en/security/bulletin/2016-11-01.html - platform/docs/source.android.com - Git at Google

 <html devsite>
   <head>
     <title>Android Security Bulletin—November 2016</title>
     <meta name="project_path" value="/_project.yaml" />
     <meta name="book_path" value="/_book.yaml" />
   </head>
   <body>
   <!--
       Copyright 2017 The Android Open Source Project

       Licensed under the Apache License, Version 2.0 (the "License");
       you may not use this file except in compliance with the License.
       You may obtain a copy of the License at

           http://www.apache.org/licenses/LICENSE-2.0

       Unless required by applicable law or agreed to in writing, software
       distributed under the License is distributed on an "AS IS" BASIS,
       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
       See the License for the specific language governing permissions and
       limitations under the License.
   -->


 <p><em>Published November 07, 2016 | Updated December 21, 2016</em></p>
 <p>
 The Android Security Bulletin contains details of security vulnerabilities
 affecting Android devices. Alongside the bulletin, we have released a security
 update to Google devices through an over-the-air (OTA) update. The Google device
 firmware images have also been released to the
 <a href="https://developers.google.com/android/nexus/images">Google Developer
 site</a>. Security patch levels of November 06, 2016 or later address all of
 these issues. Refer to the
 <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel
 and Nexus update schedule</a> to learn how to check a device's security patch level.</p>
 <p>
 Partners were notified of the issues described in the bulletin on October 20,
 2016 or earlier. Where applicable, source code patches for these issues have
 been released to the Android Open Source Project (AOSP) repository. This
 bulletin also includes links to patches outside of AOSP.
 </p>
 <p>
 The most severe of these issues is a Critical security vulnerability that could
 enable remote code execution on an affected device through multiple methods such
 as email, web browsing, and MMS when processing media files. The
 <a href="/security/overview/updates-resources.html#severity">severity
 assessment</a> is based on the effect that exploiting the vulnerability would
 possibly have on an affected device, assuming the platform and service
 mitigations are disabled for development purposes or if successfully bypassed.</p>
 <p>
 We have had no reports of active customer exploitation or abuse of these newly
 reported issues. Refer to the
 <a href="#mitigations">Android and Google service
 mitigations</a> section for details on the
 <a href="/security/enhancements/index.html">Android
 security platform protections</a> and service protections such as
 <a href="https://developer.android.com/training/safetynet/index.html">SafetyNet</a>,
 which improve the security of the Android platform.</p>
 <p>
 We encourage all customers to accept these updates to their devices.</p>
 <h2 id="announcements">Announcements</h2>
 <ul>
  <li>With the introduction of the Pixel and Pixel XL devices, the term for
   <a href="#google-devices">all devices supported by Google</a> is
   "Google devices" instead of "Nexus devices."
  </li>
  <li>This bulletin has three security patch levels to provide Android partners
  with the flexibility to more quickly fix a subset of vulnerabilities that are
  similar across all Android devices. See
  <a href="#common-questions-and-answers">Common questions and answers</a> for
  additional information:
   <ul>
    <li><strong>2016-11-01</strong>: Partial security patch level. This security
    patch level indicates that all issues associated with 2016-11-01 (and all
    previous security patch level) are addressed.</li>
    <li><strong>2016-11-05</strong>: Complete security patch level. This security
    patch level indicates that all issues associated with 2016-11-01 and 2016-11-05
    (and all previous security patch levels) are addressed.</li>
    <li><strong>Supplemental security patch levels</strong>
     <p>Supplemental security patch levels are provided to identify devices
        that contain fixes for issues that were publicly disclosed after the
        patch level was defined. Addressing these recently disclosed
        vulnerabilities is not required until the 2016-12-01 security patch level.
     </p>
     <ul>
      <li><strong>2016-11-06</strong>: This security patch level indicates that the
      device has addressed all issues associated with 2016-11-05 and CVE-2016-5195,
      which was publicly disclosed on October 19, 2016.</li>
     </ul>
    </li>
   </ul>
 </li>
 <li>Supported Google devices will receive a single OTA update with the November
 05, 2016 security patch level.</li>
 </ul>

 <h2 id="mitigations">Android and Google service
 mitigations</h2>
 <p>
 This is a summary of the mitigations provided by the
 <a href="/security/enhancements/index.html">Android
 security platform</a> and service protections, such as SafetyNet. These
 capabilities reduce the likelihood that security vulnerabilities could be
 successfully exploited on Android.</p>
 <ul>
   <li>Exploitation for many issues on Android is made more difficult by
   enhancements in newer versions of the Android platform. We encourage all users
   to update to the latest version of Android where possible.</li>
   <li>The Android Security team actively monitors for abuse with
   <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_2015_Report_Final.pdf">Verify
   Apps and SafetyNet</a>, which are designed to warn users about
   <a href="http://static.googleusercontent.com/media/source.android.com/en//security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially
   Harmful Applications</a>. Verify Apps is enabled by default on devices with
   <a href="http://www.android.com/gms">Google Mobile Services</a> and is especially
   important for users who install applications from outside of Google Play. Device
   rooting tools are prohibited within Google Play, but Verify Apps warns users
   when they attempt to install a detected rooting application—no matter where it
   comes from. Additionally, Verify Apps attempts to identify and block
   installation of known malicious applications that exploit a privilege escalation
   vulnerability. If such an application has already been installed, Verify Apps
   will notify the user and attempt to remove the detected application.</li>
   <li>As appropriate, Google Hangouts and Messenger applications do not
   automatically pass media to processes such as Mediaserver.</li>
 </ul>
 <h2 id="acknowledgements">Acknowledgements</h2>
 <p>
 We would like to thank these researchers for their contributions:</p>
 <ul>
   <li>Abhishek Arya, Oliver Chang, and Martin Barbella of Google Chrome Security
   Team: CVE-2016-6722</li>
   <li>Andrei Kapishnikov and Miriam Gershenson of Google: CVE-2016-6703</li>
   <li>Ao Wang (<a href="https://twitter.com/ArayzSegment">@ArayzSegment</a>) and
      <a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of
      <a href="http://www.pkav.net">PKAV</a>, Silence Information Technology:
   CVE-2016-6700, CVE-2016-6702</li>
   <li>Askyshang of Security Platform Department, Tencent: CVE-2016-6713</li>
   <li>Billy Lau of Android Security: CVE-2016-6737</li>
   <li><a href="mailto:kpatsak@unipi.gr">Constantinos Patsakis</a> and
       <a href="mailto:talepis@unipi.gr">Efthimios Alepis</a> of University of Piraeus:
   CVE-2016-6715</li>
   <li>dragonltx of Alibaba mobile security team: CVE-2016-6714</li>
   <li>Gal Beniamini of Project Zero: CVE-2016-6707, CVE-2016-6717</li>
