PT-2016-1865 · Google · Aosp Mail

Dzmitry Lukyanenka · Published 2016-05-09 · Updated 2016-05-10 · CVE-2016-2458

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AOSP Mail versions 5.0.0 through 5.0.1 AOSP Mail versions 5.1.0 AOSP Mail versions 6.0.0 through 2016-04-30

Description The compose functionality in AOSP Mail does not properly restrict attachments, allowing attackers to obtain sensitive information via a crafted application. This issue is related to ComposeActivity.java and ComposeActivityEmail.java.

Recommendations For AOSP Mail versions 5.0.0 through 5.0.1, update to version 5.0.2 or later. For AOSP Mail version 5.1.0, update to version 5.1.1 or later. For AOSP Mail versions 6.0.0 through 2016-04-30, ensure that updates after 2016-05-01 are applied. As a temporary workaround, consider restricting access to the compose functionality until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01198

CVE-2016-2458

Affected Products

Aosp Mail

References · 6

• http://source.android.com/security/bulletin/2016-05-01.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01198 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-2458 · Security Note
• https://osv.dev/vulnerability/CVE-2016-2458 · Vendor Advisory
• https://android.googlesource.com/platform/packages/apps/UnifiedEmail/+/a55168330d9326ff2120285763c818733590266a · Note
• https://android.googlesource.com/platform/packages/apps/Email/+/2791f0b33b610247ef87278862e66c6045f89693 · Note