deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-6149
Published: 2016-08-05
Description: SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files, aka SAP Security Note 2252941.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://packetstormsecurity.com/files/138456/SAP-HANA-SPS09-1.00.091.00[PII_REDACTED]-EXPORT-Information-Disclosure.html; http://seclists.org/fulldisclosure/2016/Aug/108; http://seclists.org/fulldisclosure/2016/Aug/97
CVE: CVE-2016-6150
Published: 2016-08-05
Description: The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended access restrictions and possibly have unspecified other impact via unknown vectors, aka SAP Security Note 2233550.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://packetstormsecurity.com/files/138453/SAP-HANA-DB-Encryption-Issue.html; http://seclists.org/fulldisclosure/2016/Aug/96; http://www.securityfocus.com/bid/92064
CVE: CVE-2015-8945
Published: 2016-08-05
Description: openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.
CVSS Score: 5.1 (MEDIUM)
CWE: CWE-255
References: http://www.openwall.com/lists/oss-security/2016/07/13/10; http://www.openwall.com/lists/oss-security/2016/07/13/9; http://www.securityfocus.com/bid/91776
CVE: CVE-2016-0782
Published: 2016-08-05
Description: The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authenticated users to conduct cross-site scripting (XSS) attacks and consequently obtain sensitive information from a Java memory dump via vectors related to creating a queue.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://activemq.apache.org/security-advisories.data/CVE-2016-0782-announcement.txt; http://packetstormsecurity.com/files/136215/Apache-ActiveMQ-5.13.0-Cross-Site-Scripting.html; http://www.securityfocus.com/archive/1/537760/100/0/threaded
CVE: CVE-2016-1276
Published: 2016-08-05
Description: Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D23, 12.3X48 before 12.3X48-D25, and 15.1X49 before 15.1X49-D40 on a High-End SRX-Series chassis system with one or more Application Layer Gateways (ALGs) enabled allow remote attackers to cause a denial of service (CPU consumption, fab link failure, or flip-flop failovers) via vectors related to in-transit traffic matching ALG rules.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-399
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10751; http://www.securityfocus.com/bid/91764; http://www.securitytracker.com/id/1036305
CVE: CVE-2016-1278
Published: 2016-08-05
Description: Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a password after a failed upgrade to 12.1X46, which might allow local users to gain privileges by leveraging use of the "request system software" command with the "partition" option.
CVSS Score: 7.8 (HIGH)
CWE: CWE-287
References: http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10753; http://www.securityfocus.com/bid/91757; http://www.securitytracker.com/id/1036307
CVE: CVE-2016-4999
Published: 2016-08-05
Description: SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in Dashbuilder before 0.6.0.Beta1 allows remote attackers to execute arbitrary SQL commands via a data set lookup filter in the (1) Data Set Authoring or (2) Displayer editor UI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: http://www.securityfocus.com/bid/91795; https://access.redhat.com/errata/RHSA-2016:1428; https://access.redhat.com/errata/RHSA-2016:1429
CVE: CVE-2016-5392
Published: 2016-08-05
Description: The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users with knowledge of other project names to obtain sensitive project and user information via vectors related to the watch-cache list.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200
References: http://www.securityfocus.com/bid/91793; https://access.redhat.com/errata/RHSA-2016:1427; https://bugzilla.redhat.com/show_bug.cgi?id=1356195
CVE: CVE-2016-6186
Published: 2016-08-05
Description: Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: http://packetstormsecurity.com/files/137965/Django-3.3.0-Script-Insertion.html; http://rhn.redhat.com/errata/RHSA-2016-1594.html; http://rhn.redhat.com/errata/RHSA-2016-1595.html
CVE: CVE-2014-9901
Published: 2016-08-05
Description: The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attackers to cause a denial of service (device hang or reboot) via crafted frames, aka Android internal bug 28670333 and Qualcomm internal bug CR548711.
CVSS Score: 7.5 (HIGH)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92247; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=637f0f7931dd7265ac1c250dc2884d6389c66bde
CVE: CVE-2014-9902
Published: 2016-08-05
Description: Buffer overflow in CORE/SYS/legacy/src/utils/src/dot11f.c in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices allows remote attackers to execute arbitrary code via a crafted Information Element (IE) in an 802.11 management frame, aka Android internal bug 28668638 and Qualcomm internal bugs CR553937 and CR553941.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92223; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=3b1c44a3a7129dc25abe2c23543f6f66c59e8f50
CVE: CVE-2016-2497
Published: 2016-08-05
Description: services/core/java/com/android/server/pm/PackageManagerService.java in the framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to increase intent-filter priority via a crafted application, aka internal bug 27450489.
