</a> and service protections such as SafetyNet. These
capabilities reduce the likelihood that security vulnerabilities could be
successfully exploited on Android.
</p>
<ul>
  <li>Exploitation for many issues on Android is made more difficult by
  enhancements in newer versions of the Android platform. We encourage all users
  to update to the latest version of Android where possible.</li>
  <li>The Android Security team actively monitors for abuse with <a
  href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
  Apps and SafetyNet</a>, which are designed to warn users about <a
  href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
  Harmful Applications</a>. Verify Apps is enabled by default on devices with <a
  href="http://www.android.com/gms">Google Mobile Services</a>, and is especially
  important for users who install applications from outside of Google Play. Device
  rooting tools are prohibited within Google Play, but Verify Apps warns users
  when they attempt to install a detected rooting application—no matter where it
  comes from. Additionally, Verify Apps attempts to identify and block
  installation of known malicious applications that exploit a privilege escalation
  vulnerability. If such an application has already been installed, Verify Apps
  will notify the user and attempt to remove the detected application.</li>
  <li>As appropriate, Google Hangouts and Messenger applications do not
  automatically pass media to processes such as Mediaserver.</li>
</ul>
<h2 id="acknowledgements">Acknowledgements</h2>
<p>
We would like to thank these researchers for their contributions:
</p>
<ul>
  <li>Andre Teixeira Rizzo: CVE-2016-3882</li>
  <li>Andrea Biondo: CVE-2016-3921</li>
  <li>Daniel Micay of Copperhead Security: CVE-2016-3922</li>
  <li><a href="https://github.com/google/syzkaller">Dmitry Vyukov</a> of Google:
  CVE-2016-7117</li>
  <li>dosomder: CVE-2016-3931</li>
  <li>Ecular Xu (徐健) of Trend Micro: CVE-2016-3920</li>
  <li>Gengjia Chen (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>)
  and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360
  Technology Co. Ltd.: CVE-2016-6690, CVE-2016-3901, CVE-2016-6672, CVE-2016-3940,
  CVE-2016-3935</li>
  <li><a href="mailto:hzhan033@ucr.edu">Hang Zhang</a>,
  <a href="mailto:dshe002@ucr.edu">Dongdong She</a>, and
  <a href="mailto:zhiyunq@cs.ucr.edu">Zhiyun Qian</a> of UC Riverside: CVE-2015-8950</li>
  <li>Hao Chen of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3860</li>
  <li>Jann Horn of Google Project Zero: CVE-2016-3900, CVE-2016-3885</li>
  <li><a href="http://keybase.io/jasonrogena">Jason Rogena</a>: CVE-2016-3917</li>
  <li>Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and
  <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab, Qihoo 360: CVE-2016-6688,
  CVE-2016-6677, CVE-2016-6673, CVE-2016-6687, CVE-2016-6686, CVE-2016-6681,
  CVE-2016-6682, CVE-2016-3930</li>
  <li>Joshua Drake (<a href="https://twitter.com/jduck">@jduck</a>):
      CVE-2016-3920</li>
  <li>Maciej Szawłowski of Google security team: CVE-2016-3905</li>
  <li>Mark Brand of Google Project Zero: CVE-2016-6689</li>
  <li><a href="https://github.com/michalbednarski">Michał Bednarski</a>:
  CVE-2016-3914, CVE-2016-6674, CVE-2016-3911, CVE-2016-3912</li>
  <li>Mingjian Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>),
  Chiachih Wu (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian
  Jiang of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3933, CVE-2016-3932</li>
  <li>Nightwatch Cybersecurity Research
  (<a href="https://twitter.com/nightwatchcyber">@nightwatchcyber</a>): CVE-2016-5348</li>
  <li>Roee Hay, IBM Security X-Force Researcher: CVE-2016-6678</li>
  <li>Samuel Tan of Google: CVE-2016-3925</li>
  <li><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a>
  (<a href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>):
  CVE-2016-3936, CVE-2016-3928, CVE-2016-3902, CVE-2016-3937, CVE-2016-6696</li>
  <li>Seven Shen (<a href="https://twitter.com/lingtongshen">@lingtongshen</a>) of
  Trend Micro Mobile Threat Research Team: CVE-2016-6685, CVE-2016-6683,
  CVE-2016-6680, CVE-2016-6679, CVE-2016-3903, CVE-2016-6693, CVE-2016-6694,
  CVE-2016-6695</li>
  <li><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a>, Mingjian Zhou
  (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>), Chiachih Wu
  (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
  <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-3909</li>
  <li>Wenlin Yang and Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>)
  of Alpha Team, Qihoo 360 Technology Co. Ltd.: CVE-2016-3918</li>
  <li>Wish Wu (<a href="http://weibo.com/wishlinux">吴潍浠</a>)
  (<a href="https://twitter.com/wish_wu">@wish_wu)</a> of
  <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/author/wishwu/">Trend
  Micro Inc.</a>: CVE-2016-3924, CVE-2016-3915, CVE-2016-3916, CVE-2016-3910</li>
  <li>Yong Shi of Eagleye team, SCC, Huawei: CVE-2016-3938</li>
  <li>Zhanpeng Zhao (行之) (<a href="https://twitter.com/0xr0ot">@0xr0ot</a>) of
  Security Research Lab, <a href="http://www.cmcm.com">Cheetah Mobile</a>:
  CVE-2016-3908</li>
</ul>

<h2 id="2016-10-01-security-patch-level-vulnerability-details">2016-10-01
security patch level—Vulnerability details</h2>
<p>
In the sections below, we provide details for each of the security
vulnerabilities listed in the
<a href="#2016-10-01-security-patch-level-vulnerability-summary">2016-10-01
security patch level—Vulnerability summary</a> above. There is a description of
the issue, a severity rationale, and a table with the CVE, associated
references, severity, updated Nexus devices, updated AOSP versions (where
applicable), and date reported. When available, we will link the public change
that addressed the issue to the bug ID, like the AOSP change list. When multiple
changes relate to a single bug, additional references are linked to numbers
following the bug ID.