   <li>Gengjia Chen (<a href="http://twitter.com/chengjia4574">@chengjia4574</a>)
   and <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab,
 <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-6725,
   CVE-2016-6738, CVE-2016-6740, CVE-2016-6741, CVE-2016-6742, CVE-2016-6744,
   CVE-2016-6745, CVE-2016-3906</li>
   <li>Guang Gong (龚广) (<a href="http://twitter.com/oldfresher">@oldfresher</a>) of
   Alpha Team, <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.:
   CVE-2016-6754</li>
   <li>Jianqiang Zhao (<a
   href="http://twitter.com/jianqiangzhao">@jianqiangzhao</a>) and
 <a href="http://weibo.com/jfpan">pjf</a> of IceSword Lab,
 <a href="http://www.360.com">Qihoo 360 Technology Co. Ltd</a>.: CVE-2016-6739,
   CVE-2016-3904, CVE-2016-3907, CVE-2016-6698</li>
   <li>Marco Grassi (<a href="http://twitter.com/marcograss">@marcograss</a>) of
   Keen Lab of Tencent (<a href="http://twitter.com/keen_lab">@keen_lab</a>):
   CVE-2016-6828</li>
   <li>Mark Brand of Project Zero: CVE-2016-6706</li>
   <li>Mark Renouf of Google: CVE-2016-6724</li>
   <li>Michał Bednarski (<a
   href="https://github.com/michalbednarski">github.com/michalbednarski</a>):
   CVE-2016-6710</li>
   <li>Min Chong of Android Security: CVE-2016-6743</li>
   <li>Peter Pi (<a href="http://twitter.com/heisecode">@heisecode</a>) of Trend
   Micro: CVE-2016-6721</li>
   <li>Qidan He (何淇丹) (<a href="http://twitter.com/flanker_hqd">@flanker_hqd</a>)
   and Gengming Liu (刘耕铭) (<a href="http://twitter.com/dmxcsnsbh">@dmxcsnsbh</a>)
   of KeenLab, Tencent: CVE-2016-6705</li>
   <li>Robin Lee of Google: CVE-2016-6708</li>
   <li><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a> (<a
   href="http://twitter.com/ScottyBauer1">@ScottyBauer1</a>): CVE-2016-6751</li>
   <li>Sergey Bobrov (<a href="http://twitter.com/Black2Fan">@Black2Fan</a>) of
   Kaspersky Lab: CVE-2016-6716</li>
   <li>Seven Shen (<a href="http://twitter.com/lingtongshen">@lingtongshen</a>) of
   Trend Micro Mobile Threat Research Team: CVE-2016-6748, CVE-2016-6749,
   CVE-2016-6750, CVE-2016-6753</li>
   <li>Victor van der Veen, Herbert Bos, Kaveh Razavi, and Cristiano Giuffrida of
   Vrije Universiteit Amsterdam and Yanick Fratantonio, Martina Lindorfer, and
   Giovanni Vigna of University of California, Santa Barbara: CVE-2016-6728</li>
   <li>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of
   Alibaba Inc: CVE-2016-6712, CVE-2016-6699, CVE-2016-6711</li>
   <li>Wenke Dou (<a
   href="mailto:vancouverdou@gmail.com">vancouverdou@gmail.com</a>), Chiachih Wu
   (<a href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang
   of <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6720</li>
   <li>Wish Wu (吴潍浠) (<a href="http://twitter.com/wish_wu">@wish_wu</a>) of Trend
   Micro Inc.: CVE-2016-6704</li>
   <li>Yakov Shafranovich of
 <a href="https://wwws.nightwatchcybersecurity.com">Nightwatch Cybersecurity</a>:
   CVE-2016-6723</li>
   <li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>,
 <a href="mailto:yaojun8558363@gmail.com">Yao Jun</a>,
 <a href="mailto:segfault5514@gmail.com">Tong Lin</a>, Chiachih Wu (<a
   href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
 <a href="http://c0reteam.org">C0RE Team</a>: CVE-2016-6730, CVE-2016-6732,
   CVE-2016-6734, CVE-2016-6736</li>
   <li><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a>,
 <a href="mailto:yaojun8558363@gmail.com">Yao Jun</a>,
 <a href="mailto:wisedd@gmail.com">Xiaodong Wang</a>, Chiachih Wu (<a
   href="https://twitter.com/chiachih_wu">@chiachih_wu</a>), and Xuxian Jiang of
 <a href="http://c0reteam.org">C0RE Team</a>:  CVE-2016-6731, CVE-2016-6733,
   CVE-2016-6735, CVE-2016-6746</li>
 </ul>
 <p>
 Additional thanks to Zach Riggle of Android Security for his contributions
 to several issues in this bulletin.</p>

 <h2 id="2016-11-01-details">2016-11-01 security patch level—Vulnerability details</h2>
 <p>
 In the sections below, we provide details for each of the security
 vulnerabilities that apply to the 2016-11-01 patch level. There is a description of
 the issue, a severity rationale, and a table with the CVE, associated
 references, severity, updated Google devices, updated AOSP versions (where
 applicable), and date reported. When available, we will link the public change
 that addressed the issue to the bug ID, like the AOSP change list. When multiple
 changes relate to a single bug, additional references are linked to numbers
 following the bug ID.</p>

 <h3 id="rce-in-mediaserver">Remote code execution vulnerability in Mediaserver</h3>
 <p>
 A remote code execution vulnerability in Mediaserver could enable an attacker
 using a specially crafted file to cause memory corruption during media file and
 data processing. This issue is rated as Critical due to the possibility of
 remote code execution within the context of the Mediaserver process.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6699</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/3b1c9f692c4d4b7a683c2b358fc89e831a641b88">
        A-31373622</a></td>
    <td>Critical</td>
    <td>All</td>
    <td>7.0</td>
    <td>Jul 27, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-libzipfile">Elevation of privilege vulnerability in libzipfile</h3>
 <p>
 An elevation of privilege vulnerability in libzipfile could enable a local
 malicious application to execute arbitrary code within the context of a
 privileged process. This issue is rated as Critical due to the possibility of a
 local permanent device compromise, which may require reflashing the operating
 system to repair the device.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6700</td>
    <td>A-30916186</td>
    <td>Critical</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1</td>
    <td>Aug 17, 2016</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="rce-in-skia">Remote code execution vulnerability in Skia</h3>
 <p>
 A remote code execution vulnerability in libskia could enable an attacker using
 a specially crafted file to cause memory corruption during media file and data
 processing. This issue is rated as High due to the possibility of remote code
 execution within the context of the gallery process.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6701</td>
    <td><a href="https://android.googlesource.com/platform/external/skia/+/aca73722873e908633ff27375f6f93a08cbb7dd3">
        A-30190637</a></td>
    <td>High</td>
    <td>All</td>
    <td>7.0</td>
    <td>Google internal</td>
   </tr>
 </table>
 <h3 id="rce-in-libjpeg">Remote code execution vulnerability in libjpeg</h3>
 <p>
 A remote code execution vulnerability in libjpeg could enable an attacker using
 a specially crafted file to execute arbitrary code in the context of an
 unprivileged process. This issue is rated as High due to the possibility of
 remote code execution in an application that uses libjpeg.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6702</td>
    <td>A-30259087</td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1</td>
    <td>Jul 19, 2016</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="rce-in-android-runtime">Remote code execution vulnerability in Android runtime</h3>
 <p>
 A remote code execution vulnerability in an Android runtime library could enable
 an attacker using a specially crafted payload to execute arbitrary code in the
 context of an unprivileged process. This issue is rated as High due to the
 possibility of remote code execution in an application that uses the Android
 runtime.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6703</td>
