yahoo-inc/cve-impacts huggingface dataset:
CVE-2016-2339: An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize" heap buffer "arg_types" allocation is made based on args array length. Specially constructed object passed as element of args array can increase this array size after mentioned allocation and cause heap overflow.
Key phrases: heap overflow
CVE-2016-2340: The AMF framework in Granite Data Services 3.1.1-SNAPSHOT allows remote authenticated users to read arbitrary files, send TCP requests to intranet servers, or cause a denial of service via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Key phrases: read arbitrary files, denial of service, xml external entity declaration, xml external entity (xxe) issue
CVE-2016-2342: The bgp_nlri_parse_vpnv4 function in bgp_mplsvpn.c in the VPNv4 NLRI parser in bgpd in Quagga before 1.0.20160309, when a certain VPNv4 configuration is used, relies on a Labeled-VPN SAFI routes-data length field during a data copy, which allows remote attackers to execute arbitrary code or cause a denial of service (stack-based buffer overflow) via a crafted packet.
Key phrases: execute arbitrary code, denial of service (stack-based buffer overflow), execute arbitrary code or cause a denial of, stack based buffer overflow
CVE-2016-2343: Patterson Dental Eaglesoft 17 has a hardcoded password of sql for the dba account, which allows remote attackers to obtain sensitive Dental.DB patient information via SQL statements.
Key phrases: obtain sensitive Dental.DB patient information, hardcoded password
CVE-2016-2344: Stack-based buffer overflow in manager.exe in Backburner Manager in Autodesk Backburner 2016 2016.0.0.2150 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a crafted command.  NOTE: this is only a vulnerability in environments in which the administrator has not followed documentation that outlines the security risks of operating Backburner on untrusted networks.
Key phrases: execute arbitrary code, denial of service (daemon crash), execute arbitrary code or cause a denial of, stack-based buffer overflow, stack based buffer overflow
CVE-2016-2345: Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted string, stack-based buffer overflow, stack based buffer overflow
CVE-2016-2346: Allround Automations PL/SQL Developer 11 before 11.0.6 relies on unverified HTTP data for updates, which allows man-in-the-middle attackers to execute arbitrary code by modifying fields in the client-server data stream.
Key phrases: execute arbitrary code, execute arbitrary code by modifying fields in the, unverified http data, man in the middle
CVE-2016-2347: Integer underflow in the decode_level3_header function in lib/lha_file_header.c in Lhasa before 0.3.1 allows remote attackers to execute arbitrary code via a crafted archive.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted archive, integer underflow
CVE-2016-2349: Remedy AR System Server in BMC Remedy 8.1 SP 2, 9.0, 9.0 SP 1, and 9.1 allows attackers to reset arbitrary passwords via a blank previous password.
Key phrases: reset arbitrary passwords, reset arbitrary passwords via a blank previous password
CVE-2016-2350: Multiple cross-site scripting (XSS) vulnerabilities on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allow remote attackers to inject arbitrary web script or HTML via unspecified input to (1) getimageajax.php, (2) move_partition_frame.html, or (3) wmInfo.html.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via unspecified, cross-site scripting (xss)
CVE-2016-2351: SQL injection vulnerability in home/seos/courier/security_key2.api on the Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote attackers to execute arbitrary SQL commands via the client_id parameter.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the client_id parameter, sql injection
CVE-2016-2352: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows remote authenticated users to execute arbitrary commands by leveraging the YUM_CLIENT restricted-user role.
Key phrases: execute arbitrary commands, execute arbitrary commands by leveraging the YUM_CLIENT restricted
CVE-2016-2353: The Accellion File Transfer Appliance (FTA) before FTA_9_12_40 allows local users to add an SSH key to an arbitrary group, and consequently gain privileges, via unspecified vectors.
