Unscored CVE-2015-3854 EUVD-2015-3890GHSA-5h2j-c7x6-9xcq

packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER pe…

Published Aug 7, 2016 · Updated Aug 6, 2024 · Assigned by google_android

Description

packages/SystemUI/src/com/android/systemui/power/PowerNotificationWarnings.java in Android 5.x allows attackers to bypass a DEVICE_POWER permission requirement via a broadcast intent with the PNW.stopSaver action, aka internal bug 20918350.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 16.04 LTS	android	No fix yet	—

References

20160526 CVE-2015-3854 Battery permission leakage in Android mailing-list
20160526 Re: CVE-2015-3854 Battery permission leakage in Android mailing-list
https://android.googlesource.com/platform/frameworks/base/+/05e0705177d2078fa9f940ce6df723312cfab976