    <td>A-30765246</td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="eop-in-mediaserver">Elevation of privilege vulnerability in Mediaserver</h3>
 <p>
 An elevation of privilege vulnerability in Mediaserver could enable a local
 malicious application to execute arbitrary code within the context of a
 privileged process. This issue is rated as High because it could be used to gain
 local access to elevated capabilities, which are not normally accessible to a
 third-party application.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6704</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/c6c446f9e022adf20064e65a17574804f8af8e7d">
        A-30229821</a>
      [<a href="https://android.googlesource.com/platform/hardware/qcom/audio/+/9cb9810ecb63c8ff55ecf4bc77431dc5b0688b5f">2</a>]
      [<a href="https://android.googlesource.com/platform/system/media/+/a6274f03b4dfe1c3a22af51e3a17ea56a314e747">3</a>]
    </td>
    <td>High</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Jul 19, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6705</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/3a03fa24d21f97e84e796ac5ef14b3f434c0e8f1">
        A-30907212</a>
       [<a href="https://android.googlesource.com/platform/frameworks/av/+/bd04b47d38a89f1dada1c6da2ef4a3d235c166b8">2</a>]
    </td>
    <td>High</td>
    <td>All</td>
    <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6706</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/1d4feebdb85db46e138530f360d9ff2490e14353">
        A-31385713</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>7.0</td>
    <td>Sep 8, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-system-server">Elevation of privilege vulnerability in System Server</h3>
 <p>
 An elevation of privilege vulnerability in System Server could enable a local
 malicious application to execute arbitrary code within the context of a
 privileged process. This issue is rated as High because it could be used to gain
 local access to elevated capabilities, which are not normally accessible to a
 third-party application.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6707</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/16024ea7c4bae08c972cf6b3734029aad33e8870">
        A-31350622</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>6.0, 6.0.1, 7.0</td>
    <td>Sep 7, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-system-ui">Elevation of privilege vulnerability in System UI</h3>
 <p>
 An elevation of privilege in the System UI could enable a local malicious user
 to bypass the security prompt of a work profile in Multi-Window mode. This
 issue is rated as High because it is a local bypass of user interaction
 requirements for any developer or security setting modifications.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6708</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/c9c73fde339b4db496f2c1ff8c18df1e9db5a7c1">
        A-30693465</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>7.0</td>
    <td>Google internal</td>
   </tr>
 </table>
 <h3 id="id-in-conscrypt">Information disclosure vulnerability in Conscrypt</h3>
 <p>
 An information disclosure vulnerability in Conscrypt could enable
 an attacker to gain access to sensitive information if a
 legacy encryption API is used by an application. This issue is rated as High
 because it could be used to access data without permission.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6709</td>
    <td><a href="https://android.googlesource.com/platform/external/conscrypt/+/44ef9535b9afb123d150d8e0362e4bb50794dd41">
        A-31081987</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>6.0, 6.0.1, 7.0</td>
    <td>Oct 9, 2015</td>
   </tr>
 </table>
 <h3 id="id-in-download-manager">Information disclosure vulnerability in download
 manager</h3>
 <p>
 An information disclosure vulnerability in the download manager could enable a
 local malicious application to bypass operating system protections that isolate
 application data from other applications. This issue is rated as High because it
 could be used to gain access to data that the application does not have access
 to.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6710</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/9fab683c9598d234dd8461335c276ed3e37c91e8">
        A-30537115</a>
       [<a href="https://android.googlesource.com/platform/packages/providers/DownloadProvider/+/243e62949f7208d3b82eda3ee4ec22d3dbc1fb19">2</a>]
    </td>
    <td>High</td>
    <td>All</td>
    <td>5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Jul 30, 2016</td>
   </tr>
 </table>
 <h3 id="dos-in-bluetooth">Denial of service
 vulnerability in Bluetooth</h3>
 <p>
 A denial of service vulnerability in Bluetooth could enable a proximate attacker
 to block Bluetooth access to an affected device. This issue is rated as High due
 to the possibility of remote denial of service.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2014-9908</td>
    <td>A-28672558</td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1</td>
    <td>May 5, 2014</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="dos-in-openjdk">Denial of service
 vulnerability in OpenJDK</h3>
 <p>
 A remote denial of service vulnerability in OpenJDK could enable an attacker to
 use a specially crafted file to cause a device hang or reboot. This issue is
 rated as High due to the possibility of remote denial of service.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2015-0410</td>
    <td><a href="https://android.googlesource.com/platform/libcore/+/21098574528bdf99dd50a74a60e161573e999108">
        A-30703445</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>7.0</td>
    <td>Jan 16, 2015</td>
   </tr>
 </table>
 <h3 id="dos-in-mediaserver">Denial of service
 vulnerability in Mediaserver</h3>
 <p>
 A remote denial of service vulnerability in Mediaserver could enable an attacker
 to use a specially crafted file to cause a device hang or reboot. This issue is
 rated as High due to the possibility of remote denial of service.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6711</td>
    <td><a href="https://android.googlesource.com/platform/external/libvpx/+/063be1485e0099bc81ace3a08b0ec9186dcad693">
        A-30593765</a>
    </td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Aug 1, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6712</td>
    <td><a href="https://android.googlesource.com/platform/external/libvpx/+/fdb1b40e7bb147c07bda988c9501ad223795d12d">
        A-30593752</a>
    </td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Aug 1, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6713</td>
    <td><a href="https://android.googlesource.com/platform/external/libavc/+/8cafca0e8b1ed8125918e203118c5a4e612fd56c">
        A-30822755</a></td>
    <td>High</td>
    <td>All</td>
    <td>6.0, 6.0.1, 7.0</td>
    <td>Aug 11, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6714</td>
    <td><a href="https://android.googlesource.com/platform/external/libavc/+/5bdb0a6b72782e505671a387bb5f83222d891d6a">
        A-31092462</a>
    </td>
    <td>High</td>
    <td>All</td>
    <td>6.0, 6.0.1, 7.0</td>
    <td>Aug 22, 2016</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="eop-in-framework-apis">Elevation of
 privilege vulnerability in Framework APIs</h3>
 <p>
 An elevation of privilege vulnerability in the Framework APIs could allow a
 local malicious application to record audio without the user's permission. This
 issue is rated as Moderate because it is a local bypass of user interaction
 requirements (access to functionality that would normally require either user
 initiation or user permission).
