CVE-2016-6700: Critical severity Google Android vulnerability

Published Nov 7, 2016

Updated

An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30916186.

Affected Software

21 affected components

Google Android=4.0

Google Android=4.0.1

Google Android=4.0.2

Google Android=4.0.3

Google Android=4.0.4

Google Android=4.1

Google Android=4.1.2

Google Android=4.2

Google Android=4.2.1

Google Android=4.2.2

Google Android=4.3

Google Android=4.3.1

Google Android=4.4

Google Android=4.4.1

Google Android=4.4.2

Google Android=4.4.3

Google Android=5.0

Google Android=5.0.1

Google Android=5.1

Google Android=5.1.0

Google Android

Event History

Nov 7, 2016

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

Nov 25, 2016

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-6700?

CVE-2016-6700 is rated as Critical due to the potential for local malicious applications to execute arbitrary code with elevated privileges.

How do I fix CVE-2016-6700?

To mitigate CVE-2016-6700, update your Android device to versions Android 4.4.4, 5.0.2, or 5.1.1 or later.

What versions of Android are affected by CVE-2016-6700?

CVE-2016-6700 affects Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1.

Can CVE-2016-6700 be exploited remotely?

CVE-2016-6700 is a local elevation of privilege vulnerability and cannot be exploited remotely.

What components are involved in CVE-2016-6700?

CVE-2016-6700 specifically involves the libzipfile component in Android.