CVSS Score: 7.3 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92249; https://android.googlesource.com/platform/frameworks/base/+/a75537b496e9df71c74c1d045ba5569631a16298
CVE: CVE-2016-2504
Published: 2016-08-05
Description: The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026365 and Qualcomm internal bug CR1002974.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92220; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3819
Published: 2016-08-05
Description: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92228; https://android.googlesource.com/platform/frameworks/av/+/590d1729883f700ab905cdc9ad850f3ddd7e1f56
CVE: CVE-2016-3820
Published: 2016-08-05
Description: The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28673410.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92228; https://android.googlesource.com/platform/external/libavc/+/a78887bcffbc2995cf9ed72e0697acf560875e9e
CVE: CVE-2016-3821
Published: 2016-08-05
Description: libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file, aka internal bug 28166152.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92228; https://android.googlesource.com/platform/frameworks/av/+/42a25c46b844518ff0d0b920c20c519e1417be69
CVE: CVE-2016-3822
Published: 2016-08-05
Description: exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01, allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds access) via crafted EXIF data, aka internal bug 28868315.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.debian.org/security/2017/dsa-3825; http://www.securityfocus.com/bid/92226
CVE: CVE-2016-3823
Published: 2016-08-05
Description: The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 mishandles heap pointers, which allows attackers to gain privileges via a crafted application, aka internal bug 28815329.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92218; https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95
CVE: CVE-2016-3824
Published: 2016-08-05
Description: omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the buffer port, which allows attackers to gain privileges via a crafted application, aka internal bug 28816827.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92218; https://android.googlesource.com/platform/frameworks/av/+/b351eabb428c7ca85a34513c64601f437923d576
CVE: CVE-2016-3825
Published: 2016-08-05
Description: mm-video-v4l2/vidc/venc/src/omx_video_base.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allocates an incorrect amount of memory, which allows attackers to gain privileges via a crafted application, aka internal bug 28816964.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92218; https://android.googlesource.com/platform/hardware/qcom/media/+/d575ecf607056d8e3328ef2eb56c52e98f81e87d
CVE: CVE-2016-3826
Published: 2016-08-05
Description: services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not validate the reply size for an AudioFlinger effect command, which allows attackers to gain privileges via a crafted application, aka internal bug 29251553.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92218; https://android.googlesource.com/platform/frameworks/av/+/9cd8c3289c91254b3955bd7347cf605d6fa032c6
CVE: CVE-2016-3827
Published: 2016-08-05
Description: codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28816956.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-172
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92221; https://android.googlesource.com/platform/frameworks/av/+/a4567c66f4764442c6cb7b5c[PII_REDACTED]80fb5
CVE: CVE-2016-3828
Published: 2016-08-05
Description: decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28835995.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-172
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92221; https://android.googlesource.com/platform/external/libavc/+/[PII_REDACTED]019e439433c515eeb44e701fb3bfb2
CVE: CVE-2016-3829
Published: 2016-08-05
Description: The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 29023649.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-172
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92221; https://android.googlesource.com/platform/external/libavc/+/326fe991a4b7971e8aeaf4ac775491dd8abd85bb
CVE: CVE-2016-3830
Published: 2016-08-05
Description: codecs/aacdec/SoftAAC2.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to cause a denial of service (device hang or reboot) via crafted ADTS data, aka internal bug 29153599.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92221; https://android.googlesource.com/platform/frameworks/av/+/8e438e153f661e9df8db0ac41d587e940352df06
CVE: CVE-2016-3831
Published: 2016-08-05
Description: The telephony component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to cause a denial of service (device crash) via a NITZ time value of 2038-01-19 or later that is mishandled by the system clock, aka internal bug 29083635, related to a "Year 2038 problem."
