PT-2016-1865 · Google · Aosp Mail

Dzmitry Lukyanenka · Publicado 2016-05-09 · Atualizado 2016-05-10 · CVE-2016-2458

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AOSP Mail versions 5.0.0 through 5.0.1 AOSP Mail versions 5.1.0 AOSP Mail versions 6.0.0 through 2016-04-30

Description The compose functionality in AOSP Mail does not properly restrict attachments, allowing attackers to obtain sensitive information via a crafted application. This issue is related to ComposeActivity.java and ComposeActivityEmail.java.

Recommendations For AOSP Mail versions 5.0.0 through 5.0.1, update to version 5.0.2 or later. For AOSP Mail version 5.1.0, update to version 5.1.1 or later. For AOSP Mail versions 6.0.0 through 2016-04-30, ensure that updates after 2016-05-01 are applied. As a temporary workaround, consider restricting access to the compose functionality until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-01198

CVE-2016-2458

Produtos afetados

Aosp Mail

Referências · 6

• http://source.android.com/security/bulletin/2016-05-01.html · Aviso do Fabricante
• https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/a55168330d9326ff2120285763c818733590266a · Nota
• https://bdu.fstec.ru/vul/2016-01198 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-2458 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-2458 · Aviso do Fabricante
• https://android.googlesource.com/platform/packages/apps/Email/+/2791f0b33b610247ef87278862e66c6045f89693 · Nota