← Back

Android

android

Vendor: Google • 8,366 CVEs

CVEs (8,366)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2016-2459
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted...Show more
mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data structures, which allows attackers to obtain sensitive information via a crafted application, related to IGraphicBufferConsumer.cpp and IGraphicBufferProducer.cpp, aka internal bug 27556038.Show less
CVE-2016-2458
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
5.5 MEDIUM· v3
4.3 MEDIUM· v2
The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a cra...Show more
The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restrict attachments, which allows attackers to obtain sensitive information via a crafted application, related to ComposeActivity.java and ComposeActivityEmail.java, aka internal bug 27335139.Show less
CVE-2016-2457
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
5.5 MEDIUM· v3
2.1 LOW· v2
server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to bypass intended restrictions on Wi-Fi configuration changes by leveraging guest...Show more
server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to bypass intended restrictions on Wi-Fi configuration changes by leveraging guest access, aka internal bug 27411179.Show less
CVE-2016-2456
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
5.1 MEDIUM· v2
The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, aka internal bug 27275187.
CVE-2016-2454
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
5.5 MEDIUM· v3
7.1 HIGH· v2
The Qualcomm hardware video codec in Android before 2016-05-01 on Nexus 5 devices allows remote attackers to cause a denial of service (reboot) via a crafted file, aka internal bug 26221024.
CVE-2016-2452
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate buffer sizes, which allows attackers to gain...Show more
codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bugs 27662364 and 27843673.Show less
CVE-2016-2451
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers...Show more
codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate VPX output buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27597103.Show less
CVE-2016-2450
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers...Show more
codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate OMX buffer sizes, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27569635.Show less
CVE-2016-2449
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attack...Show more
services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not validate template IDs, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27568958.Show less
CVE-2016-2448
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structur...Show more
media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly validate entry data structures, which allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or SignatureOrSystem access, aka internal bug 27533704.Show less
CVE-2016-2446
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27441354.
CVE-2016-2445
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27253079.
CVE-2016-2444
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27208332.
CVE-2016-2443
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka internal bug 26404525.
CVE-2016-2442
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26494907.
CVE-2016-2441
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.0 HIGH· v3
7.6 HIGH· v2
The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted application, aka internal bug 26354602.
CVE-2016-2440
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafte...Show more
libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mishandles object references, which allows attackers to gain privileges via a crafted application, aka internal bug 27252896.Show less
CVE-2016-2439
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
8.8 HIGH· v3
5.4 MEDIUM· v2
Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, ak...Show more
Buffer overflow in btif/src/btif_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows remote attackers to execute arbitrary code via a long PIN value, aka internal bug 27411268.Show less
CVE-2016-2437
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27436822.
CVE-2016-2436
1Google
1Android
May 6, 2026
May 9, 2016
N/A· v4
7.8 HIGH· v3
9.3 HIGH· v2
The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 27299111.