</p>
<h3 id="eopv-in-servicemanager">Elevation of privilege vulnerability in ServiceManager</h3>
<p>
An elevation of privilege in ServiceManager could enable a local malicious
application to register arbitrary services that would normally be provided by a
privileged process, such as the system_server. This issue is rated as High
severity due to the possibility of service impersonation.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3900</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/native/+/d3c6ce463ac91ecbeb2128beb475d31d3ca6ef42">A-29431260</a>
      [<a href="https://android.googlesource.com/platform/frameworks/native/+/047eec456943dc082e33220d28abb7df4e089f69">2</a>]
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jun 15, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-lock-settings-service">Elevation
of privilege vulnerability in Lock Settings Service</h3>
<p>
An elevation of privilege vulnerability in Lock Settings Service could enable a
local malicious application to clear the device PIN or password. This issue is
rated as High because it is a local bypass of user interaction requirements for
any developer or security settings modifications.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3908</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/96daf7d4893f614714761af2d53dfb93214a32e4">A-30003944</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>6.0, 6.0.1, 7.0</td>
   <td>Jul 6, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-mediaserver">Elevation of privilege vulnerability in Mediaserver</h3>
<p>
An elevation of privilege vulnerability in Mediaserver could enable a local
malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3909</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/av/+/d4271b792bdad85a80e2b83ab34c4b30b74f53ec">A-30033990</a>
      [<a href="https://android.googlesource.com/platform/frameworks/av/+/c48ef757cc50906e8726a3bebc3b60716292cdba">2</a>]
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 8, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3910</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/av/+/035cb12f392860113dce96116a5150e2fde6f0cc">A-30148546</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 13, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3913</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/av/+/0c3b93c8c2027e74af642967eee5c142c8fd185d">A-30204103</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 18, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-zygote-process">Elevation of privilege vulnerability in Zygote process</h3>
<p>
An elevation of privilege in the Zygote process could enable a local malicious
application to execute arbitrary code within the context of a privileged
process. This issue is rated as High because it could be used to gain local
access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3911</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/2c7008421cb67f5d89f16911bdbe36f6c35311ad">A-30143607</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 12, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-framework-apis">Elevation of privilege vulnerability in framework APIs</h3>
<p>
An elevation of privilege vulnerability in the framework APIs could enable a
local malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3912</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/6c049120c2d749f0c0289d822ec7d0aa692f55c5">A-30202481</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 17, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-telephony">Elevation of privilege vulnerability in Telephony</h3>
<p>
An elevation of privilege vulnerability in the Telephony component could enable
a local malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3914</td>
   <td><a href="https://android.googlesource.com/platform/packages/providers/TelephonyProvider/+/3a3a5d145d380deef2d5b7c3150864cd04be397f">A-30481342</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 28, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-camera-service">Elevation of privilege vulnerability in Camera service</h3>
<p>
An elevation of privilege vulnerability in the Camera service could enable a
local malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3915</td>
   <td><a href="https://android.googlesource.com/platform/system/media/+/e9e44f797742f52996ebf307740dad58c28fd9b5">A-30591838</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Aug 1, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3916</td>
   <td><a href="https://android.googlesource.com/platform/system/media/+/8e7a2b4d13bff03973dbad2bfb88a04296140433">A-30741779</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Aug 2, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-fingerprint-login">Elevation of privilege vulnerability in fingerprint login</h3>
<p>
An elevation of privilege vulnerability during fingerprint login could enable a
malicious device owner to login as a different user account on the device. This
issue is rated as High due to the possibility of a lockscreen bypass.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3917</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd">A-30744668</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>6.0.1, 7.0</td>
   <td>Aug 5, 2016</td>
  </tr>
</table>
<h3 id="information-disclosure-vulnerability-in-aosp-mail">Information
disclosure vulnerability in AOSP Mail</h3>
<p>
An information disclosure vulnerability in AOSP Mail could enable a local
malicious application to bypass operating system protections that isolate
