CVE-2016-6700 — INC Android vulnerability

CWE-2644 documents4 sources
Severity
7.8HIGHNVD
EPSS
0.1%
top 73.82%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Google INC AndroidGoogle Android
Timeline
PublishedNov 25
Latest updateMay 17

Description

An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30916186.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDgoogle/android20 versions+19
▶CVEListV5google_inc/androidAndroid-4.4.4, Android-5.0.2, Android-5.1.1+2

🔴Vulnerability Details

2
GHSA
GHSA-vqj3-j49q-xvx3: An elevation of privilege vulnerability in libzipfile in Android 4↗2022-05-17
▶
OSV
CVE-2016-6700: An elevation of privilege vulnerability in libzipfile in Android 4↗2016-11-25
▶

📋Vendor Advisories

1
Android
CVE-2016-6700: Android Security Bulletin 2016-11-01 CVE: CVE-2016-6700 Severity: CRITICAL Affected AOSP versions: 4↗2016-11-01
▶