CVE-2016-3832
HighSummary
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, allowing attackers to bypass an unspecified protection mechanism via a crafted application.
Risk Assessment
Organizations may be exposed to attacks that exploit this vulnerability to introduce malware, potentially leading to data loss or system security breaches.
Recommendation
It is recommended to update Android to the latest version to mitigate this vulnerability and to monitor applications installed on devices.
Other vulnerabilities in Android Framework
See all- CVE-2017-0667High
CVE-2017-0667 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0666High
CVE-2017-0666 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0665High
CVE-2017-0665 is a privilege escalation vulnerability in the Android framework. It affects versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
- CVE-2017-0664High
CVE-2017-0664 is a privilege escalation vulnerability in the Android framework. It affects versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2.
Original NVD description (English source)
The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package data originated from the Package Manager, which allows attackers to bypass an unspecified protection mechanism via a crafted application, aka internal bug 28795098.