application data from other applications. This issue is rated as High because it
could be used to access data without permission.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3918</td>
   <td><a href="https://android.googlesource.com/platform/packages/apps/Email/+/6b2b0bd7c771c698f11d7be89c2c57c8722c7454">A-30745403</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Aug 5, 2016</td>
  </tr>
</table>
<h3 id="dosv-in-wi-fi">Denial of service
vulnerability in Wi-Fi</h3>
<p>
A denial of service vulnerability in Wi-Fi could enable a local proximate
attacker to create a hotspot and cause a device reboot. This issue is rated as
High due to the possibility of a temporary remote denial of service.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="17%">
  <col width="19%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3882</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/35a86eef3c0eef760f7e61c52a343327ba601630">A-29464811</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>6.0, 6.0.1, 7.0</td>
   <td>Jun 17, 2016</td>
  </tr>
</table>
<h3 id="dosv-in-gps">Denial of service vulnerability in GPS</h3>
<p>
A denial of service vulnerability in the GPS component could enable a remote
attacker to cause a device hang or reboot. This issue is rated as High due to
the possibility of a temporary remote denial of service.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-5348</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/218b813d5bc2d7d3952ea1861c38b4aa944ac59b">A-29555864</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jun 20, 2016</td>
  </tr>
</table>
<h3 id="dosv-in-mediaserver">Denial of service vulnerability in Mediaserver</h3>
<p>
A denial of service vulnerability in Mediaserver could enable an attacker to use
a specially crafted file to cause a device hang or reboot. This issue is rated
as High due to the possibility of remote denial of service.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3920</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/av/+/6d0249be2275fd4086783f259f4e2c54722a7c55">A-30744884</a>
   </td>
   <td>High</td>
   <td>All Nexus</td>
   <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Aug 5, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-framework-listener">Elevation of privilege vulnerability in Framework Listener</h3>
<p>
An elevation of privilege vulnerability in Framework Listener could enable a
local malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as Moderate because it first requires
compromising a privileged process.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="18%">
  <col width="20%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3921</td>
   <td><a href="https://android.googlesource.com/platform/system/core/+/771ab014c24a682b32990da08e87e2f0ab765bd2">A-29831647</a>
   </td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jun 25, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-telephony-2">Elevation of privilege vulnerability in Telephony</h3>
<p>
An elevation of privilege vulnerability in Telephony could enable a local
malicious application to execute arbitrary code in the context of a privileged
process. This issue is rated as Moderate because it first requires compromising
a privileged process.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="19%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3922</td>
   <td><a href="https://android.googlesource.com/platform/hardware/ril/+/95610818918f6f11fe7d23aca1380e6c0fac2af0">A-30202619</a>
   </td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>6.0, 6.0.1, 7.0</td>
   <td>Jul 17, 2016</td>
  </tr>
</table>
<h3
id="eopv-in-accessibility-services">Elevation of privilege vulnerability in Accessibility services</h3>
<p>
An elevation of privilege vulnerability in the Accessibility services could
enable a local malicious application to generate unexpected touch events on the
device that could lead to applications accepting permission dialogs without the
user’s explicit consent. This issue is rated as Moderate because it is a local
bypass of user interaction requirements that would normally require either user
initiation or user permission.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="18%">
  <col width="18%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3923</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/base/+/5f256310187b4ff2f13a7abb9afed9126facd7bc">A-30647115</a>
   </td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>7.0</td>
   <td>Google internal</td>
  </tr>
</table>
<h3 id="information-disclosure-vulnerability-in-mediaserver">Information
disclosure vulnerability in Mediaserver</h3>
<p>
An information disclosure vulnerability in Mediaserver could enable a local
malicious application to access data outside of its permission levels. This
issue is rated as Moderate because it could be used to access sensitive data
without permission.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="18%">
  <col width="20%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3924</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/av/+/c894aa36be535886a8e5ff02cdbcd07dd24618f6">A-30204301</a>
   </td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
   <td>Jul 18, 2016</td>
  </tr>
</table>
<h3 id="dosv-in-wi-fi-2">Denial of service vulnerability in Wi-Fi</h3>
<p>
A denial of service vulnerability in the Wi-Fi service could enable a local
malicious application to prevent Wi-Fi calling. This issue is rated as Moderate
due to the possibility of a denial of service to application functionality.
