CVE-2016-6910: Infoleak

Published Dec 23, 2016

Updated

The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devices, but the vulnerability can persist on the device even after the device has been upgraded to an Android 5.1.1 or 6.0.1 build. The vulnerable system app gives a non-existent app the ability to read the notifications from the device, which a third-party app can utilize if it uses a package name of com.samsung.android.app.portalservicewidget. This vulnerability allows an unprivileged third-party app to obtain the text of the user's notifications, which tend to contain personal data.

Affected Software

3 affected components

Google Android=5.0.2

Google Android=5.1.1

Google Android=6.0.1

Event History

Dec 23, 2016

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-6910?

CVE-2016-6910 is classified as a vulnerability that can have significant impact due to unauthorized notification access.

How do I fix CVE-2016-6910?

To fix CVE-2016-6910, users are advised to update their device to the latest security patches or software version provided by the manufacturer.

What devices are affected by CVE-2016-6910?

CVE-2016-6910 affects Samsung Galaxy S6 Edge devices running Android versions 5.0.2, 5.1.1, and 6.0.1.

Can CVE-2016-6910 persist after an upgrade?

Yes, CVE-2016-6910 can persist on the device even after upgrading to newer Android versions.

What type of vulnerability is CVE-2016-6910?

CVE-2016-6910 is a notification listener vulnerability that allows unauthorized access to notifications on the affected devices.