CVE-2016-0843: High severity Google Android vulnerability

Published Apr 4, 2016

Updated

The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197.

Affected Software

23 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Google Android

Remediation

Patch Available

http://source.android.com/security/bulletin/2016-04-02.html

Event History

Apr 4, 2016

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Apr 18, 2016

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0843?

CVE-2016-0843 has a moderate severity rating, allowing attackers to gain privileges on vulnerable Android devices.

How do I fix CVE-2016-0843?

To fix CVE-2016-0843, update your Android device to the latest version that addresses this vulnerability.

Which Android versions are affected by CVE-2016-0843?

CVE-2016-0843 affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before April 1, 2016.

What type of attack is associated with CVE-2016-0843?

CVE-2016-0843 is associated with attacks that utilize crafted applications to exploit privilege escalation vulnerabilities.

Is there a known workaround for CVE-2016-0843?

There are no documented workarounds for CVE-2016-0843; the best mitigation is to upgrade to a patched version of Android.