CVE-2016-0847: High severity Google Android vulnerability

Published Apr 4, 2016

Updated

The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating telephone number of a call via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26864502.

Affected Software

7 affected components

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Google Android

Event History

Apr 4, 2016

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Apr 18, 2016

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2016-0847?

CVE-2016-0847 is categorized as a high-severity vulnerability that allows call spoofing.

How do I fix CVE-2016-0847?

To remediate CVE-2016-0847, update your Android device to a version later than 5.0.2, 5.1.1, or 6.0.1.

What versions of Android are affected by CVE-2016-0847?

CVE-2016-0847 affects Android versions 5.0, 5.0.1, 5.1, 5.1.0, 6.0, and 6.0.1.

Who can exploit CVE-2016-0847?

Attackers with access to a crafted application can exploit CVE-2016-0847 to spoof originating telephone numbers.

What is the impact of CVE-2016-0847?

The impact of CVE-2016-0847 is the potential for deception and fraud through phone call impersonation.