deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3917
Published: 2016-10-10
Description: The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka internal bug 30744668.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93298; https://android.googlesource.com/platform/frameworks/base/+/f[PII_REDACTED]afa835dd3f08601fb3bced7b781cd
CVE: CVE-2016-3918
Published: 2016-10-10
Description: email/provider/AttachmentProvider.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not ensure that certain values are integers, which allows attackers to read arbitrary attachments via a crafted application that provides a pathname value, aka internal bug 30745403.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93299; https://android.googlesource.com/platform/packages/apps/Email/+/6b2b0bd7c771c698f11d7be89c2c57c8722c7454
CVE: CVE-2016-3920
Published: 2016-10-10
Description: id3/ID3.cpp in libstagefright in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 30744884.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93292; https://android.googlesource.com/platform/frameworks/av/+/6d0249be2275fd4086783f259f4e2c54722a7c55
CVE: CVE-2016-3921
Published: 2016-10-10
Description: libsysutils/src/FrameworkListener.cpp in Framework Listener in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows attackers to gain privileges via a crafted application, aka internal bug 29831647.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93307; https://android.googlesource.com/platform/system/core/+/771ab014c24a682b32990da08e87e2f0ab765bd2
CVE: CVE-2016-3922
Published: 2016-10-10
Description: libril/RilSapSocket.cpp in Telephony in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka internal bug 30202619.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93315; https://android.googlesource.com/platform/hardware/ril/+/[PII_REDACTED]8f6f11fe7d23aca1380e6c0fac2af0
CVE: CVE-2016-3923
Published: 2016-10-10
Description: The Accessibility services in Android 7.0 before 2016-10-01 mishandle motion events, which allows attackers to conduct touchjacking attacks and consequently gain privileges via a crafted application, aka internal bug 30647115.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93310; https://android.googlesource.com/platform/frameworks/base/+/5f256310187b4ff2f13a7abb9afed9126facd7bc
CVE: CVE-2016-3924
Published: 2016-10-10
Description: services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 does not validate EFFECT_CMD_SET_PARAM and EFFECT_CMD_SET_PARAM_DEFERRED commands, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 30204301.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93297; https://android.googlesource.com/platform/frameworks/av/+/c894aa36be535886a8e5ff02cdbcd07dd24618f6
CVE: CVE-2016-3925
Published: 2016-10-10
Description: server/wifi/anqp/ANQPFactory.java in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows attackers to cause a denial of service (blocked Wi-Fi usage) via a crafted application, aka internal bug 30230534.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93289; https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/c2905409c20c8692d4396b8531b09e7ec81fa3fb
CVE: CVE-2016-3926
Published: 2016-10-10
Description: Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5, 5X, 6, and 6P devices has unknown impact and attack vectors, aka internal bug 28823953.
CVSS Score: 9.8 (CRITICAL)
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93333; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3927
Published: 2016-10-10
Description: Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices has unknown impact and attack vectors, aka internal bug 28823244.
CVSS Score: 9.8 (CRITICAL)
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93333; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3928
Published: 2016-10-10
Description: The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019362 and MediaTek internal bug ALPS02829384.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93308; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3929
Published: 2016-10-10
Description: Unspecified vulnerability in a Qualcomm component in Android before 2016-10-05 on Nexus 5X and 6P devices has unknown impact and attack vectors, aka internal bug 28823675.
CVSS Score: 9.8 (CRITICAL)
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93333; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3930
Published: 2016-10-10
Description: The NVIDIA MMC test driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28760138.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93306
CVE: CVE-2016-3931
Published: 2016-10-10
Description: drivers/misc/qseecom.c in the Qualcomm QSEE Communicator driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29157595 and Qualcomm internal bug CR 1036418.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93313; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e80b88323f9ff0bb0e545f209eec08ec56fca816
CVE: CVE-2016-3932
Published: 2016-10-10
Description: mediaserver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 29161895 and MediaTek internal bug ALPS02770870.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93311; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3933
Published: 2016-10-10
Description: mediaserver in Android before 2016-10-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 29421408.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93311; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3934
Published: 2016-10-10
Description: drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices relies on variable-length arrays, which allows attackers to gain privileges via a crafted application, aka Android internal bug 30102557 and Qualcomm internal bug CR 789704.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93322; https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=27fbeb6b025d5d46ccb0497cbed4c6e78ed1c5cc
CVE: CVE-2016-3935
Published: 2016-10-10
Description: Multiple integer overflows in drivers/crypto/msm/qcedev.c in the Qualcomm cryptographic engine driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29999665 and Qualcomm internal bug CR 1046507.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93327; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=5f69ccf3b011c1d14a1b1b00dbaacf74307c9132
CVE: CVE-2016-3936
Published: 2016-10-10
Description: The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30019037 and MediaTek internal bug ALPS02829568.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93334; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3937
Published: 2016-10-10
Description: The MediaTek video driver in Android before 2016-10-05 allows attackers to gain privileges via a crafted application, aka Android internal bug 30030994 and MediaTek internal bug ALPS02834874.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93334; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3938
Published: 2016-10-10
Description: drivers/video/msm/mdss/mdss_mdp_overlay.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30019716 and Qualcomm internal bug CR 1049232.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93336; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=467c81f9736b1ebc8d4ba70f9221bba02425ca10
CVE: CVE-2016-3939
Published: 2016-10-10
Description: drivers/video/msm/mdss/mdss_debug.c in the Qualcomm video driver in Android before 2016-10-05 on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 30874196 and Qualcomm internal bug CR 1001224.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93336; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-3940
