New issue
Advanced search Search tips

Issue 683095 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Jan 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Security



Sign in to add a comment

CrOS: Vulnerability reported in sys-kernel/chromeos-kernel-3_18

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Jan 20 2017

Issue description

Automated analysis has detected that the following third party packages have had vulnerabilities publicly reported. 

NOTE: There may be several bugs listed below - in almost all cases, all bugs can be quickly addressed by upgrading to the latest version of the package.

Package Name: sys-kernel/chromeos-kernel-3_18
Package Version: [cpe:/o:linux:linux_kernel:3.18]

Advisory: CVE-2016-6758
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6758
  CVSS severity score: 9.3/10.0
  Confidence: high
  Description:

An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-30148882. References: QC-CR#1071731.
Advisory: CVE-2016-6759
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6759
  CVSS severity score: 9.3/10.0
  Confidence: high
  Description:

An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-29982686. References: QC-CR#1055766.
Advisory: CVE-2016-6760
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6760
  CVSS severity score: 9.3/10.0
  Confidence: high
  Description:

An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-29617572. References: QC-CR#1055783.
Advisory: CVE-2016-6761
  Details: https://vomit.googleplex.com/advisory?id=CVE/CVE-2016-6761
  CVSS severity score: 9.3/10.0
  Confidence: high
  Description:

An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-29421682. References: QC-CR#1055792.


 
Components: OS>Kernel
Labels: Security_Impact-Stable M-56 Security_Severity-High

Comment 2 by groeck@google.com, Jan 23 2017

Feel free to assign to me.

Owner: groeck@chromium.org
Status: Assigned (was: Untriaged)

Comment 4 by groeck@chromium.org, Jan 23 2017

Status: WontFix (was: Assigned)
Not kernel bugs and/or chromeos is not affected.


Project Member

Comment 5 by sheriffbot@chromium.org, May 2 2017

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment