deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2016-3747
Published: 2016-07-11
Description: Use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27903498.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/hardware/qcom/media/+/4ed06d14080d8667d5be14eed200e378cba78345; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3748
Published: 2016-07-11
Description: The sockets subsystem in Android 6.x before 2016-07-01 allows attackers to bypass intended system-call restrictions via a crafted application that makes an ioctl call, aka internal bug 28171804.
CVSS Score: 8.4 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/external/sepolicy/+/556bb0f55324e8839d7b735a0de9bc31028e839e; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3749
Published: 2016-07-11
Description: server/LockSettingsService.java in LockSettingsService in Android 6.x before 2016-07-01 allows attackers to modify the screen-lock password or pattern via a crafted application, aka internal bug 28163930.
CVSS Score: 8.4 (HIGH)
CWE: CWE-255
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/base/+/e83f0f6a5a6f35323f5367f99c8e287c440f33f5; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3750
Published: 2016-07-11
Description: libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a crafted application, aka internal bug 28395952.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/native/+/54cb02ad733fb71b1bdf[PII_REDACTED]7fb780aff8; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3751
Published: 2016-07-11
Description: Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-07-01.html; http://www.openwall.com/lists/oss-security/2016/07/09/4; https://android.googlesource.com/platform/external/libpng/+/9d4853418ab2f754c2b63e091c29c5529b8b86ca
CVE: CVE-2016-3752
Published: 2016-07-11
Description: internal/app/ChooserActivity.java in the ChooserTarget service in Android 6.x before 2016-07-01 mishandles target security checks, which allows attackers to gain privileges via a crafted application, aka internal bug 28384423.
CVSS Score: 7.8 (HIGH)
CWE: CWE-19, CWE-254
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/base/+/ddbf2db5b946be8fdc45c7b0327bf560b2a06988; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3753
Published: 2016-07-11
Description: mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors, aka internal bug 27210135.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3754
Published: 2016-07-11
Description: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not limit process-memory usage, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28615448.
CVSS Score: 7.5 (HIGH)
CWE: CWE-399
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/av/+/6fdee2a83432b3b150d6a34f231c4e2f7353c01e; https://android.googlesource.com/platform/frameworks/av/+/e7142a0703bc93f75e213e96ebc19000022afed9
CVE: CVE-2016-3755
Published: 2016-07-11
Description: decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28470138.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/external/libavc/+/d4841f1161bdb5e13cb19e81af42437a634dd6ef; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3756
Published: 2016-07-11
Description: Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28556125.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/external/tremolo/+/659030a2e80c38fb8da0a4eb68695349eec6778b; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3757
Published: 2016-07-11
Description: The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237.  NOTE: print_maps is not related to the Vic Abell lsof product.
CVSS Score: 7.0 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/system/core/+/ae18eb014609948a40e22192b87b10efc680daa7; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3758
Published: 2016-07-11
Description: Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/dalvik/+/338aeaf28e9981c15d0673b18487dba61eb5447c; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3759
Published: 2016-07-11
Description: The Framework APIs in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to read backup data via a crafted application that leverages priv-app access to insert a backup transport, aka internal bug 28406080.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/base/+/9b8c6d2df35455ce9e67907edded1e4a2ecb9e28; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3760
Published: 2016-07-11
Description: Bluetooth in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows local users to gain privileges by establishing a pairing that remains present during a session of the primary user, aka internal bug 27410683.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-362
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/hardware/libhardware/+/8b3d5a64c3c8d010ad4517f652731f09107ae9c5; https://android.googlesource.com/platform/packages/apps/Bluetooth/+/122feb9a0b04290f55183ff2f0384c6c53756bd8
CVE: CVE-2016-3761
Published: 2016-07-11
Description: NfcService.java in NFC in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive foreground-application information via a crafted background application, aka internal bug 28300969.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/packages/apps/Nfc/+/9ea802b5456a36f1115549b645b65c791eff3c2c; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3762
Published: 2016-07-11
Description: The sockets subsystem in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application that uses (1) the AF_MSM_IPC socket class or (2) another socket class that is unrecognized by SELinux, aka internal bug 28612709.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/external/sepolicy/+/abf0663ed884af7bc880a05e9529e6671eb58f39; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3763
Published: 2016-07-11
Description: net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 27593919.
CVSS Score: 3.3 (LOW)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/base/+/ec2fc50d202d[PII_REDACTED]12997fe425496c849c; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3764
Published: 2016-07-11
Description: media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.
CVSS Score: 4.0 (MEDIUM)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/av/+/daef4327fe0c75b0a90bb8627458feec7a301e1f; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3765
Published: 2016-07-11
Description: decoder/impeg2d_bitstream.c in mediaserver in Android 6.x before 2016-07-01 allows attackers to obtain sensitive information from process memory or cause a denial of service (out-of-bounds read) via a crafted application, aka internal bug 28168413.
