CVE-2016-6709: Infoleak
An information disclosure vulnerability in Conscrypt and BoringSSL in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a man-in-the-middle attacker to gain access to sensitive information if a non-standard cipher suite is used by an application. This issue is rated as High because it could be used to access data without permission. Android ID: A-31081987.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Android Conscrypt and BoringSSLto a version that resolves this vulnerability.Fixed in 2016-11-01
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6709?
CVE-2016-6709 is rated as High due to its potential to allow man-in-the-middle attackers to access sensitive information.
How do I fix CVE-2016-6709?
To fix CVE-2016-6709, update affected Android devices to Android 6.0.1 or later versions of 7.0 as released after November 1, 2016.
Which versions of Android are affected by CVE-2016-6709?
CVE-2016-6709 affects Android versions 6.x before 2016-11-01 and Android 7.0 before 2016-11-01.
What type of vulnerability is CVE-2016-6709?
CVE-2016-6709 is an information disclosure vulnerability found in Conscrypt and BoringSSL.
What could exploit CVE-2016-6709?
CVE-2016-6709 could be exploited by a man-in-the-middle attacker using a non-standard cipher suite.