diff options
| author | Android Partner Docs <noreply@android.com> | 2018-06-07 14:07:35 -0700 |
|---|---|---|
| committer | Clay Murphy <claym@google.com> | 2018-06-07 18:10:12 -0700 |
| commit | f040e4dca8700012b3c2c066b65938f22fbad859 (patch) | |
| tree | 6fccd2c090282b8e0485f4843a4eda938c31b386 /en | |
| parent | c7c9dc7ca43c195850e71ac37aa0f5722c891c59 (diff) | |
| download | source.android.com-f040e4dca8700012b3c2c066b65938f22fbad859.tar.gz | |
Docs: Changes to source.android.com
- 199692707 Added asterisk to A-63144992, made H3 ID unique, updated ... by Android Partner Docs <noreply@android.com>
- 199691762 Devsite localized content from translation request 921712. by Android Partner Docs <noreply@android.com>
- 199658664 Fix BroadcastRecord -> BroadcastFilter by Christina Nguyen <cqn@google.com>
- 199567406 June Security Bulletins - updated with AOSP links. by Android Partner Docs <noreply@android.com>
- 199317483 Fix spelling: opague -> opaque. by Android Partner Docs <noreply@android.com>
- 199308052 Devsite localized content from translation request 934248. by Android Partner Docs <noreply@android.com>
- 199308045 Devsite localized content from translation request 934243. by Android Partner Docs <noreply@android.com>
- 199304831 b/74947856 has just been reassessed as RCE Critical by Android Partner Docs <noreply@android.com>
- 199304768 Update build numbers for 2018/06 releases by Android Partner Docs <noreply@android.com>
- 199304498 Point to the malloc_hooks docs too. by Android Partner Docs <noreply@android.com>
- 199190981 67712323 is a dupe of 66734153. A-67712323 is now removed... by Android Partner Docs <noreply@android.com>
- 199188534 Remove #type typo in bulletins by Danielle Roberts <daroberts@google.com>
- 199179248 Minor updates to June public bulletin by Android Partner Docs <noreply@android.com>
- 199152002 Android and Pixel Security Bulletins - June 2018 by Android Partner Docs <noreply@android.com>
- 199149681 Devsite localized content from translation request 925774. by Android Partner Docs <noreply@android.com>
- 198939105 Devsite localized content from translation request 929126. by Android Partner Docs <noreply@android.com>
- 198775873 Remove erroneous "key" by Christina Nguyen <cqn@google.com>
- 198758023 Publish March Pixel bulletin link in index file by Danielle Roberts <daroberts@google.com>
- 198757987 Correct bulletin with missing * by Danielle Roberts <daroberts@google.com>
- 198757969 Add missing * to bulletin by Danielle Roberts <daroberts@google.com>
- 198726709 Devsite localized content from translation request 929128. by Android Partner Docs <noreply@android.com>
- 198724418 Mention libmemunreachable. by Android Partner Docs <noreply@android.com>
PiperOrigin-RevId: 199692707
Change-Id: I1658d057a06abfb5e6dfabb17e83c241facc2222
Diffstat (limited to 'en')
| -rw-r--r-- | en/devices/architecture/hidl/versioning.html | 2 | ||||
| -rw-r--r-- | en/devices/tech/debug/native-memory.html | 17 | ||||
| -rw-r--r-- | en/security/_toc.yaml | 4 | ||||
| -rw-r--r-- | en/security/authentication/index.html | 2 | ||||
| -rw-r--r-- | en/security/bulletin/2017-01-01.html | 2 | ||||
| -rw-r--r-- | en/security/bulletin/2017-04-01.html | 2 | ||||
| -rw-r--r-- | en/security/bulletin/2018-06-01.html | 951 | ||||
| -rw-r--r-- | en/security/bulletin/2018.html | 16 | ||||
| -rw-r--r-- | en/security/bulletin/index.html | 15 | ||||
| -rw-r--r-- | en/security/bulletin/pixel/2018-06-01.html | 937 | ||||
| -rw-r--r-- | en/security/bulletin/pixel/2018.html | 15 | ||||
| -rw-r--r-- | en/security/bulletin/pixel/index.html | 17 | ||||
| -rw-r--r-- | en/security/overview/acknowledgements.html | 508 | ||||
| -rw-r--r-- | en/setup/contribute/read-bug-reports.html | 2 | ||||
| -rw-r--r-- | en/setup/start/build-numbers.html | 24 |
15 files changed, 2336 insertions, 178 deletions