Key phrases: gain privileges, add an SSH key to an arbitrary group, unspecified vectors
CVE-2016-2354: The Bluetooth functionality in Lemur Vehicle Monitors BlueDriver before 2016-04-07 supports unrestricted pairing without a PIN, which allows remote attackers to send arbitrary CAN commands by leveraging access to a device inside or adjacent to the vehicle, as demonstrated by a CAN command to disrupt braking or steering.
Key phrases: send arbitrary CAN commands, send arbitrary CAN commands by leveraging access to, unrestricted pairing without a pin, disrupt braking or steering, arbitrary commands
CVE-2016-2355: SQL injection vulnerability in the REST API in dotCMS before 3.3.2 allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the stName parameter, sql injection, arbitrary sql commands
CVE-2016-2356: Milesight IP security cameras through 2016-11-14 have a buffer overflow in a web application via a long username or password.
Key phrases: buffer overflow
CVE-2016-2357: Milesight IP security cameras through 2016-11-14 have a hardcoded SSL private key under the /etc/config directory.
Key phrases: hardcoded ssl private key
CVE-2016-2358: Milesight IP security cameras through 2016-11-14 have a default set of 10 privileged accounts with hardcoded credentials. They are accessible if the customer has not configured 10 actual user accounts.
Key phrases: hardcoded credentials
CVE-2016-2359: Milesight IP security cameras through 2016-11-14 allow remote attackers to bypass authentication and access a protected resource by simultaneously making a request for the unprotected vb.htm resource.
Key phrases: bypass authentication, bypass authentication and access a protected resource by, unprotected vb.htm resource
CVE-2016-2360: Milesight IP security cameras through 2016-11-14 have a default root password in /etc/shadow that is the same across different customers' installations.
Key phrases: default root password
CVE-2016-2362: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 has a hardcoded password for the FTP account, which allows remote attackers to obtain access via a (1) FTP or (2) SSH connection.
Key phrases: obtain access, obtain access via a (1) FTP, hardcoded password
CVE-2016-2363: Fonality (previously trixbox Pro) 12.6 through 14.1i before 2016-06-01 uses weak permissions for the /var/www/rpc/surun script, which allows local users to obtain root access for unspecified command execution by leveraging access to the nobody account.
Key phrases: obtain root access, obtain root access for unspecified command execution by, weak permissions
CVE-2016-2364: The Chrome HUDweb plugin before 2016-05-05 for Fonality (previously trixbox Pro) 12.6 through 14.1i uses the same hardcoded private key across different customers' installations, which allows remote attackers to defeat cryptographic protection mechanisms by leveraging knowledge of this key from another installation.
Key phrases: defeat cryptographic protection mechanisms by leveraging knowledge of, hardcoded private key
CVE-2016-2365: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a null pointer dereference. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
Key phrases: denial of service, crash, null pointer, null pointer dereference
CVE-2016-2366: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or an attacker who intercepts the network traffic can send invalid data to trigger this vulnerability and cause a crash.
Key phrases: denial of service, out-of-bounds read, crash, out of bounds read
CVE-2016-2367: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle can send an invalid size for an avatar which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the avatar is sent to another user.
Key phrases: information leak, out-of-bounds read, denial of service, out of bounds read, man in the middle
CVE-2016-2368: Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result in multiple buffer overflows, potentially resulting in code execution or memory disclosure.
Key phrases: memory corruption, buffer overflows, code execution, memory disclosure
CVE-2016-2369: A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in a denial of service vulnerability. A malicious server can send a packet starting with a NULL byte triggering the vulnerability.
Key phrases: null pointer dereference, denial of service
CVE-2016-2370: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an out-of-bounds read. A malicious server or man-in-the-middle attacker can send invalid data to trigger this vulnerability.
Key phrases: denial of service, out-of-bounds read, out of bounds read, man in the middle
CVE-2016-2371: An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory corruption resulting in code execution.
Key phrases: out-of-bounds write, memory corruption, code execution, out of bounds write
CVE-2016-2372: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious user, server, or man-in-the-middle attacker can send an invalid size for a file transfer which will trigger an out-of-bounds read vulnerability. This could result in a denial of service or copy data from memory to the file, resulting in an information leak if the file is sent to another user.
