Google Fixes 74 Android Security Flaws with December Patches

[Exterminator]

Google Fixes 74 Android Security Flaws with December Patches

Google has rolled out two security patches for Android devices earlier this month that address a total of 74 vulnerabilities in the operating system, including 11 that are rated as critical.

Specifically, Google’s December 2016 security patching cycle included two different releases, each of which came with fixes that were aimed at both Google and other Android devices.

The so-called 2016-12-01 security patch level includes 5 different fixes aimed at vulnerabilities flagged as “high” severity and 6 others for moderate issues. There are two different remote code execution flaws patches with CVE-2016-5419, CVE-2016-5420, CVE-2016-5421, and CVE-2016-6768, two denial of service vulnerabilities, four elevation of privilege vulnerabilities, and two information disclosure holes.

It’s important to note that Android 7.0 or later is not affected by these vulnerabilities if they are already running the latest updates. On the other hand, the rest of the Android versions on the market, starting with 4.4 and ending with 6.0.1, are all targeted by these updates.

Then, there’s the 2016-12-05 security patch level, which comes with a bigger number of fixes. There are 58 patches included in this update, 11 of which are rated as critical, 33 as high, and 14 as medium severity risk.

Most of the vulnerabilities fixed with this update would allow for elevation of privilege and Google says that both its own devices and other Android phones and tablets on the market were exposed. Once again, all versions of Android starting with 4.4.4 should install the patches as soon as possible.

Eagerly-awaited patches
Two important patches are CVE-2016-4794 and CVE-2016-5195 which fix the Dirty COW security bug discovered on Linux and also affecting Android, allowing attackers to root devices and get full root access to local data. Google rates the bug as critical and fixes the patch on all its devices, starting with Pixel C, Pixel, Pixel XL, Nexus 5X, and Nexus 6P.

“An elevation of privilege vulnerability in the kernel memory subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device,” Google says.

Canonical has already patched the flaw in supported Ubuntu versions, and following this month’s Google patch cycle, no devices should be left vulnerable.

Android devices getting the update receive just a single OTA patch which then displays the December 05, 2016 security patch level on the About information screen.

 

[dJim]

so u mean all android terminals with from kit kat till 6.1 will get update? or again this only for high end..

 

[Paul Lee]

so u mean all android terminals with from kit kat till 6.1 will get update? or again this only for high end..

Only high end. Nothing on my nexus 7 2013 with android 6.0.1

 

[dJim]

hmm i still hate more the android politices they are wrost than windows lol.. u still can use windows 10 in very old pc while android force u to buy a new ( not cheap )phone if u want the lastest and to be " proteged"

 

[tim one]

Here according to Belarc Security Advisor report, that's normal situation about old devices.

Security vulnerabilities were detected on this device.

Samsung Gt-i9300
Android 4.3 Build JSS15J.I9300XXUGOE1

Security Advisor v1.0.27.1
Last scan: 08/dic/2016 17:08:03
Vulnerable software: 1
Total Vulnerabilities: 79

Vulnerable Software

Android OS / version 4.3
Vulnerabilities: 79
Severity: 52 High, 23 Moderate, 4 Low

 

[woomera]

as an owner of a Nexus 6 i gotta say im disappointed they left our device out of the update loop (for now ofc) but still good to see these monthly updates from a security perspective.

 

[Vipersd]

Nothing yet on Samsung J5 marshmallow.

 

[marzametal]

Hmmm, the first LineageOS build (7.1.1) for Samsung Galaxy S2 has Updates as of December 5th 2016... I wonder if it incorporated the above...

 

[SHvFl]

Too almost all phones will not get this updates anytime soon and most will never get it.