CVE-2016-3907: Infoleak
An information disclosure vulnerability in Qualcomm components including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver in Android before 2016-11-05 could enable a local malicious application to access data outside of its permission levels. This issue is rated as Moderate because it first requires compromising a privileged process. Android ID: A-30593266. References: Qualcomm QC-CR#1054352.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Androidto a version that resolves this vulnerability.Patch A-30593266
Event History
Frequently Asked Questions
What must an attacker do before they can access protected data?
The attacker needs a malicious application running locally and must first compromise a privileged process. User interaction is also required according to the CVSS vector.
What is the potential impact if exploitation succeeds?
The issue can disclose data outside the malicious application's assigned permission levels. It affects confidentiality; integrity and availability impacts are not indicated.
How can I determine whether a device needs remediation?
Devices running Android versions before 2016-11-05 are identified as affected. Apply the available patch.