Google fixes over 100 flaws in Android, many in chipset drivers

Manufacturers can choose between two patch levels, one dedicated to device-specific fixes

Google released a new batch of Android patches on Wednesday, fixing over 100 flaws in Android's own components and in chipset-specific drivers from different manufacturers.

Android's mediaserver component, which handles the processing of video and audio streams and has been a source of many vulnerabilities in the past, is at the forefront of this security update. It accounts for 16 Android vulnerabilities, including 7 critical flaws that can allow an attacker to execute code with higher privileges.

The bugs can be exploited by sending specifically crafted audio or video files to users' devices via the browser, email or messaging apps. Because of the repeated mediaserver flaws, Google Hangouts and the default Android Messenger applications no longer pass media to this component automatically.

Another critical vulnerability was fixed in the OpenSSL and BoringSSL crypto libraries that are bundled with the Android OS. This flaw can also be exploited through a specially crafted file to execute code within the context of the affected processes.

This month's security bulletin was split into two parts: one with patches that apply to all Android devices, and one with patches that apply only to devices that contain the affected chipset drivers.

Phone manufacturers will have the option to upgrade their phones to one of two patch levels: 2016-07-01, which includes device-agnostic fixes, and 2016-07-05, which includes the 2016-07-01 fixes plus the device-specific ones.

The patch level, expressed as a date string, is displayed in Android's settings under "About phone" and indicates that the firmware contains all Android security patches up to that date. It only exists in newer versions of Android.

The 2016-07-01 patch level includes fixes for 32 vulnerabilities: 8 rated critical, 15 of high severity and 9 moderate.

The 2016-07-05 security patch level includes additional fixes for a whooping 75 vulnerabilities that are marked as device-specific. Twelve of these vulnerabilities are rated critical and are located in highly privileged components such as the Qualcomm GPU driver, the MediaTek Wi-Fi driver, the Qualcomm performance component, the NVIDIA video driver, the kernel file system, the USB driver and other unspecified MediaTek drivers.

Because these drivers are loaded inside the kernel, the most privileged area of the operating system, the vulnerabilities can lead to a permanent device compromise that can only be fixed by reflashing the firmware.

Most of the other 54 high-severity flaws were also in various chipset drivers and can also lead to a complete device compromise. The difference is that the attacker needs to already have access to a privileged process in order to exploit them.

As usual, Google released firmware updates for all of its supported Nexus devices and will release the patches to the Android Open Source Project (AOSP) over the next 48 hours. Manufacturers and carriers that are Google's partners were notified about the patches included in this bulletin on June 6 or earlier.

Join the PC World newsletter!

Error: Please check your email address.

Tags Google

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?