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92230; https://android.googlesource.com/platform/frameworks/opt/telephony/+/f47bc301ccbc5e6d8110afab5a1e9bac1d4ef058
CVE: CVE-2016-3832
Published: 2016-08-05
Description: The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, which allows attackers to bypass an unspecified protection mechanism via a crafted application, aka internal bug 28795098.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92232; https://android.googlesource.com/platform/frameworks/base/+/e7cf91a198de995c7440b3b64352effd2e309906
CVE: CVE-2016-3833
Published: 2016-08-05
Description: The Shell component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not properly manage the MANAGE_USERS and CREATE_USERS permissions, which allows attackers to bypass intended access restrictions via a crafted application, aka internal bug 29189712.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92225; https://android.googlesource.com/platform/frameworks/base/+/01875b0274e74f97edf6b0d5c92de822e0555d03
CVE: CVE-2016-3834
Published: 2016-08-05
Description: The camera APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allow attackers to bypass intended access restrictions and obtain sensitive information about ANW buffer addresses via a crafted application, aka internal bug 28466701.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92238; https://android.googlesource.com/platform/frameworks/av/+/1f24c730ab6ca5aff1e3137b340b8aeaeda4bdbc
CVE: CVE-2016-3835
Published: 2016-08-05
Description: The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 mishandles heap pointers, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 28920116.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92233; https://android.googlesource.com/platform/hardware/qcom/media/+/7558d03e6498e970b761aa44fff6b2c659202d95
CVE: CVE-2016-3836
Published: 2016-08-05
Description: The SurfaceFlinger service in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a crafted application, related to lack of a default constructor in include/ui/FrameStats.h, aka internal bug 28592402.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92224; https://android.googlesource.com/platform/frameworks/native/+/3bcf0caa8cca[PII_REDACTED]b36676b3bae33a4368
CVE: CVE-2016-3837
Published: 2016-08-05
Description: service/jni/com_android_server_wifi_WifiNative.cpp in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive information via a crafted application that provides a MAC address with too few characters, aka internal bug 28164077.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92235; https://android.googlesource.com/platform/frameworks/opt/net/wifi/+/a209ff12ba9617c10550678ff93d01fb72a33399
CVE: CVE-2016-3838
Published: 2016-08-05
Description: Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted application that uses the app-pinning feature, aka internal bug 28761672.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92244; https://android.googlesource.com/platform/frameworks/base/+/468651c86a8adb7aa56c708d2348e99022088af3
CVE: CVE-2016-3839
Published: 2016-08-05
Description: Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of Bluetooth 911 functionality) via a crafted application that sends a signal to a Bluetooth process, aka internal bug 28885210.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-284
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92242; https://android.googlesource.com/platform/system/bt/+/472271b153c5dc53c28beac55480a8d8434b2d5c
CVE: CVE-2016-3840
Published: 2016-08-05
Description: Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92229; https://android.googlesource.com/platform/external/conscrypt/+/5af5e93463f4333187e7e35f3bd2b846654aa214
CVE: CVE-2016-3842
Published: 2016-08-05
Description: The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28377352 and Qualcomm internal bug CR1002974.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92220; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3843
Published: 2016-08-05
Description: Android before 2016-08-05 does not properly restrict code execution in a kernel context, which allows attackers to gain privileges via a crafted application, as demonstrated by the kernel performance subsystem and the Qualcomm performance component, aka Android internal bugs 28086229 and 29119870 and Qualcomm internal bug CR1011071.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92237; http://www.securityfocus.com/bid/92250
CVE: CVE-2016-3844
Published: 2016-08-05
Description: mediaserver in Android before 2016-08-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 28299517.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92241; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3845
Published: 2016-08-05
Description: The video driver in the kernel in Android before 2016-08-05 on Nexus 5 devices allows attackers to gain privileges via a crafted application, aka internal bug 28399876.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92246; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3846
Published: 2016-08-05
Description: The Serial Peripheral Interface driver in Android before 2016-08-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 28817378.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92240; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3847
Published: 2016-08-05
Description: The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28871433.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92231
CVE: CVE-2016-3848
Published: 2016-08-05
Description: The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28919417.
CVSS Score: 7.0 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92231; http://source.android.com/security/bulletin/2016-08-01.html
CVE: CVE-2016-3849
Published: 2016-08-05
Description: The ION driver in Android before 2016-08-05 on Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 28939740.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-08-01.html; http://www.securityfocus.com/bid/92243; http://source.android.com/security/bulletin/2016-08-01.html