CVE-2016-1155: Critical severity android vulnerability
Published Apr 13, 2017
·Updated
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
Affected Software
45 affected components
Google Android=2.2
Google Android=2.2-rev1
Google Android=2.2.1
Google Android=2.2.2
Google Android=2.2.3
Google Android=2.3
Google Android=2.3-rev1
Google Android=2.3.1
Google Android=2.3.2
Google Android=2.3.3
Google Android=2.3.4
Google Android=2.3.5
Google Android=2.3.6
Google Android=2.3.7
Google Android=3.0
Google Android=3.1
Google Android=3.2
Google Android=3.2.1
Google Android=3.2.2
Google Android=3.2.4
Google Android=3.2.6
Google Android=4.0
Google Android=4.0.1
Google Android=4.0.2
Google Android=4.0.3
Google Android=4.0.4
Google Android=4.1
Google Android=4.1.2
Google Android=4.2
Google Android=4.2.1
Google Android=4.2.2
Google Android=4.3
Google Android=4.3.1
Google Android=4.4
Google Android=4.4.1
Google Android=4.4.2
Google Android=4.4.3
Google Android=4.4.4
Google Android=5.0
Google Android=5.0.1
Google Android=5.0.2
Google Android=5.1
Google Android=5.1.0
Google Android=5.1.1
Google Android=6.0
Event History
Apr 13, 2017
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-1155?
CVE-2016-1155 is classified as a high severity vulnerability due to its potential for remote exploitation.
2
How do I fix CVE-2016-1155?
The recommended fix for CVE-2016-1155 is to update to a patched version of the Android OS that addresses the HTTP header injection vulnerability.
3
What versions of Android are affected by CVE-2016-1155?
CVE-2016-1155 affects Android OS versions from 2.2 to 6.0.
4
What impact does CVE-2016-1155 have on affected devices?
CVE-2016-1155 can allow attackers to execute arbitrary scripts or set malicious values in cookies on affected devices.
5
Can CVE-2016-1155 be exploited without user interaction?
Yes, CVE-2016-1155 can be exploited remotely without requiring user interaction, making it particularly dangerous.