CVE-2016-3840: Critical severity android vulnerability

Published Aug 5, 2016

Updated

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153.

Affected Software

22 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android=6.0

Google Android=6.0.1

Remediation

Patch Available

https://android.googlesource.com/platform/external/conscrypt/+/5af5e93463f4333187e7e35f3bd2b846654aa214

Event History

Aug 5, 2016

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-3840?

CVE-2016-3840 is considered a critical vulnerability as it allows remote attackers to execute arbitrary code.

How do I fix CVE-2016-3840?

To mitigate CVE-2016-3840, users should update their Android devices to the latest version available, at least Android 4.4.4 or 5.0.2.

Which versions of Android are affected by CVE-2016-3840?

CVE-2016-3840 affects Android versions 4.x up to 6.x before the August 2016 security patch.

What types of attacks can exploit CVE-2016-3840?

CVE-2016-3840 can be exploited via unspecified vectors that allow remote code execution.

Is there a workaround for CVE-2016-3840?

There are no specific workarounds for CVE-2016-3840; the recommended action is to update your Android software.