Key phrases: information leak, out-of-bounds read, denial of service, out of bounds read, man in the middle
CVE-2016-2373: A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-of-bounds read. A malicious server or user can send an invalid mood to trigger this vulnerability.
Key phrases: denial of service, out-of-bounds read, out of bounds read
CVE-2016-2374: An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the server can result in an out-of-bounds write leading to memory disclosure and code execution.
Key phrases: memory corruption, out-of-bounds write, memory disclosure, code execution, out of bounds write
CVE-2016-2375: An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can result in memory disclosure.
Key phrases: out-of-bounds read, memory disclosure, out of bounds read
CVE-2016-2376: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in arbitrary code execution. A malicious server or an attacker who intercepts the network traffic can send an invalid size for a packet which will trigger a buffer overflow.
Key phrases: buffer overflow, arbitrary code execution
CVE-2016-2377: A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result in an out-of-bounds write of one byte. A malicious server can send a negative content-length in response to a HTTP request triggering the vulnerability.
Key phrases: buffer overflow, out-of-bounds write, out of bounds write
CVE-2016-2378: A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a buffer overflow, potentially resulting in memory corruption. A malicious server or an unfiltered malicious user can send negative length values to trigger this vulnerability.
Key phrases: buffer overflow, memory corruption
CVE-2016-2379: The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
Key phrases: gain login access, (1) decrypt hashed passwords by leveraging, weak encryption
CVE-2016-2380: An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of-bounds read. A user could be convinced to enter a particular string which would then get converted incorrectly and could lead to a potential out-of-bounds read.
Key phrases: information leak, out-of-bounds read, out of bounds read, convince
CVE-2016-2381: Perl might allow context-dependent attackers to bypass the taint protection mechanism in a child process via duplicate environment variables in envp.
Key phrases: bypass the taint protection, bypass the taint protection mechanism in a child, duplicate environment variables
CVE-2016-2383: The adjust_branches function in kernel/bpf/verifier.c in the Linux kernel before 4.5 does not consider the delta in the backward-jump case, which allows local users to obtain sensitive information from kernel memory by creating a packet filter and then loading crafted BPF instructions.
Key phrases: obtain sensitive information, obtain sensitive information from kernel memory by creating, backward-jump case
CVE-2016-2384: Double free vulnerability in the snd_usbmidi_create function in sound/usb/midi.c in the Linux kernel before 4.5 allows physically proximate attackers to cause a denial of service (panic) or possibly have unspecified other impact via vectors involving an invalid USB descriptor.
Key phrases: denial of service (panic), cause a denial of service (panic), double free, unspecified other impact, unspecified impact
CVE-2016-2385: Heap-based buffer overflow in the encode_msg function in encode_msg.c in the SEAS module in Kamailio (formerly OpenSER and SER) before 4.3.5 allows remote attackers to cause a denial of service (memory corruption and process crash) or possibly execute arbitrary code via a large SIP packet.
Key phrases: execute arbitrary code, denial of service (memory corruption and process crash), cause a denial of service (memory corruption, heap-based buffer overflow, heap based buffer overflow
CVE-2016-2386: SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via unspecified vectors, sql injection
CVE-2016-2387: Multiple cross-site scripting (XSS) vulnerabilities in the Java Proxy Runtime ProxyServer servlet in SAP NetWeaver 7.4 allow remote attackers to inject arbitrary web script or HTML via the (1) ns or (2) interface parameter to ProxyServer/register, aka SAP Security Note 2220571.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, cross-site scripting (xss)
CVE-2016-2388: The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.
Key phrases: obtain sensitive user information, obtain sensitive user information via a crafted HTTP, universal worklist configuration
CVE-2016-2389: Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4 allows remote attackers to read arbitrary files via a .. (dot dot) in the Path parameter to /Catalog, aka SAP Security Note 2230978.
