# CVEs published 2016-09-11

61 CVEs were published on September 11, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-3858](https://cve.now/CVE-2016-3858.md): Buffer overflow in drivers/soc/qcom/subsystem\_restart.c in the Qualcomm subsystem driver in Android before 2016-09-05 on Nexus 5X and 6P dev (no CVSS)
- [CVE-2016-3859](https://cve.now/CVE-2016-3859.md): The Qualcomm camera driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted (no CVSS)
- [CVE-2016-3861](https://cve.now/CVE-2016-3861.md): LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles co (no CVSS)
- [CVE-2016-3862](https://cve.now/CVE-2016-3862.md): media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does (no CVSS)
- [CVE-2016-3863](https://cve.now/CVE-2016-3863.md): Multiple stack-based buffer overflows in the AVCC reassembly implementation in Utils.cpp in libstagefright in MediaMuxer in Android 4.x befo (no CVSS)
- [CVE-2016-3864](https://cve.now/CVE-2016-3864.md): The Qualcomm radio interface layer in Android before 2016-09-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices allows atta (no CVSS)
- [CVE-2016-3865](https://cve.now/CVE-2016-3865.md): The Synaptics touchscreen driver in Android before 2016-09-05 on Nexus 5X and 9 devices allows attackers to gain privileges via a crafted ap (no CVSS)
- [CVE-2016-3866](https://cve.now/CVE-2016-3866.md): The Qualcomm sound driver in Android before 2016-09-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted appl (no CVSS)
- [CVE-2016-3867](https://cve.now/CVE-2016-3867.md): The Qualcomm IPA driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted applicatio (no CVSS)
- [CVE-2016-3868](https://cve.now/CVE-2016-3868.md): The Qualcomm power driver in Android before 2016-09-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted applicat (no CVSS)
- [CVE-2016-3869](https://cve.now/CVE-2016-3869.md): The Broadcom Wi-Fi driver in Android before 2016-09-05 on Nexus 5, Nexus 6, Nexus 6P, Nexus 9, Nexus Player, and Pixel C devices allows atta (no CVSS)
- [CVE-2016-3870](https://cve.now/CVE-2016-3870.md): omx/SimpleSoftOMXComponent.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x bef (no CVSS)
- [CVE-2016-3871](https://cve.now/CVE-2016-3871.md): Multiple buffer overflows in codecs/mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1 (no CVSS)
- [CVE-2016-3872](https://cve.now/CVE-2016-3872.md): Buffer overflow in codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before (no CVSS)
- [CVE-2016-3873](https://cve.now/CVE-2016-3873.md): The NVIDIA kernel in Android before 2016-09-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka interna (no CVSS)
- [CVE-2016-3874](https://cve.now/CVE-2016-3874.md): CORE/HDD/src/wlan\_hdd\_wext.c in the Qualcomm Wi-Fi driver in Android before 2016-09-05 on Nexus 5X devices does not properly validate the ar (no CVSS)
- [CVE-2016-3875](https://cve.now/CVE-2016-3875.md): server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW\_SAFE\_BOOT setting, which allows physicall (no CVSS)
- [CVE-2016-3876](https://cve.now/CVE-2016-3876.md): providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to (no CVSS)
- [CVE-2016-3877](https://cve.now/CVE-2016-3877.md): Unspecified vulnerability in Android before 2016-09-01 has unknown impact and attack vectors. (no CVSS)
- [CVE-2016-3878](https://cve.now/CVE-2016-3878.md): decoder/ih264d\_api.c in mediaserver in Android 6.x before 2016-09-01 mishandles the case of decoding zero MBs, which allows remote attackers (no CVSS)
- [CVE-2016-3879](https://cve.now/CVE-2016-3879.md): arm-wt-22k/lib\_src/eas\_mdls.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 (no CVSS)
- [CVE-2016-3880](https://cve.now/CVE-2016-3880.md): Multiple buffer overflows in rtsp/ASessionDescription.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, (no CVSS)
- [CVE-2016-3881](https://cve.now/CVE-2016-3881.md): The decoder\_peek\_si\_internal function in vp9/vp9\_dx\_iface.c in libvpx in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x (no CVSS)
- [CVE-2016-3883](https://cve.now/CVE-2016-3883.md): internal/telephony/SMSDispatcher.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-0 (no CVSS)
- [CVE-2016-3884](https://cve.now/CVE-2016-3884.md): server/notification/NotificationManagerService.java in the Notification Manager Service in Android 6.x before 2016-09-01 and 7.0 before 2016 (no CVSS)
- [CVE-2016-3885](https://cve.now/CVE-2016-3885.md): debuggerd/debuggerd.cpp in Debuggerd in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mis (no CVSS)
- [CVE-2016-3886](https://cve.now/CVE-2016-3886.md): systemui/statusbar/phone/QuickStatusBarHeader.java in the System UI Tuner in Android 7.0 before 2016-09-01 does not prevent tuner changes on (no CVSS)
- [CVE-2016-3887](https://cve.now/CVE-2016-3887.md): providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOW\_CONFIG\_VPN setting, which a (no CVSS)
- [CVE-2016-3888](https://cve.now/CVE-2016-3888.md): internal/telephony/SMSDispatcher.java in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 be (no CVSS)
- [CVE-2016-3889](https://cve.now/CVE-2016-3889.md): Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the Factory Reset Protection protect (no CVSS)
- [CVE-2016-3890](https://cve.now/CVE-2016-3890.md): The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, a (no CVSS)
