Comenzamos la primera semana de octubre y de nuevo, Google no pierde tiempo en cuanto al anuncio de nuevos huecos de seguridad cubiertos en favor de Android y todo esto en la víspera de la presentación de los Google Pixel y productos relacionados.
A solo un día de su gran día en favor de Android, Google anunció lo que está incluyendo la actualización de seguridad de Android documentado en el boletín de seguridad de Android y entre las mejoras notables, hay una vasta colección de problemas de elevaciones de privilegios o que simplemente, las aplicaciones pueden considerarse con privilegios administrativos aprovechando explotaciones de seguridad.
Al menos lo anterior cubre para el parcho con fecha del primero de octubre y Google en lista las mejoras como sigue:
Issue CVE Severity Affects Nexus? Elevation of privilege vulnerability in ServiceManager CVE-2016-3900 High Yes Elevation of privilege vulnerability in Lock Settings Service CVE-2016-3908 High Yes Elevation of privilege vulnerability in Mediaserver CVE-2016-3909, CVE-2016-3910, CVE-2016-3913 High Yes Elevation of privilege vulnerability in Zygote process CVE-2016-3911 High Yes Elevation of privilege vulnerability in framework APIs CVE-2016-3912 High Yes Elevation of privilege vulnerability in Telephony CVE-2016-3914 High Yes Elevation of privilege vulnerability in Camera service CVE-2016-3915, CVE-2016-3916 High Yes Elevation of privilege vulnerability in fingerprint login CVE-2016-3917 High Yes Information disclosure vulnerability in AOSP Mail CVE-2016-3918 High Yes Denial of service vulnerability in Wi-Fi CVE-2016-3882 High Yes Denial of service vulnerability in GPS CVE-2016-5348 High Yes Denial of service vulnerability in Mediaserver CVE-2016-3920 High Yes Elevation of privilege vulnerability in Framework Listener CVE-2016-3921 Moderate Yes Elevation of privilege vulnerability in Telephony CVE-2016-3922 Moderate Yes Elevation of privilege vulnerability in Accessibility services CVE-2016-3923 Moderate Yes Information disclosure vulnerability in Mediaserver CVE-2016-3924 Moderate Yes Denial of service vulnerability in Wi-Fi CVE-2016-3925 Moderate Yes
Por otra parte, la siguiente, es la lista de las mejoras de seguridad con fecha del 5 de octubre donde podemos notar una falla de seguridad a nivel de kernel donde puede ejecutarse controles remotos de equipos Android.
Issue CVE Severity Affects Nexus? Remote code execution vulnerability in kernel ASN.1 decoder CVE-2016-0758 Critical Yes Remote code execution vulnerability in kernel networking subsystem CVE-2016-7117 Critical Yes Elevation of privilege vulnerability in MediaTek video driver CVE-2016-3928 Critical No Elevation of privilege vulnerability in kernel shared memory driver CVE-2016-5340 Critical Yes Vulnerabilities in Qualcomm components CVE-2016-3926, CVE-2016-3927, CVE-2016-3929 Critical Yes Elevation of privilege vulnerability in Qualcomm networking component CVE-2016-2059 High Yes Elevation of privilege vulnerability in NVIDIA MMC test driver CVE-2016-3930 High Yes Elevation of privilege vulnerability in Qualcomm Secure Execution Environment Communicator driver CVE-2016-3931 High Yes Elevation of privilege vulnerability in Mediaserver CVE-2016-3932, CVE-2016-3933 High Yes Elevation of privilege vulnerability in Qualcomm camera driver CVE-2016-3903, CVE-2016-3934 High Yes Elevation of privilege vulnerability in Qualcomm sound driver CVE-2015-8951 High Yes Elevation of privilege vulnerability in Qualcomm crypto engine driver CVE-2016-3901, CVE-2016-3935 High No Elevation of privilege vulnerability in MediaTek video driver CVE-2016-3936, CVE-2016-3937 High Yes Elevation of privilege vulnerability in Qualcomm video driver CVE-2016-3938, CVE-2016-3939 High Yes Elevation of privilege vulnerability in Synaptics touchscreen driver CVE-2016-3940, CVE-2016-6672 High Yes Elevation of privilege vulnerability in NVIDIA camera driver CVE-2016-6673 High Yes Elevation of privilege vulnerability in system_server CVE-2016-6674 High Yes Elevation of privilege vulnerability in Qualcomm Wi-Fi driver CVE-2016-3905, CVE-2016-6675, CVE-2016-6676, CVE-2016-5342 High Yes Elevation of privilege vulnerability in kernel performance subsystem CVE-2015-8955 High Yes Information disclosure vulnerability in kernel ION subsystem CVE-2015-8950 High Yes Information disclosure vulnerability in NVIDIA GPU driver CVE-2016-6677 High Yes Elevation of privilege vulnerability in Qualcomm character driver CVE-2015-0572 Moderate Yes Information disclosure vulnerability in Qualcomm sound driver CVE-2016-3860 Moderate Yes Information disclosure vulnerability in Motorola USBNet driver CVE-2016-6678 Moderate Yes Information disclosure vulnerability in Qualcomm components CVE-2016-6679, CVE-2016-3902, CVE-2016-6680, CVE-2016-6681, CVE-2016-6682 Moderate Yes Information disclosure vulnerability in kernel components CVE-2016-6683, CVE-2016-6684, CVE-2015-8956, CVE-2016-6685 Moderate Yes Information disclosure vulnerability in NVIDIA profiler CVE-2016-6686, CVE-2016-6687, CVE-2016-6688 Moderate Yes Information disclosure vulnerability in kernel CVE-2016-6689 Moderate Yes Denial of service vulnerability in kernel networking subsystem CVE-2016-5696 Moderate Yes Denial of service vulnerability in kernel sound driver CVE-2016-6690 Low Yes Vulnerabilities in Qualcomm components CVE-2016-6691, CVE-2016-6692, CVE-2016-6693, CVE-2016-6694, CVE-2016-6695, CVE-2016-6696, CVE-2016-5344, CVE-2016-5343 High No
La actualización incluye a los equipos Google Nexus Player, 5X, 6P, 9 (Wi-Fi) y el Pixel C que debe ya estar circulando desde esta tarde.
