PT-2016-1577
CVE-2016-0831
·
تاريخ النشر
2016-03-12
·
تاريخ التحديث
2016-11-28
الوصف من
CVSS 3.1
5.5
متوسطةالمقاييسAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions
Android versions 5.x through 5.1.1 LMY49H
Android versions 6.x through 2016-03-01
Description
The issue is related to the
getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java, which lacks protection of service data. This allows a remote attacker to obtain confidential information using a specially crafted application. The function does not check for the READ PHONE STATE permission.Recommendations
For Android versions 5.x through 5.1.1 LMY49H, update to version 5.1.1 LMY49H or later.
For Android versions 6.x through 2016-03-01, update to a version released after 2016-03-01.
As a temporary workaround, consider restricting access to the
getDeviceIdForPhone function until a patch is available. وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