CVE-2016-3752 - internal/app/ChooserActivity.java in the ChooserTarget service in Android 6.x before 2016-07-01 mish

CVE-2016-3752

Summary

internal/app/ChooserActivity.java in the ChooserTarget service in Android 6.x before 2016-07-01 mishandles target security checks, which allows attackers to gain privileges via a crafted application, aka internal bug 28384423.

References

http://source.android.com/security/bulletin/2016-07-01.html
https://android.googlesource.com/platform/frameworks/base/+/ddbf2db5b946be8fdc45c7b0327bf560b2a06988

Vulnerable Configurations

cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:6.0:*:*:*:*:*:*:*
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*
cpe:2.3:o:google:android:6.0.1:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 11-07-2016 - 18:30)
Impact:
Exploitability:

CWE

CWE-254

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

confirm

http://source.android.com/security/bulletin/2016-07-01.html
https://android.googlesource.com/platform/frameworks/base/+/ddbf2db5b946be8fdc45c7b0327bf560b2a06988

Last major update

11-07-2016 - 18:30

Published

11-07-2016 - 01:59

Last modified

11-07-2016 - 18:30