CVE-2016-0849

Published: Apr 18, 2016Modified: May 6, 2026

8.4

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.5 / Impact: 5.9

Source: NVD

Description

Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allow attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 26960931.

Affected (6)

Products: Google: Android

Google

1 product

Android

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 5.0.1
Google Android	Version 5.0
Google Android	Version 5.1.0
Google Android	Version 5.1
Google Android	Version 6.0.1
Google Android	Version 6.0

Related CWEs

CWE-189

References (4)

http://source.android.com/security/bulletin/2016-04-02.html

Source: security@android.com

PatchVendor Advisory

https://android.googlesource.com/platform/bootable/recovery/+/28a566f7731b4cb76d2a9ba16d997ac5aeb07dad

Source: security@android.com

http://source.android.com/security/bulletin/2016-04-02.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

https://android.googlesource.com/platform/bootable/recovery/+/28a566f7731b4cb76d2a9ba16d997ac5aeb07dad

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.