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6715</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/3de09838fb0996bb4b420630800ad34e828fd1b6">
        A-29833954</a>
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Jun 28, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-aosp-launcher">Elevation of
 privilege vulnerability in AOSP Launcher</h3>
 <p>
 An elevation of privilege vulnerability in the AOSP Launcher could allow a local
 malicious application to create shortcuts that have elevated privileges without
 the user's consent. This issue is rated as Moderate because it is a local bypass
 of user interaction requirements (access to functionality that would normally
 require either user initiation or user permission).
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6716</td>
    <td><a href="https://android.googlesource.com/platform/packages/apps/Launcher3/+/e83fc11c982e67dd0181966f5f3a239ea6b14924">
        A-30778130</a>
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>7.0</td>
    <td>Aug 5, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-mediaserver-1">Elevation of
 privilege vulnerability in Mediaserver</h3>
 <p>
 An elevation of privilege vulnerability in Mediaserver could enable a local
 malicious application to execute arbitrary code within the context of a
 privileged process. This issue is rated as Moderate because it first requires
 exploitation of a separate vulnerability.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6717</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/45d9bbabbe7920bf4e0a68074b97d8260aef2e07">
        A-31350239</a>
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Sep 7, 2016</td>
   </tr>
 </table>
 <h3
 id="eop-in-account-manager-service">Elevation
 of privilege vulnerability in Account Manager Service</h3>
 <p>
 An elevation of privilege vulnerability in the Account Manager Service could
 enable a local malicious application to retrieve sensitive information without
 user interaction. This issue is rated as Moderate because it is a local bypass
 of user interaction requirements (access to functionality that would normally
 require either user initiation or user permission.)
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6718</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/fecfd550edeca422c0d9f32a9c0abe73398a1ff1">
        A-30455516</a>
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>7.0</td>
    <td>Google internal</td>
   </tr>
 </table>
 <h3 id="eop-in-bluetooth">Elevation of
 privilege vulnerability in Bluetooth</h3>
 <p>
 An elevation of privilege vulnerability in the Bluetooth component could enable
 a local malicious application to pair with any Bluetooth device without user
 consent. This issue is rated as Moderate because it is a local bypass of user
 interaction requirements (access to functionality that would normally require
 either user initiation or user permission).
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6719</td>
    <td><a href="https://android.googlesource.com/platform/packages/apps/Bluetooth/+/e1b6db10e913c09d0b695368336137f6aabee462">
        A-29043989</a>
       [<a href="https://android.googlesource.com/platform/frameworks/base/+/b1dc1757071ba46ee653d68f331486e86778b8e4">2</a>]
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Google internal</td>
   </tr>
 </table>
 <h3 id="id-in-mediaserver">Information
 disclosure vulnerability in Mediaserver</h3>
 <p>
 An information disclosure vulnerability in Mediaserver could enable a local
 malicious application to access data outside of its permission levels. This
 issue is rated as Moderate because it could be used to access sensitive data
 without permission.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6720</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/0f177948ae2640bfe4d70f8e4248e106406b3b0a">
        A-29422020</a>
       [<a href="https://android.googlesource.com/platform/frameworks/av/+/2c75e1c3b98e4e94f50c63e2b7694be5f948477c">2</a>]
       [<a href="https://android.googlesource.com/platform/frameworks/av/+/7c88b498fda1c2b608a9dd73960a2fd4d7b7e3f7">3</a>]
       [<a href="https://android.googlesource.com/platform/frameworks/av/+/640b04121d7cd2cac90e2f7c82b97fce05f074a5">4</a>]</td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Jun 15, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6721</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/f6bf0102bdc1adff973e08d8ce9c869c4e2efade">
        A-30875060</a></td>
    <td>Moderate</td>
    <td>All</td>
    <td>6.0, 6.0.1, 7.0</td>
    <td>Aug 13, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6722</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/av/+/89c03b3b9ff74a507a8b8334c50b08b334483556">
        A-31091777</a></td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Aug 23, 2016</td>
   </tr>
 </table>
 <h3 id="dos-in-proxy-auto-config">Denial of service
 vulnerability in Proxy Auto Config</h3>
 <p>
 A denial of service vulnerability in Proxy Auto Config could enable a remote
 attacker to use a specially crafted file to cause a device hang or reboot. This
 issue is rated as Moderate because it requires an uncommon device configuration.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6723</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/d5b0d0b1df2e1a7943a4bb2034fd21487edd0264">
        A-30100884</a>
       [<a href="https://android.googlesource.com/platform/frameworks/base/+/31f351160cdfd9dbe9919682ebe41bde3bcf91c6">2</a>]
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Jul 11, 2016</td>
   </tr>
 </table>
 <h3 id="dos-in-input-manager-service">Denial of
 service vulnerability in Input Manager Service</h3>
 <p>
 A denial of service vulnerability in the Input Manager Service could enable a
 local malicious application to cause the device to continually reboot. This
 issue is rated as Moderate because it is a temporary denial of service that
 requires a factory reset to fix.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6724</td>
    <td><a href="https://android.googlesource.com/platform/frameworks/base/+/7625010a2d22f8c3f1aeae2ef88dde37cbebd0bf">
        A-30568284</a>
    </td>
    <td>Moderate</td>
    <td>All</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0</td>
    <td>Google internal</td>
   </tr>
 </table>
 <h2 id="2016-11-05-details">2016-11-05 security patch level—Vulnerability details</h2>
 <p>
 In the sections below, we provide details for each of the security
 vulnerabilities that apply to the 2016-11-05 patch level. There is a description of
 the issue, a severity rationale, and a table with the CVE, associated
 references, severity, updated Google devices, updated AOSP versions (where
 applicable), and date reported. When available, we will link the public change
 that addressed the issue to the bug ID, like the AOSP change list. When multiple
 changes relate to a single bug, additional references are linked to numbers
 following the bug ID.