</p>
<table>
  <col width="18%">
  <col width="16%">
  <col width="10%">
  <col width="19%">
  <col width="17%">
  <col width="19%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Updated AOSP versions</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3925</td>
   <td><a href="https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/c2905409c20c8692d4396b8531b09e7ec81fa3fb">A-30230534</a>
   </td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>6.0, 6.0.1, 7.0</td>
   <td>Google internal</td>
  </tr>
</table>
<h2 id="2016-10-05-security-patch-level-vulnerability-details">2016-10-05
security patch level—Vulnerability details</h2>
<p>
In the sections below, we provide details for each of the security
vulnerabilities listed in the
<a href="#2016-10-05-security-patch-level-vulnerability-summary">2016-10-05
security patch level—Vulnerability summary</a> above. There is a description of
the issue, a severity rationale, and a table with the CVE, associated
references, severity, updated Nexus devices, updated AOSP versions (where
applicable), and date reported. When available, we will link the public change
that addressed the issue to the bug ID, like the AOSP change list. When multiple
changes relate to a single bug, additional references are linked to numbers
following the bug ID.
</p>
<h3 id="remote-code-execution-vulnerability-in-kernel-asn-1-decoder">Remote code
execution vulnerability in kernel ASN.1 decoder</h3>
<p>
An elevation of privilege vulnerability in the kernel ASN.1 decoder could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as Critical due to the possibility of a local
permanent device compromise, which may require reflashing the operating system
to repair the device.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-0758</td>
   <td>A-29814470<br>
      <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=23c8a812dc3c621009e4f0e5342aa4e2ede1ceaa">
      Upstream kernel</a></td>
   <td>Critical</td>
   <td>Nexus 5X, Nexus 6P</td>
   <td>May 12, 2016</td>
  </tr>
</table>
<h3
id="remote-code-execution-vulnerability-in-kernel-networking-subsystem">Remote
code execution vulnerability in kernel networking subsystem</h3>
<p>
A remote code execution vulnerability in the kernel networking subsystem could
enable a remote attacker to execute arbitrary code within the context of the
kernel. This issue is rated as Critical due to the possibility of a local
permanent device compromise, which may require reflashing the operating system
to repair the device.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-7117</td>
   <td>A-30515201<br>
<a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=34b88a68f26a75e4fded796f1a49c40f82234b7d">Upstream
kernel</a></td>
   <td>Critical</td>
   <td>All Nexus</td>
   <td>Google internal</td>
  </tr>
</table>
<h3 id="eopv-in-mediatek-video-driver">Elevation
of privilege vulnerability in MediaTek video driver</h3>
<p>
An elevation of privilege vulnerability in the MediaTek video driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Critical due to the possibility of
a local permanent device compromise, which may require reflashing the operating
system to repair the device.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3928</td>
   <td>A-30019362*<br>
       M-ALPS02829384</td>
   <td>Critical</td>
   <td>None</td>
   <td>Jul 6, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3
id="eopv-in-kernel-shared-memory-driver">Elevation
of privilege vulnerability in kernel shared memory driver</h3>
<p>
An elevation of privilege vulnerability in the kernel shared memory driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Critical due to the possibility of
a local permanent device compromise, which may require reflashing the operating
system to repair the device.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-5340</td>
   <td>A-30652312<br>
      <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=06e51489061e5473b4e2035c79dcf7c27a6f75a6">QC-CR#1008948</a></td>
   <td>Critical</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jul 26, 2016</td>
  </tr>
</table>

<h3 id="vulnerabilities-in-qc-components">
Vulnerabilities in Qualcomm components</h3>
<p>
The table below contains security vulnerabilities affecting Qualcomm components
and are described in further detail in the Qualcomm AMSS March 2016 and
Qualcomm AMSS April 2016 security bulletins.
</p>
<table>
  <col width="19%">
  <col width="16%">
  <col width="10%">
  <col width="23%">
  <col width="21%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3926</td>
   <td>A-28823953*</td>
   <td>Critical</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P</td>
   <td>Qualcomm internal</td>
  </tr>
  <tr>
   <td>CVE-2016-3927</td>
   <td>A-28823244*</td>
   <td>Critical</td>
   <td>Nexus 5X, Nexus 6P</td>
   <td>Qualcomm internal</td>
  </tr>
  <tr>
   <td>CVE-2016-3929</td>
   <td>A-28823675*</td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6P</td>
   <td>Qualcomm internal</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-qualcomm-networking-component">Elevation
of privilege vulnerability in Qualcomm networking component</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm networking component
could enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-2059</td>
   <td>A-27045580<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=9e8bdd63f7011dff5523ea435433834b3702398d">QC-CR#974577</a></td>
   <td>High</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Feb 4, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-nvidia-mmc-test-driver">Elevation of privilege vulnerability in
NVIDIA MMC test driver</h3>
<p>
An elevation of privilege vulnerability in the NVIDIA MMC test driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3930</td>
   <td>A-28760138*<br>
       N-CVE-2016-3930</td>
   <td>High</td>
   <td>Nexus 9</td>
