U.S. flag   An official website of the United States government
Dot gov

Official websites use .gov
A .gov website belongs to an official government organization in the United States.

Https

Secure .gov websites use HTTPS
A lock (Dot gov) or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.

National Vulnerability Database

National Vulnerability Database

NVD

National Vulnerability Database
  1. VulnerabilitiesSearch And Statistics

Search Results (Refine Search)

Search Parameters:
  • Keyword (text search): android
There are 8,508 matching records.
Displaying matches 6,301 through 6,320.
Vuln ID Summary CVSS Severity
CVE-2016-2475

The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C devices allows attackers to gain privileges for certain system calls via a crafted application, aka internal bug 26425765.

Published: June 12, 2016; 9:59:14 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 6.8 MEDIUM
CVE-2016-2474

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 27424603.

Published: June 12, 2016; 9:59:13 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2473

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27777501.

Published: June 12, 2016; 9:59:12 PM -0400 		V4.0:(not available)
 V3.0: 9.8 CRITICAL
V2.0: 9.3 HIGH
CVE-2016-2472

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27776888.

Published: June 12, 2016; 9:59:11 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2471

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27773913.

Published: June 12, 2016; 9:59:10 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2470

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 27662174.

Published: June 12, 2016; 9:59:09 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2469

The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27531992.

Published: June 12, 2016; 9:59:08 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2468

The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted application, aka internal bug 27475454.

Published: June 12, 2016; 9:59:07 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2467

The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5 devices allows attackers to gain privileges via a crafted application, aka internal bug 28029010.

Published: June 12, 2016; 9:59:06 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2466

The Qualcomm sound driver in Android before 2016-06-01 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka internal bug 27947307.

Published: June 12, 2016; 9:59:05 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2465

The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 27407865.

Published: June 12, 2016; 9:59:04 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2464

libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726.

Published: June 12, 2016; 9:59:03 PM -0400 		V4.0:(not available)
 V3.0: 7.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-2463

Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419.

Published: June 12, 2016; 9:59:02 PM -0400 		V4.0:(not available)
 V3.0: 8.4 HIGH
V2.0: 7.5 HIGH
CVE-2016-2066

Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (memory corruption) via a crafted application that makes an ioctl call.

Published: June 12, 2016; 9:59:01 PM -0400 		V4.0:(not available)
 V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM
CVE-2016-2061

Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (array overflow and memory corruption) via a crafted application that triggers an msm_isp_axi_create_stream call.

Published: June 12, 2016; 9:59:00 PM -0400 		V4.0:(not available)
 V3.1: 7.8 HIGH
V2.0: 6.8 MEDIUM
CVE-2016-4783

Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98_ww on Android before 4.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, aka "Universal XSS (UXSS)."

Published: May 23, 2016; 3:59:13 PM -0400 		V4.0:(not available)
 V3.0: 6.1 MEDIUM
V2.0: 4.3 MEDIUM
CVE-2016-4782

Lenovo SHAREit before 3.5.98_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an "intent scheme URL attack."

Published: May 23, 2016; 3:59:12 PM -0400 		V4.0:(not available)
 V3.0: 8.8 HIGH
V2.0: 9.3 HIGH
CVE-2016-1671

Google Chrome before 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, which allows attackers to conduct directory traversal attacks via a file: URL, related to net/base/escape.cc and net/base/filename_util.cc.

Published: May 14, 2016; 5:59:11 PM -0400 		V4.0:(not available)
 V3.0: 8.1 HIGH
V2.0: 6.8 MEDIUM
CVE-2016-2462

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bug 27371173.

Published: May 09, 2016; 6:59:40 AM -0400 		V4.0:(not available)
 V3.0: 7.0 HIGH
V2.0: 7.6 HIGH
CVE-2016-2461

OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which allows attackers to spoof message authentication via unspecified vectors, aka internal bugs 27324690 and 27696681.

Published: May 09, 2016; 6:59:39 AM -0400 		V4.0:(not available)
 V3.0: 7.0 HIGH
V2.0: 7.6 HIGH