Key phrases: read arbitrary files, read arbitrary files via a .. (dot, directory traversal
CVE-2016-2390: The FwdState::connectedToPeer method in FwdState.cc in Squid before 3.5.14 and 4.0.x before 4.0.6 does not properly handle SSL handshake errors when built with the --with-openssl option, which allows remote attackers to cause a denial of service (application crash) via a plaintext HTTP message.
Key phrases: denial of service (application crash), cause a denial of service (application crash, ssl handshake errors
CVE-2016-2391: The ohci_bus_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors related to multiple eof_timers.
Key phrases: denial of service (NULL pointer dereference and QEMU process crash), cause a denial of service (NULL pointer, null pointer dereference, qemu process crash
CVE-2016-2392: The is_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuration descriptor objects, which allows local guest OS administrators to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving a remote NDIS control message packet.
Key phrases: denial of service (NULL pointer dereference and QEMU process crash), cause a denial of service (NULL pointer, null pointer dereference, qemu process crash, vectors involving a remote ndis control message packet
CVE-2016-2393: Lenovo Fingerprint Manager before 8.01.57 and Touch Fingerprint before 1.00.08 use weak ACLs for unspecified (1) services and (2) files, which allows local users to gain privileges by invalidating local checks.
Key phrases: gain privileges, gain privileges by invalidating local checks, weak acls, unspecified
CVE-2016-2396: The GMS ViewPoint (GMSVP) web application in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote authenticated users to execute arbitrary commands via vectors related to configuration input.
Key phrases: execute arbitrary commands, execute arbitrary commands via vectors related to configuration, vectors related to configuration input
CVE-2016-2397: The cliserver implementation in Dell SonicWALL GMS, Analyzer, and UMA EM5000 7.2, 8.0, and 8.1 before Hotfix 168056 allows remote attackers to deserialize and execute arbitrary Java code via crafted XML data.
Key phrases: execute arbitrary Java code, deserialize and execute arbitrary Java code via crafted
CVE-2016-2398: Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.
Key phrases: defeat sensor functionality by interfering with ZigBee 2.4, base-station communication
CVE-2016-2399: Integer overflow in the quicktime_read_pascal function in libquicktime 1.2.4 and earlier allows remote attackers to cause a denial of service or possibly have other unspecified impact via a crafted hdlr MP4 atom.
Key phrases: cause a denial of service or possibly have, integer overflow, unspecified impact
CVE-2016-2402: OkHttp before 2.7.4 and 3.x before 3.1.2 allows man-in-the-middle attackers to bypass certificate pinning by sending a certificate chain with a certificate from a non-pinned trusted CA and the pinned certificate.
Key phrases: bypass certificate pinning by sending a certificate chain, man in the middle
CVE-2016-2403: Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, which triggers an unauthenticated bind.
Key phrases: bypass authentication, bypass authentication by logging in with an empty, unauthenticated bind
CVE-2016-2404: Huawei switches S5700, S6700, S7700, S9700 with software V200R001C00SPC300, V200R002C00SPC100, V200R003C00SPC300, V200R005C00SPC500, V200R006C00; S12700 with software V200R005C00SPC500, V200R006C00; ACU2 with software V200R005C00SPC500, V200R006C00 have a permission control vulnerability. If a switch enables Authentication, Authorization, and Accounting (AAA) for permission control and user permissions are not appropriate, AAA users may obtain the virtual type terminal (VTY) access permission, resulting in privilege escalation.
Key phrases: obtain the virtual type terminal (VTY) access permission, permission control, privilege escalation
CVE-2016-2405: Huawei Policy Center with software before V100R003C10SPC020 allows remote authenticated users to gain privileges and cause a denial of service (system crash) via a crafted URL.
Key phrases: denial of service (system crash), gain privileges, gain privileges and cause a denial of service
CVE-2016-2406: The permission control module in Huawei Document Security Management (aka DSM) before V100R002C05SPC670 allows remote authenticated users to obtain sensitive information from encrypted documents by leveraging incorrect control of permissions on the PrintScreen button.