   <td>May 12, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3
id="eopv-in-qsee-communicator-driver">Elevation of privilege vulnerability in
Qualcomm QSEE Communicator driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm QSEE
Communicator driver could enable a local malicious application to
execute arbitrary code within the context of the kernel. This issue is rated as
High because it first requires compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3931</td>
   <td>A-29157595<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e80b88323f9ff0bb0e545f209eec08ec56fca816">QC-CR#1036418</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jun 4, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-mediaserver-2">Elevation of privilege vulnerability in Mediaserver</h3>
<p>
An elevation of privilege vulnerability in Mediaserver could enable a local
malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3932</td>
   <td>A-29161895<br>
       M-ALPS02770870</td>
   <td>High</td>
   <td>None</td>
   <td>Jun 6, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3933</td>
   <td>A-29421408*<br>
       N-CVE-2016-3933</td>
   <td>High</td>
   <td>Nexus 9, Pixel C</td>
   <td>Jun 14, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-qualcomm-camera-driver">Elevation of privilege vulnerability
in Qualcomm camera driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm camera driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3903</td>
   <td>A-29513227<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=b8874573428e8ce024f57c6242d662fcca5e5d55">QC-CR#1040857</a></td>
   <td>High</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jun 20, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3934</td>
   <td>A-30102557<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=27fbeb6b025d5d46ccb0497cbed4c6e78ed1c5cc">QC-CR#789704</a></td>
   <td>High</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jul 12, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-qualcomm-sound-driver">Elevation
of privilege vulnerability in Qualcomm sound driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm sound driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2015-8951</td>
   <td>A-30142668<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?h=APSS.FSM.3.0&id=ccff36b07bfc49efc77b9f1b55ed2bf0900b1d5b">QC-CR#948902</a><br>
      QC-CR#948902</td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6P, Android One</td>
   <td>Jun 20, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-qualcomm-crypto-engine-driver">Elevation
of privilege vulnerability in Qualcomm crypto engine driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm cryptographic engine
driver could enable a local malicious application to execute arbitrary code
within the context of the kernel. This issue is rated as High because it first
requires compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3901</td>
   <td>A-29999161<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5f69ccf3b011c1d14a1b1b00dbaacf74307c9132">QC-CR#1046434</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jul 6, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3935</td>
   <td>A-29999665<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5f69ccf3b011c1d14a1b1b00dbaacf74307c9132">QC-CR#1046507</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jul 6, 2016</td>
  </tr>
</table>
<h3 id="eopv-in-mediatek-video-driver-2">Elevation
of privilege vulnerability in MediaTek video driver</h3>
<p>
An elevation of privilege vulnerability in the MediaTek video driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3936</td>
   <td>A-30019037*<br>
       M-ALPS02829568</td>
   <td>High</td>
   <td>None</td>
   <td>Jul 6, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3937</td>
   <td>A-30030994*<br>
       M-ALPS02834874</td>
   <td>High</td>
   <td>None</td>
   <td>Jul 7, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-qualcomm-video-driver">Elevation
of privilege vulnerability in Qualcomm video driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm video driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3938</td>
   <td>A-30019716<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=467c81f9736b1ebc8d4ba70f9221bba02425ca10">QC-CR#1049232</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Jul 7, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3939</td>
   <td>A-30874196<br>
      <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=e0bb18771d6ca71db2c2a61226827059be3fa424">QC-CR#1001224</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Android One</td>
   <td>Aug 15, 2016</td>
  </tr>
</table>
<h3
id="eopv-in-synaptics-touchscreen-driver">Elevation
of privilege vulnerability in Synaptics touchscreen driver</h3>
<p>
An elevation of privilege vulnerability in the Synaptics touchscreen driver
could enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3940</td>
   <td>A-30141991*</td>
   <td>High</td>
   <td>Nexus 6P, Android One</td>
   <td>Jul 12, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6672</td>
   <td>A-30537088*</td>
   <td>High</td>
   <td>Nexus 5X</td>
   <td>Jul 31, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-nvidia-camera-driver">Elevation
of privilege vulnerability in NVIDIA camera driver</h3>
<p>
An elevation of privilege vulnerability in the NVIDIA camera driver could enable
a local malicious application to execute arbitrary code within the context of
the kernel. This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6673</td>
   <td>A-30204201*<br>
       N-CVE-2016-6673</td>
   <td>High</td>
   <td>Nexus 9</td>
   <td>Jul 17, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-system_server">Elevation of privilege vulnerability in system_server</h3>
<p>
An elevation of privilege vulnerability in system_server could enable a local
malicious application to execute arbitrary code within the context of a