- [CVE-2016-3892](https://cve.now/CVE-2016-3892.md): The Qualcomm SPMI driver in Android before 2016-09-05 on Nexus 5, 5X, 6, and 6P devices allows attackers to obtain sensitive information via (no CVSS)
- [CVE-2016-3893](https://cve.now/CVE-2016-3893.md): The wcdcal\_hwdep\_ioctl\_shared function in sound/soc/codecs/wcdcal-hwdep.c in the Qualcomm sound codec in Android before 2016-09-05 on Nexus (no CVSS)
- [CVE-2016-3894](https://cve.now/CVE-2016-3894.md): The Qualcomm DMA component in Android before 2016-09-05 on Nexus 6 devices allows attackers to obtain sensitive information via a crafted ap (no CVSS)
- [CVE-2016-3895](https://cve.now/CVE-2016-3895.md): Integer overflow in the Region::unflatten function in libs/ui/Region.cpp in mediaserver in Android 6.x before 2016-09-01 and 7.0 before 2016 (no CVSS)
- [CVE-2016-3896](https://cve.now/CVE-2016-3896.md): AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 allows attackers to obtain sensitiv (no CVSS)
- [CVE-2016-3897](https://cve.now/CVE-2016-3897.md): The WifiEnterpriseConfig class in net/wifi/WifiEnterpriseConfig.java in Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before (no CVSS)
- [CVE-2016-3898](https://cve.now/CVE-2016-3898.md): Telephony in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 allows attackers to cause a de (no CVSS)
- [CVE-2016-3899](https://cve.now/CVE-2016-3899.md): OMXCodec.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, an (no CVSS)
- [CVE-2016-5147](https://cve.now/CVE-2016-5147.md): Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles deferred page loads, wh (no CVSS)
- [CVE-2016-5148](https://cve.now/CVE-2016-5148.md): Cross-site scripting (XSS) vulnerability in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 (no CVSS)
- [CVE-2016-5149](https://cve.now/CVE-2016-5149.md): The extensions subsystem in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME sourc (no CVSS)
- [CVE-2016-5150](https://cve.now/CVE-2016-5150.md): WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and bef (no CVSS)
- [CVE-2016-5151](https://cve.now/CVE-2016-5151.md): PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux mishandles timers, which allows remote atta (no CVSS)
- [CVE-2016-5152](https://cve.now/CVE-2016-5152.md): Integer overflow in the opj\_tcd\_get\_decoded\_tile\_size function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 (no CVSS)
- [CVE-2016-5153](https://cve.now/CVE-2016-5153.md): The Web Animations implementation in Blink, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linu (no CVSS)
- [CVE-2016-5154](https://cve.now/CVE-2016-5154.md): Multiple heap-based buffer overflows in PDFium, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on (no CVSS)
- [CVE-2016-5155](https://cve.now/CVE-2016-5155.md): Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly validate access to the initial docu (no CVSS)
- [CVE-2016-5156](https://cve.now/CVE-2016-5156.md): extensions/renderer/event\_bindings.cc in the event bindings in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 (no CVSS)
- [CVE-2016-5157](https://cve.now/CVE-2016-5157.md): Heap-based buffer overflow in the opj\_dwt\_interleave\_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 (no CVSS)
- [CVE-2016-5158](https://cve.now/CVE-2016-5158.md): Multiple integer overflows in the opj\_tcd\_init\_tile function in tcd.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on (no CVSS)
- [CVE-2016-5159](https://cve.now/CVE-2016-5159.md): Multiple integer overflows in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 o (no CVSS)
- [CVE-2016-5160](https://cve.now/CVE-2016-5160.md): The AllowCrossRendererResourceLoad function in extensions/browser/url\_request\_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS (no CVSS)
- [CVE-2016-5161](https://cve.now/CVE-2016-5161.md): The EditingStyle::mergeStyle function in WebKit/Source/core/editing/EditingStyle.cpp in Blink, as used in Google Chrome before 53.0.2785.89 (no CVSS)
- [CVE-2016-5162](https://cve.now/CVE-2016-5162.md): The AllowCrossRendererResourceLoad function in extensions/browser/url\_request\_util.cc in Google Chrome before 53.0.2785.89 on Windows and OS (no CVSS)
- [CVE-2016-5163](https://cve.now/CVE-2016-5163.md): The bidirectional-text implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not ens (no CVSS)
- [CVE-2016-5164](https://cve.now/CVE-2016-5164.md): Cross-site scripting (XSS) vulnerability in WebKit/Source/platform/v8\_inspector/V8Debugger.cpp in Blink, as used in Google Chrome before 53. (no CVSS)
- [CVE-2016-5165](https://cve.now/CVE-2016-5165.md): Cross-site scripting (XSS) vulnerability in the Developer Tools (aka DevTools) subsystem in Google Chrome before 53.0.2785.89 on Windows and (no CVSS)
- [CVE-2016-5166](https://cve.now/CVE-2016-5166.md): The download implementation in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux does not properly rest (no CVSS)
- [CVE-2016-5167](https://cve.now/CVE-2016-5167.md): Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux allow attacke (no CVSS)
- [CVE-2016-7395](https://cve.now/CVE-2016-7395.md): SkPath.cpp in Skia, as used in Google Chrome before 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, does not properly val (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-09-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.