CVE-2016-2440

Published: May 9, 2016Modified: May 6, 2026

7.8

Vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.8 / Impact: 5.9

Source: NVD

Description

libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.

Affected (22)

Products: Google: Android

Google

1 product

Android

Configuration A

22 vulnerable

Vulnerable Software	Affected Versions
Google Android	Version 4.0.1
Google Android	Version 4.0.2
Google Android	Version 4.0.3
Google Android	Version 4.0.4
Google Android	Version 4.0
Google Android	Version 4.1.2
Google Android	Version 4.1
Google Android	Version 4.2.1
Google Android	Version 4.2.2
Google Android	Version 4.2
Google Android	Version 4.3.1
Google Android	Version 4.3
Google Android	Version 4.4.1
Google Android	Version 4.4.2
Google Android	Version 4.4.3
Google Android	Version 4.4
Google Android	Version 5.0.1
Google Android	Version 5.0
Google Android	Version 5.1.0
Google Android	Version 5.1
Google Android	Version 6.0.1
Google Android	Version 6.0

Related CWEs

CWE-264

References (4)

http://source.android.com/security/bulletin/2016-05-01.html

Source: security@android.com

Vendor Advisory

https://android.googlesource.com/platform/frameworks/native/+/a59b827869a2ea04022dd225007f29af8d61837a

Source: security@android.com

http://source.android.com/security/bulletin/2016-05-01.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://android.googlesource.com/platform/frameworks/native/+/a59b827869a2ea04022dd225007f29af8d61837a

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.