Published: 2016-10-10
Description: The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 6P and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 30141991.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93338; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-5343
Published: 2016-10-10
Description: drivers/soc/qcom/qdsp6v2/voice_svc.c in the QDSP6v2 Voice Service driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a write request, as demonstrated by a voice_svc_send_req buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=6927e2e0af4dcac357be86ba563c9ae12354bb08
CVE: CVE-2016-5348
Published: 2016-10-10
Description: The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01 allows man-in-the-middle attackers to cause a denial of service (memory consumption, and device hang or reboot) via a large xtra.bin or xtra2.bin file on a spoofed Qualcomm gpsonextra.net or izatcloud.net host, aka internal bug 29555864.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93293; https://android.googlesource.com/platform/frameworks/base/+/218b813d5bc2d7d3952ea1861c38b4aa944ac59b
CVE: CVE-2016-6672
Published: 2016-10-10
Description: The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 30537088.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93338; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6673
Published: 2016-10-10
Description: The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 30204201.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93321; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6674
Published: 2016-10-10
Description: system_server in Android before 2016-10-05 on Nexus devices allows attackers to gain privileges via a crafted application, aka internal bug 30445380.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93316; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6675
Published: 2016-10-10
Description: Off-by-one error in CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a linkspeed ioctl call, aka Android internal bug 30873776 and Qualcomm internal bug CR 1000861.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93328; https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/prima/commit/?id=1353fa0bd0c78427f3ae7d9bde7daeb75bd01d09
CVE: CVE-2016-6676
Published: 2016-10-10
Description: Off-by-one error in CORE/HDD/src/wlan_hdd_cfg.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service (buffer overflow) via a crafted application that makes a GET_CFG ioctl call, aka Android internal bug 30874066 and Qualcomm internal bug CR 1000853.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93328; https://source.codeaurora.org/quic/la//platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=6ba[PII_REDACTED]442a182996427e5c88e5a7512a8
CVE: CVE-2016-6677
Published: 2016-10-10
Description: The NVIDIA GPU driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30259955.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93319; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6678
Published: 2016-10-10
Description: The Motorola USBNet driver in Android before 2016-10-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 29914434.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93305; https://securityintelligence.com/android-vulnerabilities-attacking-nexus-6-and-6p-custom-boot-modes/
CVE: CVE-2016-6679
Published: 2016-10-10
Description: CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes a setwpaie ioctl call, aka Android internal bug 29915601 and Qualcomm internal bug CR 1000913.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93309; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=d39345f0abc309959d831d09fcbf1619cc0ae0f5
CVE: CVE-2016-6680
Published: 2016-10-10
Description: CORE/HDD/src/wlan_hdd_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes an iw_set_priv ioctl call, aka Android internal bug 29982678 and Qualcomm internal bug CR 1048052.
CVSS Score: 7.8 (HIGH)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93309; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=2f2fa073b95d4700de88c0f7558b4a18c13ac552
CVE: CVE-2016-6681
Published: 2016-10-10
Description: drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 30152182 and Qualcomm internal bug CR 1049521.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93309; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395
CVE: CVE-2016-6682
Published: 2016-10-10
Description: drivers/misc/qcom/qdsp6v2/audio_utils.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 on Nexus 5X, Nexus 6P, and Android One devices does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 30152501 and Qualcomm internal bug CR 1049615.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93309; https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=0950fbd39ff189497f1b6115825c210e3eeaf395
CVE: CVE-2016-6683
Published: 2016-10-10
Description: The kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30143283.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93326; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6684
Published: 2016-10-10
Description: The kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Android One devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30148243.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93326; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6685
Published: 2016-10-10
Description: The kernel in Android before 2016-10-05 on Nexus 6P devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30402628.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93326; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6686
Published: 2016-10-10
Description: The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30163101.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93324; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6687
Published: 2016-10-10
Description: The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30162222.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93324; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6688
Published: 2016-10-10
Description: The NVIDIA profiler in Android before 2016-10-05 on Nexus 9 devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30593080.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93324; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6689
Published: 2016-10-10
Description: Binder in the kernel in Android before 2016-10-05 on Nexus devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 30768347.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93323; https://www.exploit-db.com/exploits/40515/
CVE: CVE-2016-6690
Published: 2016-10-10
Description: The sound driver in the kernel in Android before 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Nexus Player devices allows attackers to cause a denial of service (reboot) via a crafted application, aka internal bug 28838221.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93301; http://source.android.com/security/bulletin/2016-10-01.html
CVE: CVE-2016-6691
Published: 2016-10-10
Description: service/jni/com_android_server_wifi_Gbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service (framework crash) or possibly have unspecified other impact via an access point that has a malformed SSID with GBK encoding, aka Qualcomm internal bug CR 978452.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-172
References: http://source.android.com/security/bulletin/2016-10-01.html; http://www.securityfocus.com/bid/93330; https://source.codeaurora.org/quic/la//platform/frameworks/opt/net/wifi/commit/?id=343f123c396b2a97fc7cce396cd5d99365cb9131