privileged process. This issue is rated as High because it could be used to gain
local access to elevated capabilities, which are not normally accessible to a
third-party application.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6674</td>
   <td>A-30445380*</td>
   <td>High</td>
   <td>All Nexus</td>
   <td>Jul 26, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="eopv-in-qualcomm-wi-fi-driver">Elevation
of privilege vulnerability in Qualcomm Wi-Fi driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm Wi-Fi driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3905</td>
   <td>A-28061823<br>
      <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=b5112838eb91b71eded4b5ee37338535784e0aef">QC-CR#1001449</a></td>
   <td>High</td>
   <td>Nexus 5X</td>
   <td>Google internal</td>
  </tr>
  <tr>
   <td>CVE-2016-6675</td>
   <td>A-30873776<br>
      <a href="https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=1353fa0bd0c78427f3ae7d9bde7daeb75bd01d09">QC-CR#1000861</a></td>
   <td>High</td>
   <td>Nexus 5X, Android One</td>
   <td>Aug 15, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6676</td>
   <td>A-30874066<br>
      <a href="https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6ba9136879232442a182996427e5c88e5a7512a8">QC-CR#1000853</a></td>
   <td>High</td>
   <td>Nexus 5X, Android One</td>
   <td>Aug 15, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-5342</td>
   <td>A-30878283<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=579e796cb089324c55e0e689a180575ba81b23d9">QC-CR#1032174</a></td>
   <td>High</td>
   <td>Android One</td>
   <td>Aug 15, 2016</td>
  </tr>
</table>
<h3
id="eopv-in-kernel-performance-subsystem">Elevation
of privilege vulnerability in kernel performance subsystem</h3>
<p>
An elevation of privilege vulnerability in the kernel performance subsystem
could enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as High because it first requires
compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2015-8955</td>
   <td>A-29508816<br>
      <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8fff105e13041e49b82f92eef034f363a6b1c071">Upstream kernel</a></td>
   <td>High</td>
   <td>Nexus 5X, Nexus 6P, Pixel C, Android One</td>
   <td>Google internal</td>
  </tr>
</table>
<h3
id="information-disclosure-vulnerability-in-kernel-ion-subsystem">Information
disclosure vulnerability in kernel ION subsystem</h3>
<p>
An information disclosure vulnerability in the kernel ION subsystem could enable
a local malicious application to access data outside of its permission levels.
This issue is rated as High because it could be used to access sensitive data
without explicit user permission.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2015-8950</td>
   <td>A-29795245<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8">QC-CR#1041735</a></td>
   <td>High</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P</td>
   <td>May 12, 2016</td>
  </tr>
</table>
<h3 id="information-disclosure-vulnerability-in-nvidia-gpu-driver">Information
disclosure vulnerability in NVIDIA GPU driver</h3>
<p>
An information disclosure vulnerability in the NVIDIA GPU driver could enable a
local malicious application to access data outside of its permission levels.
This issue is rated as High because it first requires compromising a
privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6677</td>
   <td>A-30259955*<br>
       N-CVE-2016-6677</td>
   <td>High</td>
   <td>Nexus 9</td>
   <td>Jul 19, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3
id="eopv-in-qualcomm-character-driver">Elevation
of privilege vulnerability in Qualcomm character driver</h3>
<p>
An elevation of privilege vulnerability in the Qualcomm character driver could
enable a local malicious application to execute arbitrary code within the
context of the kernel. This issue is rated as Moderate because it first requires
compromising a privileged process, and the vulnerable code is currently not
accessible.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2015-0572</td>
   <td>A-29156684<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=34ad3d34fbff11b8e1210b9da0dac937fb956b61">QC-CR#848489</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6P</td>
   <td>May 28, 2016</td>
  </tr>
</table>
<h3
id="information-disclosure-vulnerability-in-qualcomm-sound-driver">Information
disclosure vulnerability in Qualcomm sound driver</h3>
<p>
An information disclosure vulnerability in the Qualcomm sound driver could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as Moderate because it first requires compromising a
privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-3860</td>
   <td>A-29323142<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/diff/sound/soc/msm/qdsp6v2/audio_calibration.c?id=528976f54be246ec93a71ac53aa4faf3e3791c48">QC-CR#1038127</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6P, Android One</td>
   <td>Jun 13, 2016</td>
  </tr>
</table>
<h3
id="information-disclosure-vulnerability-in-motorola-usbnet-driver">Information
disclosure vulnerability in Motorola USBNet driver</h3>
<p>
An information disclosure vulnerability in the Motorola USBNet driver could
enable a local malicious application to access data outside of its permission
levels. This issue is rated as Moderate because it first requires compromising a
privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6678</td>
   <td>A-29914434*</td>
   <td>Moderate</td>
   <td>Nexus 6</td>
   <td>Jun 30, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-qualcomm-components">Information
disclosure vulnerability in Qualcomm components</h3>
<p>
An information disclosure vulnerability in Qualcomm components, including the
sound driver, IPA driver and Wi-Fi driver could enable a local malicious
application to access data outside of its permission levels. This issue is rated
