deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-1273
Published: 2016-04-15
Description: Juniper Junos OS before 13.2X51-D40, 14.x before 14.1X53-D30, and 15.x before 15.1X53-D20 on QFX5100 and QFX10002 switches do not have sufficient entropy, which makes it easier for remote attackers to defeat cryptographic encryption and authentication protection mechanisms via unspecified vectors.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-310
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10746; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10746
CVE: CVE-2016-1274
Published: 2016-04-15
Description: Juniper Junos OS 14.1X53 before 14.1X53-D30 on QFX Series switches allows remote attackers to cause a denial of service (PFE panic) via a high rate of unspecified VXLAN packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-19
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10747; http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10747
CVE: CVE-2016-2076
Published: 2016-04-15
Description: Client Integration Plugin (CIP) in VMware vCenter Server 5.5 U3a, U3b, and U3c and 6.0 before U2; vCloud Director 5.5.5; and vRealize Automation Identity Appliance 6.2.4 before 6.2.4.1 mishandles session content, which allows remote attackers to hijack sessions via a crafted web site.
CVSS Score: 7.6 (HIGH)
CWE: CWE-287
References: http://www.securitytracker.com/id/1035570; http://www.securitytracker.com/id/1035571; http://www.securitytracker.com/id/1035572
CVE: CVE-2016-2145
Published: 2016-04-15
Description: The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html; https://github.com/UNINETT/mod_auth_mellon/pull/71; https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html
CVE: CVE-2016-2146
Published: 2016-04-15
Description: The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html; https://github.com/UNINETT/mod_auth_mellon/pull/71; https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html
CVE: CVE-2016-2212
Published: 2016-04-15
Description: The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: http://karmainsecurity.com/KIS-2016-02; http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.html; http://seclists.org/fulldisclosure/2016/Feb/105
CVE: CVE-2016-3961
Published: 2016-04-15
Description: Xen and the Linux kernel through 4.5.x do not properly suppress hugetlbfs support in x86 PV guests, which allows local PV guest OS users to cause a denial of service (guest OS crash) by attempting to access a hugetlbfs mapped area.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://www.debian.org/security/2016/dsa-3607; http://www.securityfocus.com/bid/86068; http://www.securitytracker.com/id/1035569
CVE: CVE-2015-5348
Published: 2016-04-15
Description: Apache Camel 2.6.x through 2.14.x, 2.15.x before 2.15.5, and 2.16.x before 2.16.1, when using (1) camel-jetty or (2) camel-servlet as a consumer in Camel routes, allow remote attackers to execute arbitrary commands via a crafted serialized Java object in an HTTP request.
CVSS Score: 8.1 (HIGH)
CWE: CWE-19
References: http://camel.apache.org/security-advisories.data/CVE-2015-5348.txt.asc; http://packetstormsecurity.com/files/134946/Apache-Camel-Java-Object-Deserialization.html; http://rhn.redhat.com/errata/RHSA-2016-2035.html
CVE: CVE-2015-7676
Published: 2016-04-15
Description: Ipswitch MOVEit File Transfer (formerly DMZ) 8.1 and earlier, when configured to support file view on download, allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading HTML files.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/135458/Ipswitch-MOVEit-DMZ-8.1-Persistent-Cross-Site-Scripting.html; http://seclists.org/fulldisclosure/2016/Jan/95; http://www.securityfocus.com/bid/90574
CVE: CVE-2016-3144
Published: 2016-04-15
Description: Cross-site scripting (XSS) vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182535.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182886.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-April/182953.html
CVE: CVE-2015-5271
Published: 2016-04-15
Description: The TripleO Heat templates (tripleo-heat-templates) do not properly order the Identity Service (keystone) before the OpenStack Object Storage (Swift) staticweb middleware in the swiftproxy pipeline when the staticweb middleware is enabled, which might allow remote attackers to obtain sensitive information from private containers via unspecified vectors.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2015:1862; https://bugs.launchpad.net/tripleo/+bug/1494896; https://bugzilla.redhat.com/show_bug.cgi?id=1261697
CVE: CVE-2016-1339
Published: 2016-04-16
Description: Cisco Unified Computing System (UCS) Platform Emulator 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 allows local users to gain privileges via crafted arguments on a ucspe-copy command line, aka Bug ID CSCux68832.
CVSS Score: 7.8 (HIGH)
CWE: CWE-78
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160414-ucspe1; http://www.securitytracker.com/id/1035581; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160414-ucspe1
CVE: CVE-2016-1340
Published: 2016-04-16
Description: Heap-based buffer overflow in Cisco Unified Computing System (UCS) Platform Emulator 2.5(2)TS4, 3.0(2c)A, and 3.0(2c)TS9 allows local users to gain privileges via crafted libclimeta.so filename arguments, aka Bug ID CSCux68837.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160414-ucspe2; http://www.securitytracker.com/id/1035582; http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160414-ucspe2
CVE: CVE-2016-0834
Published: 2016-04-18
Description: An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26220548.