 </p>
 <h3 id="rce-in-qualcomm-crypto-driver">Remote
 code execution vulnerability in Qualcomm crypto driver</h3>
 <p>
 A remote code execution vulnerability in the Qualcomm crypto driver could enable
 a remote attacker to execute arbitrary code within the context of the kernel.
 This issue is rated as Critical due to the possibility of remote code execution
 in the context of the kernel.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6725</td>
    <td>A-30515053<br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=cc95d644ee8a043f2883d65dda20e16f95041de3">QC-CR#1050970</a></td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 25, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-file-system">Elevation of
 privilege vulnerability in kernel file system</h3>
 <p>
 An elevation of privilege vulnerability in the kernel file system could enable a
 local malicious application to execute arbitrary code within the context of the
 kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2015-8961</td>
    <td>A-30952474
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6934da9238da947628be83635e365df41064b09b">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Pixel, Pixel XL</td>
    <td>Oct 18, 2015</td>
   </tr>
   <tr>
    <td>CVE-2016-7911</td>
    <td>A-30946378
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8ba8682107ee2ca3347354e018865d8e1967c5f4">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Jul 01, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-7910</td>
    <td>A-30942273
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=77da160530dd1dc94f6ae15a981f24e5f0021e84">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Jul 29, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-scsi-driver">Elevation of
 privilege vulnerability in kernel SCSI driver</h3>
 <p>
 An elevation of privilege vulnerability in the kernel SCSI driver could enable a
 local malicious application to execute arbitrary code within the context of the
 kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2015-8962</td>
    <td>A-30951599
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3951a3709ff50990bf3e188c27d346792103432">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Pixel, Pixel XL</td>
    <td>Oct 30, 2015</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-media-driver">Elevation
 of privilege vulnerability in kernel media driver</h3>
 <p>
 An elevation of privilege vulnerability in the kernel media driver could enable
 a local malicious application to execute arbitrary code within the context of
 the kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-7913</td>
    <td>A-30946097
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8dfbcc4351a0b6d2f2d77f367552f48ffefafe18">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Nexus 6P, Android One, Nexus Player, Pixel, Pixel XL</td>
    <td>Jan 28, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-usb-driver">Elevation of
 privilege vulnerability in kernel USB driver</h3>
 <p>
 An elevation of privilege vulnerability in the kernel USB driver could enable a
 local malicious application to execute arbitrary code within the context of the
 kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-7912</td>
    <td>A-30950866
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=38740a5b87d53ceb89eb2c970150f6e94e00373a">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Pixel C, Pixel, Pixel XL</td>
    <td>Apr 14, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-ion-subsystem">Elevation
 of privilege vulnerability in kernel ION subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel ION subsystem could enable
 a local malicious application to execute arbitrary code within the context of
 the kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6728</td>
    <td>A-30400942*</td>
    <td>Critical</td>
    <td>Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, Pixel C,
 Android One</td>
    <td>Jul 25, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="eop-in-qualcomm-bootloader">Elevation
 of privilege vulnerability in Qualcomm bootloader</h3>
 <p>
 An elevation of privilege vulnerability in the Qualcomm bootloader could enable
 a local malicious application to execute arbitrary code within the context of
 the kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6729</td>
    <td>A-30977990*
 <br>
 QC-CR#977684</td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 25, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="eop-in-nvidia-gpu-driver">Elevation of
 privilege vulnerability in NVIDIA GPU driver</h3>
 <p>
 An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a
 local malicious application to execute arbitrary code within the context of the
 kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6730</td>
    <td>A-30904789*<br>
        N-CVE-2016-6730</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6731</td>
    <td>A-30906023*<br>
        N-CVE-2016-6731</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6732</td>
    <td>A-30906599*<br>
        N-CVE-2016-6732</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6733</td>
    <td>A-30906694*<br>
        N-CVE-2016-6733</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6734</td>
    <td>A-30907120*<br>
        N-CVE-2016-6734</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6735</td>
    <td>A-30907701*<br>
        N-CVE-2016-6735</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 16, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6736</td>
    <td>A-30953284*<br>
        N-CVE-2016-6736</td>
    <td>Critical</td>
    <td>Pixel C</td>
    <td>Aug 18, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3
 id="eop-in-kernel-networking-subsystem">Elevation
 of privilege vulnerability in kernel networking subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel networking subsystem could
 enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as Critical due to the possibility of
 a local permanent device compromise, which may require reflashing the operating
 system to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6828</td>
    <td>A-31183296
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/include/net/tcp.h?id=bb1fceca22492109be12640d49f5ea5a544c6bb4">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Aug 18, 2016</td>
   </tr>
 </table>
 <h3
 id="eop-in-kernel-sound-subsystem">Elevation of
 privilege vulnerability in kernel sound subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel sound subsystem could
 enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as Critical due to the possibility of
 a local permanent device compromise, which may require reflashing the operating
 system to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-2184</td>
    <td>A-30952477
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=836b34a935abc91e13e63053d0a83b24dfb5ea78">Upstream
 kernel</a></td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Mar 31, 2016</td>
   </tr>
 </table>
 <h3 id="eop-in-kernel-ion-subsystem-1">Elevation
 of privilege vulnerability in kernel ION subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel ION subsystem could enable
 a local malicious application to execute arbitrary code within the context of
 the kernel. This issue is rated as Critical due to the possibility of a local
 permanent device compromise, which may require reflashing the operating system
 to repair the device.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6737</td>
    <td>A-30928456*</td>
    <td>Critical</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel C, Nexus Player, Pixel,
 Pixel XL</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="vulnerabilities-in-qualcomm-components">Vulnerabilities in Qualcomm
 components</h3>
 <p>
 The table below contains security vulnerabilities affecting Qualcomm components
 and are described in further detail in Qualcomm AMSS June 2016 security
 bulletin and Security Alert 80-NV606-17.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity*</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6727</td>
    <td>A-31092400**</td>
    <td>Critical</td>
    <td>Android One</td>
    <td>Qualcomm internal</td>
   </tr>
   <tr>
    <td>CVE-2016-6726</td>
    <td>A-30775830**</td>
    <td>High</td>
    <td>Nexus 6, Android One</td>
    <td>Qualcomm internal</td>
   </tr>
 </table>
 <p>* The severity rating for these vulnerabilities was determined by the vendor.</p>
 <p>
 ** The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="rce-in-expat">Remote code execution
 vulnerability in Expat</h3>
 <p>
 The table below contains security vulnerabilities affecting the Expat library.
