deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-4494
Published: 2016-06-10
Description: Cross-site request forgery (CSRF) vulnerability on KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allows remote attackers to hijack the authentication of unspecified victims for requests that disclose the contents of a configuration file.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-126-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-126-01
CVE: CVE-2016-4495
Published: 2016-06-10
Description: KMC Controls BAC-5051E devices with firmware before E0.2.0.2 allow remote attackers to bypass intended access restrictions and read a configuration file via unspecified vectors.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-284, CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-126-01; https://ics-cert.us-cert.gov/advisories/ICSA-16-126-01
CVE: CVE-2016-4511
Published: 2016-06-10
Description: ABB PCM600 before 2.7 uses an improper hash algorithm for the main application password, which makes it easier for local users to obtain sensitive cleartext information by leveraging read access to the ACTConfig configuration file.
CVSS Score: 2.8 (LOW)
CWE: CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02
CVE: CVE-2016-4516
Published: 2016-06-10
Description: ABB PCM600 before 2.7 improperly stores the main application password after a password change, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02
CVE: CVE-2016-4524
Published: 2016-06-10
Description: ABB PCM600 before 2.7 improperly stores OPC Server IEC61850 passwords in unspecified temporary circumstances, which allows local users to obtain sensitive information via unknown vectors.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-284, CWE-310
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02
CVE: CVE-2016-4527
Published: 2016-06-10
Description: ABB PCM600 before 2.7 improperly stores PCM600 authentication credentials, which allows local users to obtain sensitive information via unspecified vectors.
CVSS Score: 3.3 (LOW)
CWE: CWE-255
References: https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02; https://ics-cert.us-cert.gov/advisories/ICSA-16-152-02
CVE: CVE-2016-2785
Published: 2016-06-10
Description: Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: https://github.com/puppetlabs/puppet/pull/4921/commits/8d2ce797db265720f0a20d1d46ee2757b4e4f6b2; https://puppet.com/security/cve/cve-2016-2785; https://security.gentoo.org/glsa/201606-02
CVE: CVE-2016-2786
Published: 2016-06-10
Description: The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://puppet.com/security/cve/CVE-2016-2786; https://security.gentoo.org/glsa/201606-02; https://puppet.com/security/cve/CVE-2016-2786
CVE: CVE-2016-3085
Published: 2016-06-10
Description: Apache CloudStack 4.5.x before 4.5.2.1, 4.6.x before 4.6.2.1, 4.7.x before 4.7.1.1, and 4.8.x before 4.8.0.1, when SAML-based authentication is enabled and used, allow remote attackers to bypass authentication and access the user interface via vectors related to the SAML plugin.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-254, CWE-287
References: http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html; http://www.securityfocus.com/archive/1/538636/100/0/threaded; http://packetstormsecurity.com/files/137390/Apache-CloudStack-4.5.0-Authentication-Bypass.html
CVE: CVE-2016-3706
Published: 2016-06-10
Description: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html; http://www-01.ibm.com/support/docview.wss?uid=swg21995039
CVE: CVE-2016-3720
Published: 2016-06-10
Description: XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.
CVSS Score: 9.8 (CRITICAL)
References: http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184561.html; http://lists.fedoraproject.org/pipermail/package-announce/2016-May/184561.html
CVE: CVE-2016-4429
Published: 2016-06-10
Description: Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-updates/2016-06/msg00030.html; http://lists.opensuse.org/opensuse-updates/2016-07/msg00039.html; http://www-01.ibm.com/support/docview.wss?uid=swg21995039
CVE: CVE-2016-5118
Published: 2016-06-10
Description: The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at the start of a filename.
CVSS Score: 9.8 (CRITICAL)
References: http://git.imagemagick.org/repos/ImageMagick/commit/40639d173aa8c76b850d625c630b711fee4dcfb8; http://hg.code.sf.net/p/graphicsmagick/code/file/41876934e762/ChangeLog; http://hg.code.sf.net/p/graphicsmagick/code/rev/ae3928faa858
CVE: CVE-2016-5233
Published: 2016-06-10
Description: Huawei Mate 8 smartphones with software NXT-AL10 before NXT-AL10C00B182, NXT-CL00 before NXT-CL00C92B182, NXT-DL00 before NXT-DL00C17B182, and NXT-TL00 before NXT-TL00C01B182 allow remote base stations to obtain sensitive subscriber signal strength information via vectors involving improper security status verification, aka HWPSIRT-2015-12007.
CVSS Score: 3.7 (LOW)
CWE: CWE-200
References: http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-03-smartphone-en; http://www.securityfocus.com/bid/90792; http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20160520-03-smartphone-en
CVE: CVE-2016-2061
Published: 2016-06-13
Description: Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://source.android.com/security/bulletin/2016-06-01.html; https://us.codeaurora.org/cgit/quic/la//kernel/msm-3.18/commit/id=79db14ca9f791a14be9376a0340ad3b9b9a4d603; https://www.codeaurora.org/array-overflow-msm-v4l2-video-driver-allows-kernel-memory-corruption-cve-2016-2061
CVE: CVE-2016-2066
Published: 2016-06-13
Description: Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call.
