CVE-2016-0833

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors.

Unchecked public access permissions on a core Broadcast Receiver allow unauthorized local software components to invoke administrative operations.

A cryptographic issue while processing a specific partition allows unauthorized write access to load a customized bootloader.

In multiple functions of AppOpsService.java, there is a missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed.

In fixInitiatingUserIfNecessary of CallIntentProcessor.java, a logic error allows making an emergency call without proper privileges.

In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.

In multiple functions of DevicePolicyManagerService.java, a desync from persistence due to improper input validation could lead to local denial of service.

In the addWindow method of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed.