In this month's Nexus Security Bulletin, Android's de-facto security update, Google fixed 40 security bugs, 15 of which were labeled as critical, the company's highest security rating.
The most important change included with this release is an update Google announced through its first-ever Android Security Advisory, which it published on March 18.
This specific issue has to do with a security flaw discovered in Android devices running versions 4.4.4 and higher, and it would have allowed attackers to root the device, even permanently compromising it.
A quick patch was shipped to OEMs back in March, and now Google is delivering a better fix to prevent future exploitation of this issue.
Google fixes record number of security flaws
Besides this, Google also addressed multiple remote code execution (RCE) bugs in the DHCPCD service, in the Media Codec, and the almost standard monthly RCE fixes to the Mediaserver component and libstagefright library.
Additional patches for two other elevation of privilege issues rated as critical were also included for the Android Kernel and the Qualcomm Performance Module.
Probably the most intriguing of all the bugs is the one in the DHCPCD component, which allows malicious apps to leverage its deep integration with various internal Android features and execute code on unpatched devices within the context of the DHCP client, which most apps don't have.
Issue | CVE | Severity |
---|---|---|
Remote Code Execution Vulnerability in DHCPCD | CVE-2016-1503 CVE-2014-6060 |
Critical |
Remote Code Execution Vulnerability in Media Codec | CVE-2016-0834 | Critical |
Remote Code Execution Vulnerability in Mediaserver | CVE-2016-0835 CVE-2016-0836 CVE-2016-0837 CVE-2016-0838 CVE-2016-0839 CVE-2016-0840 CVE-2016-0841 |
Critical |
Remote Code Execution Vulnerability in libstagefright | CVE-2016-0842 | Critical |
Elevation of Privilege Vulnerability in Kernel | CVE-2015-1805 | Critical |
Elevation of Privilege Vulnerability in Qualcomm Performance Module |
CVE-2016-0843 | Critical |
Elevation of Privilege Vulnerability in Qualcomm RF Component | CVE-2016-0844 | Critical |
Elevation of Privilege Vulnerability in Kernel | CVE-2014-9322 | Critical |
Elevation of Privilege Vulnerability in IMemory Native Interface | CVE-2016-0846 | High |
Elevation of Privilege Vulnerability in Telecom Component | CVE-2016-0847 | High |
Elevation of Privilege Vulnerability in Download Manager | CVE-2016-0848 | High |
Elevation of Privilege Vulnerability in Recovery Procedure | CVE-2016-0849 | High |
Elevation of Privilege Vulnerability in Bluetooth | CVE-2016-0850 | High |
Elevation of Privilege Vulnerability in Texas Instruments Haptic Driver | CVE-2016-2409 | High |
Elevation of Privilege Vulnerability in a Video Kernel Driver | CVE-2016-2410 | High |
Elevation of Privilege Vulnerability in Qualcomm Power Management Component |
CVE-2016-2411 | High |
Elevation of Privilege Vulnerability in System_server | CVE-2016-2412 | High |
Elevation of Privilege Vulnerability in Mediaserver | CVE-2016-2413 | High |
Denial of Service Vulnerability in Minikin | CVE-2016-2414 | High |
Information Disclosure Vulnerability in Exchange ActiveSync | CVE-2016-2415 | High |
Information Disclosure Vulnerability in Mediaserver | CVE-2016-2416 CVE-2016-2417 CVE-2016-2418 CVE-2016-2419 |
High |
Elevation of Privilege Vulnerability in Debuggerd Component | CVE-2016-2420 | Moderate |
Elevation of Privilege Vulnerability in Setup Wizard | CVE-2016-2421 | Moderate |
Elevation of Privilege Vulnerability in Wi-Fi | CVE-2016-2422 | Moderate |
Elevation of Privilege Vulnerability in Telephony | CVE-2016-2423 | Moderate |
Denial of Service Vulnerability in SyncStorageEngine | CVE-2016-2424 | Moderate |
Information Disclosure Vulnerability in AOSP Mail | CVE-2016-2425 | Moderate |
Information Disclosure Vulnerability in Framework | CVE-2016-2426 | Moderate |
Information Disclosure Vulnerability in BouncyCastle | CVE-2016-2427 | Moderate |