CVSS Score: 7.8 (HIGH)
CWE: CWE-269
References: http://source.android.com/security/bulletin/2016-06-01.html; http://www.securityfocus.com/bid/91046; https://us.codeaurora.org/cgit/quic/la/kernel/msm-3.18/commit/?id=775fca8289eff931f91ff6e8c36cf2034ba59e88
CVE: CVE-2016-2463
Published: 2016-06-13
Description: Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419.
CVSS Score: 8.4 (HIGH)
CWE: CWE-119, CWE-189
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/2b6f22dc64d456471a1dc6df09d515771d1427c8; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2464
Published: 2016-06-13
Description: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/external/libvpx/+/65c49d5b382de4085ee5668732bcb0f6ecaf7148; https://android.googlesource.com/platform/external/libvpx/+/cc274e2abe8b2a6698a5c47d8aa4bb45f1f9538d
CVE: CVE-2016-2465
Published: 2016-06-13
Description: The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27407865.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2466
Published: 2016-06-13
Description: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka internal bug 27947307.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2467
Published: 2016-06-13
Description: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5 devices allows attackers to gain privileges via a crafted application, aka internal bug 28029010.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2468
Published: 2016-06-13
Description: The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted application, aka internal bug 27475454.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2469
Published: 2016-06-13
Description: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27531992.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://www.securityfocus.com/bid/91046; http://www.securitytracker.com/id/1036763
CVE: CVE-2016-2470
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27662174.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2471
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27773913.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2472
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27776888.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2473
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27777501.
CVSS Score: 9.8 (CRITICAL)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2474
Published: 2016-06-13
Description: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 27424603.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2475
Published: 2016-06-13
Description: The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges for certain system calls via a crafted application, aka internal bug 26425765.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2476
Published: 2016-06-13
Description: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27207275.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/0bb5ced60304da7f61478ffd359e7ba65d72f181; https://android.googlesource.com/platform/frameworks/av/+/295c883fe3105b19bcd0f9e07d54c6b589fc5bff
CVE: CVE-2016-2477
Published: 2016-06-13
Description: mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27251096.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/f22c2a0f0f9e030c240468d9d18b9297f001bcf0; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2478
Published: 2016-06-13
Description: mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27475409.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/f22c2a0f0f9e030c240468d9d18b9297f001bcf0; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2479
Published: 2016-06-13
Description: The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532282.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/46e305be6e670a5a0041b0b4861122a0f1aabefa; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2480
Published: 2016-06-13
Description: The mm-video-v4l2 vidc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate certain OMX parameter data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532721.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/560ccdb509a7b86186fac0fce1b25bd9a3e6a6e8; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2481
Published: 2016-06-13
Description: The mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532497.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/89913d7df36dbeb458ce165856bd6505a2ec647d; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2482
Published: 2016-06-13
Description: The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27661749.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/46e305be6e670a5a0041b0b4861122a0f1aabefa; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2483
Published: 2016-06-13
Description: The mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27662502.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/89913d7df36dbeb458ce165856bd6505a2ec647d; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2484
Published: 2016-06-13
Description: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes for the GSM and G711 codecs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793163.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2485
Published: 2016-06-13
Description: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes for the GSM and G711 codecs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793367.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/7cea5cb64b83d690fe02bc210bbdf08f5a87636f; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2486
Published: 2016-06-13
Description: mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate the relationship between allocated memory and the frame size, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27793371.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/ad40e57890f81a3cf436c5f06da66396010bd9e5; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2487
Published: 2016-06-13
Description: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27833616.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-06-01.html; https://android.googlesource.com/platform/frameworks/av/+/4e32001e4196f39ddd0b86686ae0231c8f5ed944; https://android.googlesource.com/platform/frameworks/av/+/918eeaa29d99d257282fafec931b4bda0e3bae12
CVE: CVE-2016-2488
Published: 2016-06-13
Description: The Qualcomm camera driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27600832.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2489
Published: 2016-06-13
Description: The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27407629.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2490
Published: 2016-06-13
Description: The NVIDIA camera driver in Android before 2016-06-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27533373.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html
CVE: CVE-2016-2491
Published: 2016-06-13
Description: The NVIDIA camera driver in Android before 2016-06-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27556408.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-06-01.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-2492
Published: 2016-06-13
Description: The MediaTek power-management driver in Android before 2016-06-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 28085410.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-06-01.html; http://source.android.com/security/bulletin/2016-06-01.html