CVSS Score: 8.4 (HIGH)
CWE: CWE-20
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-04-02.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-0835
Published: 2016-04-18
Description: decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/libmpeg2/+/58a6822d7140137ce957c6d2fc20bae1374186c1; https://android.googlesource.com/platform/external/libmpeg2/+/ba604d336b40fd4bde1622f64d67135bdbd61301
CVE: CVE-2016-0836
Published: 2016-04-18
Description: Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/libmpeg2/+/8b4ed5a23175b7ffa56eea4678db7287f825e985; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0837
Published: 2016-04-18
Description: MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/7a282fb64fef25349e9d341f102d9cea3bf75baf; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0838
Published: 2016-04-18
Description: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/sonivox/+/24d7c408c52143bce7b49de82f3913fd8d1219cf; https://android.googlesource.com/platform/external/sonivox/+/3ac044334c3ff6a61cb4238ff3ddaf17c7efcf49
CVE: CVE-2016-0839
Published: 2016-04-18
Description: post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/hardware/qcom/audio/+/ebbb[PII_REDACTED]7c6c250c6cac4e326970a9e351; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0840
Published: 2016-04-18
Description: Multiple stack-based buffer underflows in decoder/ih264d_parse_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26399350.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/libavc/+/c57fc3703ae2e0d41b1f6580c50015937f2d23c1; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0841
Published: 2016-04-18
Description: media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/3097f364237fb552871f7639d37a7afa4563e252; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0842
Published: 2016-04-18
Description: The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/libavc/+/943323f1d9d3dd5c2634deb26cbe72343ca6b3db; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0843
Published: 2016-04-18
Description: The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0844
Published: 2016-04-18
Description: The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to gain privileges via a crafted application, aka internal bug 26324307.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/sepolicy/+/57531cacb40682be4b1189c721fd1e7f25bf3786; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0846
Published: 2016-04-18
Description: libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider the heap size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26877992.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/native/+/f3199c228aced7858b75a8070b8358c155ae0149; https://www.exploit-db.com/exploits/39686/
CVE: CVE-2016-0847
Published: 2016-04-18
Description: The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/services/Telecomm/+/2750faaa1ec819eed9acffea7bd3daf867fda444; https://android.googlesource.com/platform/packages/services/Telephony/+/a294ae[PII_REDACTED]a568126183efe86261668b5d
CVE: CVE-2016-0848
Published: 2016-04-18
Description: Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to bypass private-storage file-access restrictions via a crafted application that changes a symlink target, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26211054.
CVSS Score: 8.4 (HIGH)
CWE: CWE-362
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/bdc831357e7a116bc561d51bf2ddc85ff11c01a9; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0849
Published: 2016-04-18
Description: Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.
CVSS Score: 8.4 (HIGH)
CWE: CWE-189
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/bootable/recovery/+/28a566f7731b4cb76d2a9ba16d997ac5aeb07dad; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-0850
Published: 2016-04-18
Description: The PORCHE_PAIRING_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to bypass intended pairing restrictions via a crafted device, aka internal bug 26551752.
CVSS Score: 8.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/bluetooth/bluedroid/+/c677ee[PII_REDACTED]3eb0e7b59809a1a94e7a678a; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-1503
Published: 2016-04-18
Description: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://roy.marples.name/projects/dhcpcd/info/76a[PII_REDACTED]bd9def1300d7ba990679571fa30; http://source.android.com/security/bulletin/2016-04-02.html; http://www.securitytracker.com/id/1034601
CVE: CVE-2016-2409
Published: 2016-04-18
Description: A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 25981545.
CVSS Score: 8.1 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2410
Published: 2016-04-18
Description: A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677.
CVSS Score: 7.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2411
Published: 2016-04-18
Description: A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages root access, aka internal bug 26866053.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-04-02.html; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2412
Published: 2016-04-18
Description: include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, mishandles certain crashes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26593930.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/external/skia/+/b36c23b3e6b0b316075cc43e466d44c62508fcac; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2413
Published: 2016-04-18
Description: media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/25be9ac20db51044e1b09ca67906355e4f328d48; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2414
Published: 2016-04-18
Description: The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177.
CVSS Score: 6.2 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/minikin/+/ca8ac8acdad662230ae37998c6c4091bb39402b6; https://android.googlesource.com/platform/frameworks/minikin/+/f4785aa1947b8d22d5b19559ef1ca526d98e0e73
CVE: CVE-2016-2415
Published: 2016-04-18
Description: exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, aka internal bug 26488455.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/packages/apps/Exchange/+/0d1a38b1755efe7ed4e8d7302a24186616bba9b2; http://source.android.com/security/bulletin/2016-04-02.html
CVE: CVE-2016-2416
Published: 2016-04-18
Description: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/native/+/85d253fab5e2c01bd90990667c6de25c282fc5cd; https://android.googlesource.com/platform/frameworks/native/+/a40b30f5c43726120bfe69d41ff5aeb31fe1d02a
CVE: CVE-2016-2417
Published: 2016-04-18
Description: media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/1171e7c047bf79e7c93342bb6a812c9edd86aa84; https://www.exploit-db.com/exploits/39685/
CVE: CVE-2016-2418
Published: 2016-04-18
Description: media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-04-02.html; https://android.googlesource.com/platform/frameworks/av/+/8d87321b704cb3f88e8cae668937d001fd63d5e3; http://source.android.com/security/bulletin/2016-04-02.html