CVE-2016-2423

server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider whether a device is provisioned, which allows physically proximate attackers to bypass the Factory Reset Protection protection mechanism and delete data via unspecified vectors, aka internal bug 26303187.

Affected Software

Name	Vendor	Start Version	End Version
Android	Google	4.0 (including)	4.0 (including)
Android	Google	4.0.1 (including)	4.0.1 (including)
Android	Google	4.0.2 (including)	4.0.2 (including)
Android	Google	4.0.3 (including)	4.0.3 (including)
Android	Google	4.0.4 (including)	4.0.4 (including)
Android	Google	4.1 (including)	4.1 (including)
Android	Google	4.1.2 (including)	4.1.2 (including)
Android	Google	4.2 (including)	4.2 (including)
Android	Google	4.2.1 (including)	4.2.1 (including)
Android	Google	4.2.2 (including)	4.2.2 (including)
Android	Google	4.3 (including)	4.3 (including)
Android	Google	4.3.1 (including)	4.3.1 (including)
Android	Google	4.4 (including)	4.4 (including)
Android	Google	4.4.1 (including)	4.4.1 (including)
Android	Google	4.4.2 (including)	4.4.2 (including)
Android	Google	4.4.3 (including)	4.4.3 (including)
Android	Google	5.0 (including)	5.0 (including)
Android	Google	5.0.1 (including)	5.0.1 (including)
Android	Google	5.1 (including)	5.1 (including)
Android	Google	5.1.0 (including)	5.1.0 (including)
Android	Google	6.0 (including)	6.0 (including)
Android	Google	6.0.1 (including)	6.0.1 (including)
Android	Ubuntu	esm-apps/xenial	*
Android	Ubuntu	trusty	*
Android	Ubuntu	upstream	*
Android	Ubuntu	vivid/stable-phone-overlay	*
Android	Ubuntu	wily	*
Android	Ubuntu	xenial	*
Android	Ubuntu	yakkety	*
Android	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-2423
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References