 The most severe of these issues is an elevation of privilege vulnerability in
 the Expat XML parser, which could enable an attacker using a specially crafted
 file to execute arbitrary code in an unprivileged process. This issue is rated
 as High due to the possibility of arbitrary code execution in an application
 that uses Expat.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>

   <tr>
    <td>CVE-2016-0718</td>
    <td><a href="https://android.googlesource.com/platform/external/expat/+/52ac633b73856ded34b33bd4adb4ab793bbbe963">
        A-28698301</a></td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>May 10, 2016</td>
   </tr>
   <tr>
    <td>CVE-2012-6702</td>
    <td><a href="https://android.googlesource.com/platform/external/expat/+/a11ff32280a863bff93df13ad643912ad9bf1302">
        A-29149404</a></td>
    <td>Moderate</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Mar 06, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-5300</td>
    <td><a href="https://android.googlesource.com/platform/external/expat/+/a11ff32280a863bff93df13ad643912ad9bf1302">
        A-29149404</a></td>
    <td>Moderate</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Jun 04, 2016</td>
   </tr>
   <tr>
    <td>CVE-2015-1283</td>
    <td><a href="https://android.googlesource.com/platform/external/expat/+/13b40c2040a17038b63a61e2b112c634da203d3b">
        A-27818751</a></td>
    <td>Low</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Jul 24, 2015</td>
   </tr>
 </table>

 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="rce-in-webview">Remote code execution vulnerability in Webview</h3>
 <p>
 A remote code execution vulnerability in Webview could enable a remote attacker
 to execute arbitrary code when the user is navigating to a website. This issue
 is rated as High due to the possibility of remote code execution in an
 unprivileged process.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6754</td>
    <td>A-31217937</td>
    <td>High</td>
    <td>None*</td>
    <td>5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Aug 23, 2016</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3 id="rce-in-freetype">Remote code execution
 vulnerability in Freetype</h3>
 <p>
 A remote code execution vulnerability in Freetype could enable a local malicious
 application to load a specially crafted font to cause memory corruption in an
 unprivileged process. This issue is rated as High due to the possibility of
 remote code execution in applications that use Freetype.
 </p>
 <table>
   <col width="18%">
   <col width="18%">
   <col width="10%">
   <col width="19%">
   <col width="17%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Updated AOSP versions</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2014-9675</td>
    <td><a href="https://android.googlesource.com/platform/external/freetype/+/f720f0dbcf012d6c984dbbefa0875ef9840458c6">
        A-24296662</a>
       [<a href="https://android.googlesource.com/platform/external/pdfium/+/96f965ff7411f1edba72140fd70740e63cabec71">2</a>]
    </td>
    <td>High</td>
    <td>None*</td>
    <td>4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * Supported Google devices on Android 7.0 or later that have installed all
 available updates are not affected by this vulnerability.
 </p>
 <h3
 id="eop-in-kernel-performance-subsystem">Elevation
 of privilege vulnerability in kernel performance subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel performance subsystem
 could enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as High because it first requires
 compromising a privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2015-8963</td>
    <td>A-30952077
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=12ca6ad2e3a896256f086497a7c7406a547ee373">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Dec 15, 2015</td>
   </tr>
 </table>
 <h3
 id="eop-in-kernel-system-call-auditing-subsystem">Elevation
 of privilege vulnerability in kernel system-call auditing subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel system-call auditing
 subsystem could enable a local malicious application to disrupt system-call
 auditing in the kernel. This issue is rated as High because it is a general
 bypass for a kernel-level defense in depth or exploit mitigation technology.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6136</td>
    <td>A-30956807
 <br>
 <a
 href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=43761473c254b45883a64441dd0bc85a42f3645c">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Android One, Pixel C, Nexus Player</td>
    <td>Jul 1, 2016</td>
   </tr>
 </table>
 <h3
 id="eop-in-qualcomm-crypto-engine-driver">Elevation
 of privilege vulnerability in Qualcomm crypto engine driver</h3>
 <p>
 An elevation of privilege vulnerability in the Qualcomm crypto engine driver
 could enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as High because it first requires
 compromising a privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6738</td>
    <td>A-30034511
 <br>
 <a
 href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=a829c54236b455885c3e9c7c77ac528b62045e79">QC-CR#1050538</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 7, 2016</td>
   </tr>
 </table>
 <h3
 id="eop-in-qualcomm-camera-driver">Elevation of
 privilege vulnerability in Qualcomm camera driver</h3>
 <p>
 An elevation of privilege vulnerability in the Qualcomm camera driver could
 enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as High because it first requires
 compromising a privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6739</td>
    <td>A-30074605*<br>
        QC-CR#1049826</td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
    <td>Jul 11, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6740</td>
    <td>A-30143904
 <br>
 <a
 href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=ef78bd62f0c064ae4c827e158d828b2c110ebcdc">QC-CR#1056307</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 12, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6741</td>
    <td>A-30559423
 <br>
 <a
 href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?id=d291eebd8e43bba3229ae7ef9146a132894dc293">QC-CR#1060554</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 28, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="eop-in-qualcomm-bus-driver">Elevation
 of privilege vulnerability in Qualcomm bus driver</h3>
 <p>
 An elevation of privilege vulnerability in the Qualcomm bus driver could enable
 a local malicious application to execute arbitrary code within the context of
 the kernel. This issue is rated as High because it first requires compromising a
 privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-3904</td>
    <td>A-30311977
 <br>
 <a
 href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=069683407ca9a820d05c914b57c587bcd3f16a3a">QC-CR#1050455</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
    <td>Jul 22, 2016</td>
   </tr>
 </table>
 <h3
 id="eop-in-synaptics-touchscreen-driver">Elevation
 of privilege vulnerability in Synaptics touchscreen driver</h3>
 <p>
 An elevation of privilege vulnerability in the Synaptics touchscreen driver
 could enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as High because it first requires
 compromising a privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6742</td>
    <td>A-30799828*</td>
    <td>High</td>
    <td>Nexus 5X, Android One</td>
    <td>Aug 9, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6744</td>
    <td>A-30970485*</td>
    <td>High</td>
    <td>Nexus 5X</td>
    <td>Aug 19, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6745</td>
    <td>A-31252388*</td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6P, Nexus 9, Android One, Pixel, Pixel XL</td>
    <td>Sep 1, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6743</td>
    <td>A-30937462*</td>
    <td>High</td>
    <td>Nexus 9, Android One</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="id-in-kernel-components">Information
 disclosure vulnerability in kernel components</h3>
 <p>
 An information disclosure vulnerability in kernel components, including the
 human interface device driver, file system, and Teletype driver, could enable a
 local malicious application to access data outside of its permission levels.