as Moderate because it first requires compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6679</td>
   <td>A-29915601<br>
      <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=d39345f0abc309959d831d09fcbf1619cc0ae0f5">QC-CR#1000913</a>
[<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=f081695446679aa44baa0d00940ea18455eeb4c5">2</a>]</td>
   <td>Moderate</td>
   <td>Nexus 5X, Android One</td>
   <td>Jun 30, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-3902</td>
   <td>A-29953313*<br>
      <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=2fca425d781572393fbe51abe2e27a932d24a768">QC-CR#1044072</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6P,</td>
   <td>Jul 2, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6680</td>
   <td>A-29982678*<br>
      <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2f2fa073b95d4700de88c0f7558b4a18c13ac552">QC-CR#1048052</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Android One</td>
   <td>Jul 3, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6681</td>
   <td>A-30152182<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395">QC-CR#1049521</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6P, Android One</td>
   <td>Jul 14, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6682</td>
   <td>A-30152501<br>
      <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395">QC-CR#1049615</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6P, Android One</td>
   <td>Jul 14, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-kernel-components">Information
disclosure vulnerability in kernel components</h3>
<p>
An information disclosure vulnerability in kernel components, including
Binder, Sync, Bluetooth, and Sound driver, could enable a local malicious
application to access data outside of its permission levels. This issue is
rated as Moderate because it first requires compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="18%">
  <col width="10%">
  <col width="25%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6683</td>
   <td>A-30143283*</td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>Jul 13, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6684</td>
   <td>A-30148243*</td>
   <td>Moderate</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Android One</td>
   <td>Jul 13, 2016</td>
  </tr>
  <tr>
   <td>CVE-2015-8956</td>
   <td>A-30149612*</td>
   <td>Moderate</td>
   <td>Nexus 5, Nexus 6P, Android One</td>
   <td>Jul 14, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6685</td>
   <td>A-30402628*</td>
   <td>Moderate</td>
   <td>Nexus 6P</td>
   <td>Jul 25, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-nvidia-profiler">Information
disclosure vulnerability in NVIDIA profiler</h3>
<p>
An information disclosure vulnerability in the NVIDIA profiler could enable a
local malicious application to access data outside of its permission levels.
This issue is rated as Moderate because it first requires compromising a
privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6686</td>
   <td>A-30163101*<br>
       N-CVE-2016-6686</td>
   <td>Moderate</td>
   <td>Nexus 9</td>
   <td>Jul 15, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6687</td>
   <td>A-30162222*<br>
       N-CVE-2016-6687</td>
   <td>Moderate</td>
   <td>Nexus 9</td>
   <td>Jul 15, 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6688</td>
   <td>A-30593080*<br>
       N-CVE-2016-6688</td>
   <td>Moderate</td>
   <td>Nexus 9</td>
   <td>Aug 2, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="information-disclosure-vulnerability-in-kernel">Information disclosure
vulnerability in kernel</h3>
<p>
An information disclosure vulnerability in Binder could enable a local malicious
application to access data outside of its permission levels. This issue is rated
as Moderate because it first requires compromising a privileged process.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6689</td>
   <td>A-30768347*</td>
   <td>Moderate</td>
   <td>All Nexus</td>
   <td>Aug 9, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="dosv-in-kernel-networking-subsystem">Denial of service vulnerability
in kernel networking subsystem</h3>
<p>
A denial of service vulnerability in the kernel networking subsystem could
enable an attacker to block access to TCP connections and cause a temporary
remote denial of service. This issue is rated as Moderate because cellular
services are still available and the device is still usable.
</p>
<table>
  <col width="19%">
  <col width="18%">
  <col width="10%">
  <col width="25%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-5696</td>
   <td>A-30809774<br>
      <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=75ff39ccc1bd5d3c455b6822ab09e533c551f758">Upstream
       kernel</a></td>
   <td>Moderate</td>
   <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C, Android One</td>
   <td>Jul 12, 2016</td>
  </tr>
</table>
<h3 id="dosv-in-kernel-sound-driver">Denial of service vulnerability in kernel
sound driver</h3>
<p>
A denial of service vulnerability in the kernel could allow a local malicious
application to cause a device reboot. This issue is rated as Low because it is a
temporary denial of service.
</p>
<table>
  <col width="19%">
  <col width="18%">
  <col width="10%">
  <col width="25%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6690</td>
   <td>A-28838221*</td>
   <td>Low</td>
   <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus Player</td>
   <td>May 18, 2016</td>
  </tr>
</table>
<p>
* The patch for this issue is not publicly available. The update is contained in
the latest binary drivers for Nexus devices available from the
<a href="https://developers.google.com/android/nexus/drivers">Google Developer
site</a>.
</p>
<h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm
components</h3>
<p>
The table below contains a list of security vulnerabilities that affect Qualcomm
components.