Key phrases: obtain sensitive information, obtain sensitive information from encrypted documents by leveraging, incorrect control of permissions
CVE-2016-2408: Pulse Secure Desktop before 5.2R2 and Pulse Secure Installer Service before 8.2R2 and below for Windows allow restricted users to gain privileges via unspecified vectors.
Key phrases: gain privileges, gain privileges via unspecified vectors
CVE-2016-2409: A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 25981545.
Key phrases: gain privileges, gain privileges via a crafted application that leverages, internal bug
CVE-2016-2410: A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages control over a service that can call this driver, aka internal bug 26291677.
Key phrases: gain privileges, gain privileges via a crafted application that leverages, internal bug
CVE-2016-2411: A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages root access, aka internal bug 26866053.
Key phrases: gain privileges, gain privileges via a crafted application that leverages, root access, internal bug
CVE-2016-2412: include/core/SkPostConfig.h in Skia, as used in System_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01, mishandles certain crashes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26593930.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug, crash
CVE-2016-2413: media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a handle pointer, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26403627.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2414: The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size values in font data, which allows remote attackers to cause a denial of service (memory corruption and reboot loop) via a crafted font, aka internal bug 26413177.
Key phrases: denial of service (memory corruption and reboot loop), cause a denial of service (memory corruption, internal bug
CVE-2016-2415: exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to obtain sensitive information via a crafted application that triggers a spoofed response to a GET request, aka internal bug 26488455.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application that, internal bug, spoofing
CVE-2016-2416: libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for the android.permission.DUMP permission, which allows attackers to obtain sensitive information, and consequently bypass an unspecified protection mechanism, via a dump request, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27046057.
Key phrases: bypass an unspecified protection, consequently bypass, obtain sensitive information, internal bug
CVE-2016-2417: media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a parameter data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26914474.
Key phrases: bypass an unspecified protection, consequently bypass, obtain sensitive information, obtain sensitive information from process memory, internal bug
CVE-2016-2418: media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324358.
Key phrases: bypass an unspecified protection, consequently bypass, obtain sensitive information, obtain sensitive information from process memory, internal bug
CVE-2016-2419: media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allows attackers to obtain sensitive information from process memory, and consequently bypass an unspecified protection mechanism, via unspecified vectors, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26323455.
Key phrases: bypass an unspecified protection, consequently bypass, obtain sensitive information, obtain sensitive information from process memory, internal bug
CVE-2016-2420: rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which allows attackers to gain privileges via a crafted application, aka internal bug 26403620.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2421: Setup Wizard in Android 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26154410.
Key phrases: bypass the Factory Reset Protection, bypass the Factory Reset Protection protection mechanism and, delete data, internal bug, unspecified
CVE-2016-2422: Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA certificate in an unrelated CA role, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26324357.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2423: server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider whether a device is provisioned, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26303187.
Key phrases: bypass the Factory Reset Protection, bypass the Factory Reset Protection protection mechanism and, delete data, unspecified vectors, internal bug
CVE-2016-2424: server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mismanages certain authority data, which allows attackers to cause a denial of service (reboot loop) via a crafted application, aka internal bug 26513719.
Key phrases: denial of service (reboot loop), cause a denial of service (reboot loop, internal bug
CVE-2016-2425: mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 supports file:///data attachments, which allows attackers to obtain sensitive information via a crafted application, aka internal bugs 7154234 and 26989185.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application, internal bugs and
CVE-2016-2426: server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a GET_ACCOUNTS permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 26094635.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application, internal bug
CVE-2016-2427: The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might make it easier for attackers to defeat a cryptographic protection mechanism and discover an authentication key via a crafted application, aka internal bug 26234568.  NOTE: The vendor disputes the existence of this potential issue in Android, stating "This CVE was raised in error: it referred to the authentication tag size in GCM, whose default according to ASN.1 encoding (12 bytes) can lead to vulnerabilities. After careful consideration, it was decided that the insecure default value of 12 bytes was a default only for the encoding and not default anywhere else in Android, and hence no vulnerability existed.
