U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): cpe:2.3:o:google:android:4.3.1:*:*:*:*:*:*:*
  • CPE Name Search: true
There are 1,427 matching records.
Displaying matches 801 through 820.
Vuln ID Summary CVSS Severity
CVE-2016-3792

CORE/HDD/src/wlan_hdd_hostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-07-05 on Nexus 7 (2013) devices mishandles userspace data copying, which allows attackers to gain privileges via a crafted application, aka Android internal bug 27725204 and Qualcomm internal bug CR561022.

Published: July 10, 2016; 10:00:17 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3775

The kernel filesystem implementation in Android before 2016-07-05 on Nexus 5X, Nexus 6, Nexus 6P, Nexus Player, and Pixel C devices allows attackers to gain privileges via a crafted application, aka internal bug 28588279.

Published: July 10, 2016; 10:00:16 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3774

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008609 and MediaTek internal bug ALPS02703102.

Published: July 10, 2016; 10:00:15 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3773

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008363 and MediaTek internal bug ALPS02703102.

Published: July 10, 2016; 10:00:14 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3772

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29008188 and MediaTek internal bug ALPS02703102.

Published: July 10, 2016; 10:00:13 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3771

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 29007611 and MediaTek internal bug ALPS02703102.

Published: July 10, 2016; 10:00:12 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3770

The MediaTek drivers in Android before 2016-07-05 on Android One devices allow attackers to gain privileges via a crafted application, aka Android internal bug 28346752 and MediaTek internal bug ALPS02703102.

Published: July 10, 2016; 10:00:12 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3769

The NVIDIA video driver in Android before 2016-07-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28376656.

Published: July 10, 2016; 10:00:10 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3768

The Qualcomm performance component in Android before 2016-07-05 on Nexus 5, 6, 5X, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28172137 and Qualcomm internal bug CR1010644.

Published: July 10, 2016; 10:00:09 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3767

The MediaTek Wi-Fi driver in Android before 2016-07-05 on Android One devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28169363 and MediaTek internal bug ALPS02689526.

Published: July 10, 2016; 10:00:08 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3766

MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not check whether memory allocation succeeds, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted file, aka internal bug 28471206.

Published: July 10, 2016; 10:00:07 PM -0400 		V4.0:(not available)
 V3.0: 7.5 HIGH
V2.0: 7.8 HIGH
CVE-2016-3764

media/libmediaplayerservice/MetadataRetrieverClient.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive pointer information via a crafted application, aka internal bug 28377502.

Published: July 10, 2016; 10:00:05 PM -0400 		V4.0:(not available)
 V3.0: 4.0 MEDIUM
V2.0: 5.0 MEDIUM
CVE-2016-3763

net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 27593919.

Published: July 10, 2016; 10:00:04 PM -0400 		V4.0:(not available)
 V3.0: 3.3 LOW
V2.0: 5.0 MEDIUM
CVE-2016-3761

NfcService.java in NFC in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to obtain sensitive foreground-application information via a crafted background application, aka internal bug 28300969.

Published: July 10, 2016; 10:00:02 PM -0400 		V4.0:(not available)
 V3.0: 4.0 MEDIUM
V2.0: 2.1 LOW
CVE-2016-3758

Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides a long filename, aka internal bug 27840771.

Published: July 10, 2016; 9:59:58 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-3757

The print_maps function in toolbox/lsof.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file, aka internal bug 28175237. NOTE: print_maps is not related to the Vic Abell lsof product.

Published: July 10, 2016; 9:59:57 PM -0400 		V4.0:(not available)
 V3.0: 7.0 HIGH
V2.0: 5.9 MEDIUM
CVE-2016-3756

Tremolo/res012.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the number of partitions, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28556125.

Published: July 10, 2016; 9:59:56 PM -0400 		V4.0:(not available)
 V3.0: 7.5 HIGH
V2.0: 7.8 HIGH
CVE-2016-3754

mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not limit process-memory usage, which allows remote attackers to cause a denial of service (device hang or reboot) via a crafted media file, aka internal bug 28615448.

Published: July 10, 2016; 9:59:54 PM -0400 		V4.0:(not available)
 V3.0: 7.5 HIGH
V2.0: 7.8 HIGH
CVE-2016-3753

mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors, aka internal bug 27210135.

Published: July 10, 2016; 9:59:53 PM -0400 		V4.0:(not available)
 V3.0: 7.5 HIGH
V2.0: 5.0 MEDIUM
CVE-2016-3751

Unspecified vulnerability in libpng before 1.6.20, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 23265085.

Published: July 10, 2016; 9:59:51 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 7.5 HIGH