</p>
<table>
  <col width="19%">
  <col width="20%">
  <col width="10%">
  <col width="23%">
  <col width="17%">
  <tr>
   <th>CVE</th>
   <th>References</th>
   <th>Severity</th>
   <th>Updated Nexus devices</th>
   <th>Date reported</th>
  </tr>
  <tr>
   <td>CVE-2016-6691</td>
   <td><a href="https://source.codeaurora.org/quic/la//platform/frameworks/opt/net/wifi/commit/?id=343f123c396b2a97fc7cce396cd5d99365cb9131">QC-CR#978452</a></td>
   <td>High</td>
   <td>None</td>
   <td>Jul 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6692</td>
   <td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=0f0e7047d39f9fb3a1a7f389918ff79cdb4a50b3">QC-CR#1004933</a></td>
   <td>High</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6693</td>
   <td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=ac328eb631fa74a63d5d2583e6bfeeb5a7a2df65">QC-CR#1027585</a></td>
   <td>High</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6694</td>
   <td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=961e38553aae8ba9b1af77c7a49acfbb7b0b6f62">QC-CR#1033525</a></td>
   <td>High</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6695</td>
   <td><a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=c319c2b0926d1ea5edb4d0778d88bd3ce37c4b95">QC-CR#1033540</a></td>
   <td>High</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-6696</td>
   <td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=c3c9341bfdf93606983f893a086cb33a487306e5">QC-CR#1041130</a></td>
   <td>High</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-5344</td>
   <td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=64e15c36d6c1c57dc2d95a3f163bc830a469fc20">QC-CR#993650</a></td>
   <td>Moderate</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
  <tr>
   <td>CVE-2016-5343</td>
   <td><a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08">QC-CR#1010081</a></td>
   <td>Moderate</td>
   <td>None</td>
   <td>Aug 2016</td>
  </tr>
</table>
<h2 id="common-questions-and-answers">Common Questions and Answers</h2>
<p>
This section answers common questions that may occur after reading this
bulletin.
</p>
<p>
<strong>1. How do I determine if my device is updated to address these issues?
</strong>
</p>
<p>
Security Patch Levels of 2016-10-01 or later address all issues associated with
the 2016-10-01 security patch string level. Security Patch Levels of 2016-10-05
or later address all issues associated with the 2016-10-05 security patch string
level. Refer to the <a href="https://support.google.com/nexus/answer/4457705">help center</a> for
instructions on how to check the security patch level. Device manufacturers that
include these updates should set the patch string level to:
[ro.build.version.security_patch]:[2016-10-01] or
[ro.build.version.security_patch]:[2016-10-05].
</p>
<p>
<strong>2. Why does this bulletin have two security patch level
strings?</strong>
</p>
<p>
This bulletin has two security patch level strings so that Android partners have
the flexibility to fix a subset of vulnerabilities that are similar across all
Android devices more quickly. Android partners are encouraged to fix all issues
in this bulletin and use the latest security patch level string.
</p>
<p>
Devices that use the security patch level of October 5, 2016 or newer must
include all applicable patches in this (and previous) security bulletins.
</p>
<p>
Devices that use the October 1, 2016 security patch level must include all
issues associated with that security patch level, as well as fixes for all
issues reported in previous security bulletins.
</p>
<p>
<strong>3. How do I determine which Nexus devices are affected by each
issue?</strong>
</p>
<p>
In the <a href="#2016-10-01-security-patch-level-vulnerability-details">2016-10-01</a> and
<a href="#2016-10-05-security-patch-level-vulnerability-details">2016-10-05</a>
security vulnerability details sections, each table has an <em>Updated Nexus
devices</em> column that covers the range of affected Nexus devices updated for
each issue. This column has a few options:
</p>
<ul>
  <li><strong>All Nexus devices</strong>: If an issue affects all Nexus devices,
  the table will have “All Nexus” in the <em>Updated Nexus devices</em> column.
  “All Nexus” encapsulates the following <a
  href="https://support.google.com/nexus/answer/4457705#nexus_devices">supported
  devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9,
  Android One, Nexus Player and Pixel C.</li>
  <li><strong>Some Nexus devices</strong>: If an issue doesn’t affect all Nexus
  devices, the affected Nexus devices are listed in the <em>Updated Nexus
  devices</em> column.</li>
  <li><strong>No Nexus devices</strong>: If no Nexus devices running Android 7.0
  are affected by the issue, the table will have “None” in the <em>Updated Nexus
  devices</em> column.</li>
</ul>
<p>
<strong>4. What do the entries in the references column map to?</strong>
</p>
<p>
Entries under the <em>References</em> column of the vulnerability details table
may contain a prefix identifying the organization to which the reference value
belongs. These prefixes map as follows:
</p>
<table>
  <tr>
   <th>Prefix</th>
   <th>Reference</th>
  </tr>
  <tr>
   <td>A-</td>
   <td>Android bug ID</td>
  </tr>
  <tr>
   <td>QC-</td>
   <td>Qualcomm reference number</td>
  </tr>
  <tr>
   <td>M-</td>
   <td>MediaTek reference number</td>
  </tr>
  <tr>
   <td>N-</td>
   <td>NVIDIA reference number</td>
  </tr>
  <tr>
   <td>B-</td>
   <td>Broadcom reference number</td>
  </tr>
</table>

<h2 id="revisions">Revisions</h2>
<ul>
  <li>October 03, 2016: Bulletin published.</li>
  <li>October 04, 2016: Bulletin revised to include AOSP links and update
      attributions for CVE-2016-3920, CVE-2016-6693, CVE-2016-6694,
      CVE-2016-6695, and CVE-2016-6696.</li>
</ul>