CVE-2016-3840

Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153.

Affected Software

Name	Vendor	Start Version	End Version
Android	Google	4.0 (including)	4.0 (including)
Android	Google	4.0.1 (including)	4.0.1 (including)
Android	Google	4.0.2 (including)	4.0.2 (including)
Android	Google	4.0.3 (including)	4.0.3 (including)
Android	Google	4.0.4 (including)	4.0.4 (including)
Android	Google	4.1 (including)	4.1 (including)
Android	Google	4.1.2 (including)	4.1.2 (including)
Android	Google	4.2 (including)	4.2 (including)
Android	Google	4.2.1 (including)	4.2.1 (including)
Android	Google	4.2.2 (including)	4.2.2 (including)
Android	Google	4.3 (including)	4.3 (including)
Android	Google	4.3.1 (including)	4.3.1 (including)
Android	Google	4.4 (including)	4.4 (including)
Android	Google	4.4.1 (including)	4.4.1 (including)
Android	Google	4.4.2 (including)	4.4.2 (including)
Android	Google	4.4.3 (including)	4.4.3 (including)
Android	Google	5.0 (including)	5.0 (including)
Android	Google	5.0.1 (including)	5.0.1 (including)
Android	Google	5.1 (including)	5.1 (including)
Android	Google	5.1.0 (including)	5.1.0 (including)
Android	Google	6.0 (including)	6.0 (including)
Android	Google	6.0.1 (including)	6.0.1 (including)
Android	Ubuntu	esm-apps/xenial	*
Android	Ubuntu	trusty	*
Android	Ubuntu	vivid/stable-phone-overlay	*
Android	Ubuntu	xenial	*
Android	Ubuntu	yakkety	*
Android	Ubuntu	zesty	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2016-3840
CWE	https://cwe.mitre.org/data/definitions/264.html

Affected Software

References