Key phrases: internal bug
CVE-2016-2428: libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted media file, aka internal bug 26751339.
Key phrases: execute arbitrary code, denial of service (stack memory corruption), execute arbitrary code or cause a denial of, internal bug
CVE-2016-2429: libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted media file, aka internal bug 27211885.
Key phrases: execute arbitrary code, denial of service (heap memory corruption), execute arbitrary code or cause a denial of, uninitialized memory, internal bug
CVE-2016-2430: libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236.
Key phrases: gain privileges, gain privileges via an application containing a crafted, internal bug
CVE-2016-2431: The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 5, Nexus 6, Nexus 7 (2013), and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 24968809.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2432: The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 6 and Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 25913059.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2433: The Broadcom Wi-Fi driver for Android, as used by BlackBerry smartphones before Build AAE570, allows remote attackers to execute arbitrary code in the context of the kernel.
Key phrases: execute arbitrary code, execute arbitrary code in the context of the
CVE-2016-2434: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27251090.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2435: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27297988.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2436: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27299111.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2437: The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27436822.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2439: Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.
Key phrases: execute arbitrary code, execute arbitrary code via a long PIN value, buffer overflow, internal bug
CVE-2016-2440: libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2441: The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26354602.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2442: The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26494907.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2443: The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 26404525.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2444: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27208332.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2445: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27253079.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2446: The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27441354.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2448: media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2449: services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27568958.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2450: codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27569635.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2451: codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27597103.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2452: codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 27662364 and 27843673.
Key phrases: gain privileges, gain privileges via a crafted application, internal bugs and
CVE-2016-2453: The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27549705.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2454: The Qualcomm hardware video codec in Android before 2016-05-01 on Nexus 5 devices allows remote attackers to cause a denial of service (reboot) via a crafted file, aka internal bug 26221024.
Key phrases: denial of service (reboot), cause a denial of service (reboot), internal bug
CVE-2016-2456: The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27275187.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2457: server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to bypass intended restrictions on Wi-Fi configuration changes by leveraging guest access, aka internal bug 27411179.
Key phrases: bypass intended restrictions, bypass intended restrictions on Wi-Fi configuration, internal bug
CVE-2016-2458: The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and ComposeActivityEmail.java, aka internal bug 27335139.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application, internal bug
CVE-2016-2459: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application, internal bug
CVE-2016-2460: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27555981.
Key phrases: obtain sensitive information, obtain sensitive information via a crafted application, internal bug
CVE-2016-2461: OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bugs 27324690 and 27696681.
Key phrases: spoof message authentication via unspecified vectors, internal bugs and, spoofing
CVE-2016-2462: OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173.
Key phrases: spoof message authentication via unspecified vectors, internal bug, spoofing
CVE-2016-2463: Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, multiple integer overflows, internal bug
CVE-2016-2464: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.
Key phrases: execute arbitrary code, denial of service (memory corruption), execute arbitrary code or cause a denial of, internal bug
CVE-2016-2465: The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27407865.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2466: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka internal bug 27947307.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2467: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5 devices allows attackers to gain privileges via a crafted application, aka internal bug 28029010.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2468: The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted application, aka internal bug 27475454.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2469: The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27531992.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2470: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27662174.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2471: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27773913.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2472: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27776888.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2473: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27777501.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2474: The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 27424603.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2475: The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges for certain system calls via a crafted application, aka internal bug 26425765.
Key phrases: gain privileges, gain privileges for certain system calls via a, internal bug
CVE-2016-2476: mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27207275.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2477: mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27251096.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2478: mm-video-v4l2/vidc/vdec/src/omx_vdec_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles pointers, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27475409.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug
CVE-2016-2479: The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 mishandles a buffer count, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27532282.
Key phrases: gain privileges, gain privileges via a crafted application, internal bug