CVE-2016-1155 HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
CriticalCVSS 9.8
EPSS 1.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Android | = 2.2 | No fix listed |
| Google Android | = 2.2-rev1 | No fix listed |
| Google Android | = 2.2.1 | No fix listed |
| Google Android | = 2.2.2 | No fix listed |
| Google Android | = 2.2.3 | No fix listed |
| Google Android | = 2.3 | No fix listed |
| Google Android | = 2.3-rev1 | No fix listed |
| Google Android | = 2.3.1 | No fix listed |
| Google Android | = 2.3.2 | No fix listed |
| Google Android | = 2.3.3 | No fix listed |
| Google Android | = 2.3.4 | No fix listed |
| Google Android | = 2.3.5 | No fix listed |
| Google Android | = 2.3.6 | No fix listed |
| Google Android | = 2.3.7 | No fix listed |
| Google Android | = 3.0 | No fix listed |
| Google Android | = 3.1 | No fix listed |
| Google Android | = 3.2 | No fix listed |
| Google Android | = 3.2.1 | No fix listed |
| Google Android | = 3.2.2 | No fix listed |
| Google Android | = 3.2.4 | No fix listed |
| Google Android | = 3.2.6 | No fix listed |
| Google Android | = 4.0 | No fix listed |
| Google Android | = 4.0.1 | No fix listed |
| Google Android | = 4.0.2 | No fix listed |
| Google Android | = 4.0.3 | No fix listed |
Show 20 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Android | = 4.0.4 | No fix listed |
| Google Android | = 4.1 | No fix listed |
| Google Android | = 4.1.2 | No fix listed |
| Google Android | = 4.2 | No fix listed |
| Google Android | = 4.2.1 | No fix listed |
| Google Android | = 4.2.2 | No fix listed |
| Google Android | = 4.3 | No fix listed |
| Google Android | = 4.3.1 | No fix listed |
| Google Android | = 4.4 | No fix listed |
| Google Android | = 4.4.1 | No fix listed |
| Google Android | = 4.4.2 | No fix listed |
| Google Android | = 4.4.3 | No fix listed |
| Google Android | = 4.4.4 | No fix listed |
| Google Android | = 5.0 | No fix listed |
| Google Android | = 5.0.1 | No fix listed |
| Google Android | = 5.0.2 | No fix listed |
| Google Android | = 5.1 | No fix listed |
| Google Android | = 5.1.0 | No fix listed |
| Google Android | = 5.1.1 | No fix listed |
| Google Android | = 6.0 | No fix listed |
References
- 97662 third-party-advisory vdb-entry
- android.googlesource.com
- JVN#99757346 mitigation third-party-advisory vdb-entry