CVE-2016-1155

Published: Apr 13, 2017Modified: May 13, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

Affected (45)

Products: Google: Android

Google

1 product

Android

Configuration A

45 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 2.2.1
Google Android	Version 2.2.2
Google Android	Version 2.2.3
Google Android	Version 2.2
Google Android	Version 2.2 rev1
Google Android	Version 2.3.1
Google Android	Version 2.3.2
Google Android	Version 2.3.3
Google Android	Version 2.3.4
Google Android	Version 2.3.5
Google Android	Version 2.3.6
Google Android	Version 2.3.7
Google Android	Version 2.3
Google Android	Version 2.3 rev1
Google Android	Version 3.0
Google Android	Version 3.1
Google Android	Version 3.2.1
Google Android	Version 3.2.2
Google Android	Version 3.2.4
Google Android	Version 3.2.6
Google Android	Version 3.2
Google Android	Version 4.0.1
Google Android	Version 4.0.2
Google Android	Version 4.0.3
Google Android	Version 4.0.4
Google Android	Version 4.0
Google Android	Version 4.1.2
Google Android	Version 4.1
Google Android	Version 4.2.1
Google Android	Version 4.2.2
Google Android	Version 4.2
Google Android	Version 4.3.1
Google Android	Version 4.3
Google Android	Version 4.4.1
Google Android	Version 4.4.2
Google Android	Version 4.4.3
Google Android	Version 4.4.4
Google Android	Version 4.4
Google Android	Version 5.0.1
Google Android	Version 5.0.2
Google Android	Version 5.0
Google Android	Version 5.1.0
Google Android	Version 5.1.1
Google Android	Version 5.1
Google Android	Version 6.0