 This issue is rated as High because it could be used to access sensitive data
 without explicit user permission.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2015-8964</td>
    <td>A-30951112
 <br>
 <a
 href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=dd42bf1197144ede075a9d4793123f7689e164bc">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Nov 27, 2015</td>
   </tr>
   <tr>
    <td>CVE-2016-7915</td>
    <td>A-30951261
 <br>
 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=50220dead1650609206efe91f0cc116132d59b3f">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>Jan 19, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-7914</td>
    <td>A-30513364
 <br>
 <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=8d4a2ec1e0b41b0cf9a0c5cd4511da7f8e4f3de2">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Pixel C, Pixel, Pixel XL</td>
    <td>Apr 06, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-7916</td>
    <td>A-30951939
 <br>
 <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8148a73c9901a8794a50f950083c00ccf97d43b3">Upstream
 kernel</a></td>
    <td>High</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Android One, Pixel C, Nexus Player,
 Pixel, Pixel XL</td>
    <td>May 05, 2016</td>
   </tr>
 </table>
 <h3 id="id-in-nvidia-gpu-driver">Information
 disclosure vulnerability in NVIDIA GPU driver</h3>
 <p>
 An information disclosure vulnerability in the NVIDIA GPU driver could enable a
 local malicious application to access data outside of its permission levels.
 This issue is rated as High because it could be used to access sensitive data
 without explicit user permission.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6746</td>
    <td>A-30955105*<br>
        N-CVE-2016-6746</td>
    <td>High</td>
    <td>Pixel C</td>
    <td>Aug 18, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="dos-in-mediaserver-1">Denial of service vulnerability in Mediaserver</h3>
 <p>
 A denial of service vulnerability in Mediaserver could enable an attacker to use
 a specially crafted file to cause a device hang or reboot. This issue is rated
 as High due to the possibility of remote denial of service.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6747</td>
    <td>A-31244612*<br>
        N-CVE-2016-6747</td>
    <td>High</td>
    <td>Nexus 9</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="id-in-kernel-components-1">Information disclosure vulnerability in
 kernel components</h3>
 <p>
 An information disclosure vulnerability in kernel components, including the
 process-grouping subsystem and the networking subsystem, could enable a local
 malicious application to access data outside of its permission levels. This
 issue is rated as Moderate because it first requires compromising a privileged
 process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-7917</td>
    <td>A-30947055
 <br>
 <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c58d6c93680f28ac58984af61d0a7ebf4319c241">Upstream
 kernel</a></td>
    <td>Moderate</td>
    <td>Pixel C, Pixel, Pixel XL</td>
    <td>Feb 02, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6753</td>
    <td>A-30149174*</td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Nexus 9, Pixel C, Nexus Player, Pixel, Pixel
 XL</td>
    <td>Jul 13, 2016</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>
 <h3 id="id-in-qualcomm-components">Information
 disclosure vulnerability in Qualcomm components</h3>
 <p>
 An information disclosure vulnerability in Qualcomm components including the GPU
 driver, power driver, SMSM Point-to-Point driver, and sound driver, could enable
 a local malicious application to access data outside of its permission levels.
 This issue is rated as Moderate because it first requires compromising a
 privileged process.
 </p>
 <table>
   <col width="19%">
   <col width="20%">
   <col width="10%">
   <col width="23%">
   <col width="17%">
   <tr>
     <th>CVE</th>
     <th>References</th>
     <th>Severity</th>
     <th>Updated Google devices</th>
     <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-6748</td>
    <td>A-30076504
 <br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=be651d020b122a1ba9410d23ca4ebbe9f5598df6">QC-CR#987018</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 12, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6749</td>
    <td>A-30228438
 <br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=f9185dc83b92e7d1ee341e32e8cf5ed00a7253a7">QC-CR#1052818</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
    <td>Jul 12, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6750</td>
    <td>A-30312054
 <br>
 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=34bda711a1c7bc7f9fd7bea3a5be439ed00577e5">QC-CR#1052825</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Jul 21, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-3906</td>
    <td>A-30445973
 <br>
 <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=b333d32745fec4fb1098ee1a03d4425f3c1b4c2e">QC-CR#1054344</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6P</td>
    <td>Jul 27, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-3907</td>
    <td>A-30593266
 <br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=744330f4e5d70dce71c4c9e03c5b6a8b59bb0cda">QC-CR#1054352</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6P, Pixel, Pixel XL</td>
    <td>Aug 2, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6698</td>
    <td>A-30741851
 <br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.10/commit/?id=de90beb76ad0b80da821c3b857dd30cd36319e61">QC-CR#1058826</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Aug 2, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6751</td>
    <td>A-30902162*<br>
        QC-CR#1062271</td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Aug 15, 2016</td>
   </tr>
   <tr>
    <td>CVE-2016-6752</td>
    <td>A-31498159
 <br>
 <a href="https://source.codeaurora.org/quic/la//kernel/msm-3.18/commit/?h=0de2c7600c8f1f0152a2f421c6593f931186400a">QC-CR#987051</a></td>
    <td>Moderate</td>
    <td>Nexus 5X, Nexus 6, Nexus 6P, Android One, Pixel, Pixel XL</td>
    <td>Google internal</td>
   </tr>
 </table>
 <p>
 * The patch for this issue is not publicly available. The update is contained in
 the latest binary drivers for Google devices available from the <a
 href="https://developers.google.com/android/nexus/drivers">Google Developer
 site</a>.