CVSS Score: 7.7 (HIGH)
CWE: CWE-200, CWE-399
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/external/libmpeg2/+/d1c775d1d8d2ed117d1e026719b7f9f089716597; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3766
Published: 2016-07-11
Description: MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not check whether memory allocation succeeds, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28471206.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20
References: http://source.android.com/security/bulletin/2016-07-01.html; https://android.googlesource.com/platform/frameworks/av/+/6fdee2a83432b3b150d6a34f231c4e2f7353c01e; https://android.googlesource.com/platform/frameworks/av/+/e7142a0703bc93f75e213e96ebc19000022afed9
CVE: CVE-2016-3767
Published: 2016-07-11
Description: The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28169363 and MediaTek internal bug ALPS02689526.
CVSS Score: 7.8 (HIGH)
CWE: CWE-399
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3768
Published: 2016-07-11
Description: The Qualcomm performance component in Android before 2016-07-05 on Nexus 5, 6, 5X, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28172137 and Qualcomm internal bug CR1010644.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3769
Published: 2016-07-11
Description: The NVIDIA video driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28376656.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3770
Published: 2016-07-11
Description: The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 28346752 and MediaTek internal bug ALPS02703102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3771
Published: 2016-07-11
Description: The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29007611 and MediaTek internal bug ALPS02703102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3772
Published: 2016-07-11
Description: The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008188 and MediaTek internal bug ALPS02703102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3773
Published: 2016-07-11
Description: The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008363 and MediaTek internal bug ALPS02703102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3774
Published: 2016-07-11
Description: The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008609 and MediaTek internal bug ALPS02703102.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3775
Published: 2016-07-11
Description: The kernel filesystem implementation in Android before 2016-07-05 on Nexus 5X, Nexus 6, Nexus 6P, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 28588279.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3792
Published: 2016-07-11
Description: CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 7 (2013) devices mishandles userspace data copying, which allows attackers to gain privileges via a crafted application, aka Android internal bug 27725204 and Qualcomm internal bug CR561022.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=28d4f0c1f712bffb4aa5b47f06e97d5a9fa06d29; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3793
Published: 2016-07-11
Description: The NVIDIA camera driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026625.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://nvidia.custhelp.com/app/answers/detail/a_id/4561; http://source.android.com/security/bulletin/2016-07-01.html; http://nvidia.custhelp.com/app/answers/detail/a_id/4561
CVE: CVE-2016-3795
Published: 2016-07-11
Description: The MediaTek power driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28085222 and MediaTek internal bug ALPS02677244.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3796
Published: 2016-07-11
Description: The MediaTek power driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 29008443 and MediaTek internal bug ALPS02677244.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3797
Published: 2016-07-11
Description: The Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28085680 and Qualcomm internal bug CR1001450.
CVSS Score: 7.8 (HIGH)
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3798
Published: 2016-07-11
Description: The MediaTek hardware sensor driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28174490 and MediaTek internal bug ALPS02703105.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3799
Published: 2016-07-11
Description: The MediaTek video driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28175025 and MediaTek internal bug ALPS02693738.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3800
Published: 2016-07-11
Description: The MediaTek video driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28175027 and MediaTek internal bug ALPS02693739.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3801
Published: 2016-07-11
Description: The MediaTek GPS driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28174914 and MediaTek internal bug ALPS02688853.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3802
Published: 2016-07-11
Description: The kernel filesystem implementation in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28271368.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3803
Published: 2016-07-11
Description: The kernel filesystem implementation in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 28588434.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3804
Published: 2016-07-11
Description: The MediaTek power management driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28332766 and MediaTek internal bug ALPS02694410.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3805
Published: 2016-07-11
Description: The MediaTek power management driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28333002 and MediaTek internal bug ALPS02694412.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3806
Published: 2016-07-11
Description: The MediaTek display driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28402341 and MediaTek internal bug ALPS02715341.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3807
Published: 2016-07-11
Description: The serial peripheral interface driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 28402196.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3808
Published: 2016-07-11
Description: The serial peripheral interface driver in Android before 2016-07-05 on Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 28430009.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3809
Published: 2016-07-11
Description: The networking component in Android before 2016-07-05 on Android One, Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C devices allows attackers to obtain sensitive information via a crafted application, aka internal bug 27532522.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3810
Published: 2016-07-11
Description: The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28175522 and MediaTek internal bug ALPS02694389.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-200
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html
CVE: CVE-2016-3811
Published: 2016-07-11
Description: The kernel video driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 28447556.
CVSS Score: 7.8 (HIGH)
CWE: CWE-264
References: http://source.android.com/security/bulletin/2016-07-01.html; http://source.android.com/security/bulletin/2016-07-01.html