CVSS: 4.3EPSS: 0%CPEs: 26EXPL: 0CVE-2016-6770
https://notcve.org/view.php?id=CVE-2016-6770
An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. This issue is rated as Moderate because it is a local bypass of restrictions on a constrained process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0. Android ID: A-30202228. • http://www.securityfocus.com/bid/94702 https://source.android.com/security/bulletin/2016-12-01.html • CWE-284: Improper Access Control •
CVSS: 7.1EPSS: 0%CPEs: 26EXPL: 0CVE-2016-6764
https://notcve.org/view.php?id=CVE-2016-6764
A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated as High due to the possibility of remote denial of service. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0. Android ID: A-31681434. • http://www.securityfocus.com/bid/94688 https://source.android.com/security/bulletin/2016-12-01.html • CWE-399: Resource Management Errors •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 0CVE-2016-6783
https://notcve.org/view.php?id=CVE-2016-6783
An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: N/A. Android ID: A-31350044. • http://www.securityfocus.com/bid/94683 https://source.android.com/security/bulletin/2016-12-01.html • CWE-284: Improper Access Control •
CVSS: 5.5EPSS: 0%CPEs: 3EXPL: 0CVE-2016-6910
https://notcve.org/view.php?id=CVE-2016-6910
The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data. La vulnerabilidad de oyente de notificación inexistente se introdujo en las primeras versiones de Android 5.0.2 para los dispositivos Samsung Galaxy S6 Edge, pero la vulnerabilidad puede persistir en el dispositivo incluso después de que el dispositivo se haya actualizado a una versión de Android 5.1.1 o 6.0.1. La aplicación del sistema vulnerable da a una aplicación inexistente la capacidad de leer las notificaciones del dispositivo, que una aplicación de terceros puede utilizar si usa un nombre de paquete de com.samsung.android.app.portalservicewidget. • http://www.kryptowire.com/disclosures/CVE-2016-6910/Factory_Resets_and_Obtaining_Notifications_on_Samsung_Android_Devices.pdf http://www.securityfocus.com/bid/95092 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 9.3EPSS: 0%CPEs: 9EXPL: 1CVE-2016-6772 – Google Android - WifiNative::setHotlist Stack Overflow
https://notcve.org/view.php?id=CVE-2016-6772
An elevation of privilege vulnerability in Wi-Fi could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Moderate because it first requires compromising a privileged process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0. Android ID: A-31856351. • https://www.exploit-db.com/exploits/40945 http://www.securityfocus.com/bid/94701 https://bugs.chromium.org/p/project-zero/issues/detail?id=958 https://source.android.com/security/bulletin/2016-12-01.html • CWE-264: Permissions, Privileges, and Access Controls •