 </p>

 <h2 id="2016-11-06-details">2016-11-06 security patch level—Vulnerability details</h2>
 <p>
 In the sections below, we provide details for each of the security
 vulnerabilities listed in the
 <a href="#2016-11-06-summary">2016-11-06 security patch level—Vulnerability
 summary</a> above. There is a description of
 the issue, a severity rationale, and a table with the CVE, associated
 references, severity, updated Google devices, updated AOSP versions (where
 applicable), and date reported. When available, we will link the public change
 that addressed the issue to the bug ID, like the AOSP change list. When multiple
 changes relate to a single bug, additional references are linked to numbers
 following the bug ID.
 </p>
 <h3
 id="eop-in-kernel-memory-subsystem">Elevation
 of privilege vulnerability in kernel memory subsystem</h3>
 <p>
 An elevation of privilege vulnerability in the kernel memory subsystem could
 enable a local malicious application to execute arbitrary code within the
 context of the kernel. This issue is rated as Critical due to the possibility of
 a local permanent device compromise, which may require reflashing the operating
 system to repair the device.
 </p>
 <p>
 <strong>Note:</strong> A security patch level of 2016-11-06 indicates that this
 issue, as well as all issues associated with 2016-11-01 and 2016-11-05 are
 addressed.
 </p>
 <table>
   <tr>
    <th>CVE</th>
    <th>References</th>
    <th>Severity</th>
    <th>Updated kernel versions</th>
    <th>Date reported</th>
   </tr>
   <tr>
    <td>CVE-2016-5195</td>
    <td>A-32141528<br>
 <a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=9691eac5593ff1e2f82391ad327f21d90322aec1">Upstream kernel</a>
 [<a href="https://git.kernel.org/cgit/linux/kernel/git/stable/linux-stable.git/commit/?id=e45a502bdeae5a075257c4f061d1ff4ff0821354">2</a>]</td>
    <td>Critical</td>
    <td>3.10, 3.18</td>
    <td>Oct 12, 2016</td>
   </tr>
 </table>
 <h2 id="common-questions-and-answers">Common Questions and Answers</h2>
 <p>
 This section answers common questions that may occur after reading this
 bulletin.
 </p>
 <p>
 <strong>1. How do I determine if my device is updated to address these issues?</strong>
 </p>
 <p>
 To learn how to check a device’s security patch level, read the instructions on the
 <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel
 and Nexus update schedule</a>.
 </p>
 <ul>
   <li>Security patch levels of 2016-11-01 or later address all issues associated
   with the 2016-11-01 security patch level.</li>
   <li>Security patch levels of 2016-11-05 or later address all issues associated
   with the 2016-11-05 security patch level and all previous patch levels.</li>
   <li>Security patch levels of 2016-11-06 or later address all issues associated
   with the 2016-11-06 security patch level and all previous patch
   levels.</li>
 </ul>
 <p>
 Device manufacturers that include these updates should set the patch level
 string to:
 </p>
 <ul>
   <li>[ro.build.version.security_patch]:[2016-11-01]</li>
   <li>[ro.build.version.security_patch]:[2016-11-05]</li>
   <li>[ro.build.version.security_patch]:[2016-11-06].</li>
 </ul>
 <p>
 <strong>2. Why does this bulletin have three security patch levels?</strong>
 </p>
 <p>
 This bulletin has three security patch levels so that Android partners have the
 flexibility to fix a subset of vulnerabilities that are similar across all
 Android devices more quickly. Android partners are encouraged to fix all issues
 in this bulletin and use the latest security patch level.
 </p>
 <ul>
   <li>Devices that use the November 1, 2016 security patch level must include all
   issues associated with that security patch level, as well as fixes for all
   issues reported in previous security bulletins.</li>
   <li>Devices that use the security patch level of November 5, 2016 or newer must
   include all applicable patches in this (and previous) security bulletins.</li>
   <li>Devices that use the security patch level of November 6, 2016 or newer must
   include all applicable patches in this (and previous) security
   bulletins.</li>
 </ul>
 <p>
 Partners are encouraged to bundle the fixes for all issues they are addressing
 in a single update.
 </p>
 <p id="google-devices">
 <strong>3. How do I determine which Google devices are affected by each
 issue?</strong>
 </p>
 <p>
 In the
 <a href="#2016-11-01-details">2016-11-01</a>,
 <a href="#2016-11-05-details">2016-11-05</a>,
 and
 <a href="#2016-11-06-details">2016-11-06</a>
 security vulnerability details sections, each table has an <em>Updated Google
 devices</em> column that covers the range of affected Google devices updated for
 each issue. This column has a few options:
 </p>
 <ul>
   <li><strong>All Google devices</strong>: If an issue affects all Nexus and Pixel
   devices, the table will have "All" in the <em>Updated Google devices</em>
   column. "All" encapsulates the following
   <a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported
   devices</a>: Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9,
   Android One, Nexus Player, Pixel C, Pixel, and Pixel XL.</li>
   <li><strong>Some Google devices</strong>: If an issue doesn't affect all Google
   devices, the affected Google devices are listed in the <em>Updated Google
   devices</em> column.</li>
   <li><strong>No Google devices</strong>: If no Google devices running Android 7.0
   are affected by the issue, the table will have "None" in the <em>Updated Google
   devices</em> column.</li>
 </ul>
 <p>
 <strong>4. What do the entries in the references column map to?</strong>
 </p>
 <p>
 Entries under the <em>References</em> column of the vulnerability details table
 may contain a prefix identifying the organization to which the reference value
 belongs. These prefixes map as follows:
 </p>
 <table>
   <tr>
    <th>Prefix</th>
    <th>Reference</th>
   </tr>
   <tr>
    <td>A-</td>
    <td>Android bug ID</td>
   </tr>
   <tr>
    <td>QC-</td>
    <td>Qualcomm reference number</td>
   </tr>
   <tr>
    <td>M-</td>
    <td>MediaTek reference number</td>
   </tr>
   <tr>
    <td>N-</td>
    <td>NVIDIA reference number</td>
   </tr>
   <tr>
    <td>B-</td>
    <td>Broadcom reference number</td>
   </tr>
 </table>

 <h2 id="revisions">Revisions</h2>
 <ul>
   <li>November 07, 2016: Bulletin published.</li>
   <li>November 08: Bulletin revised to include AOSP links and updated
       description for CVE-2016-6709.</li>
   <li>November 17: Bulletin revised to include attribution for CVE-2016-6828.</li>
   <li>December 21: Updated researcher credit.</li>
 </ul>

   </body>
 </html>