diff --git a/en/devices/architecture/hidl/versioning.html b/en/devices/architecture/hidl/versioning.html index 52552f0c..c67910d9 100644 --- a/en/devices/architecture/hidl/versioning.html +++ b/en/devices/architecture/hidl/versioning.html @@ -142,7 +142,7 @@ semantic names and meaning.</li> <li>Can be opaque data (such as public keys, ids, etc.) if necessary.</li> </ul> -<p>If opague data is used, it must be read only by one side of the HIDL +<p>If opaque data is used, it must be read only by one side of the HIDL interface. For example, if <code>vendor.img</code> code gives a component on the <code>system.img</code> a string message or <code>vec<uint8_t></code> data, that data cannot be parsed by the <code>system.img</code> itself; it can diff --git a/en/devices/tech/debug/native-memory.html b/en/devices/tech/debug/native-memory.html index afa0d220..df25f6b0 100644 --- a/en/devices/tech/debug/native-memory.html +++ b/en/devices/tech/debug/native-memory.html @@ -39,13 +39,28 @@ href="https://android.googlesource.com/platform/bionic/+/master/libc/malloc_debu Memory Tracking using libc Callbacks</a> for a thorough description of the debugging options available for native memory issues.</p> +<h2 id="libmemunreachable">libmemunreachable</h2> + +<p>Android's libmemunreachable is a zero-overhead native memory leak detector. +It uses an imprecise mark-and-sweep garbage collector pass over all native memory, +reporting any unreachable blocks as leaks. See the +<a href="https://android.googlesource.com/platform/system/core/+/master/libmemunreachable/README.md">libmemunreachable +documentation</a> for usage instructions.</p> + +<h2 id="malloc_hooks">Malloc hooks</h2> + +<p>If you want to build your own tools, Android's libc also supports intercepting all +allocation/free calls that happen during program execution. See the +<a href="https://android.googlesource.com/platform/bionic/+/master/libc/malloc_hooks/README.md">malloc_hooks +documentation</a> for usage instructions.</p> + <h2 id="malloc-stats">Malloc statistics</h2> <p> Android supports the <a href="http://man7.org/linux/man-pages/man3/mallinfo.3.html" ><code>mallinfo(3)</code></a>and <a href="http://man7.org/linux/man-pages/man3/malloc_info.3.html" ><code>malloc_info(3)</code></a> extensions to <code><malloc.h></code></a>. - The <code>malloc_info</code> function is available in Android 6.0 and later and + The <code>malloc_info</code> function is available in Android 6.0 (Marshmallow) and higher and its XML schema is documented in Bionic's <a href="https://android.googlesource.com/platform/bionic/+/master/libc/include/malloc.h" ><code><malloc.h></code></a>. diff --git a/en/security/_toc.yaml b/en/security/_toc.yaml index e125d205..bb9d4e02 100644 --- a/en/security/_toc.yaml +++ b/en/security/_toc.yaml @@ -47,6 +47,8 @@ toc: section: - title: 2018 Bulletins section: + - title: June + path: /security/bulletin/2018-06-01 - title: May path: /security/bulletin/2018-05-01 - title: April @@ -135,6 +137,8 @@ toc: path: /security/bulletin/pixel/index - title: 2018 Bulletins section: + - title: June + path: /security/bulletin/pixel/2018-06-01 - title: May path: /security/bulletin/pixel/2018-05-01 - title: April diff --git a/en/security/authentication/index.html b/en/security/authentication/index.html index e1436b8f..33c141d7 100644 --- a/en/security/authentication/index.html +++ b/en/security/authentication/index.html @@ -176,7 +176,7 @@ The format is a simple serialization protocol with fixed size fields:</p> <td>Time (in milliseconds) since the most recent system boot.</td> </tr> <tr> - <td>AuthToken HMAC key (SHA-256)</td> + <td>AuthToken HMAC (SHA-256)</td> <td>256-bit blob</td> <td>Yes</td> <td>Keyed SHA-256 MAC of all fields except the HMAC field.</td> diff --git a/en/security/bulletin/2017-01-01.html b/en/security/bulletin/2017-01-01.html index c3ac2dd0..b11c43b1 100644 --- a/en/security/bulletin/2017-01-01.html +++ b/en/security/bulletin/2017-01-01.html @@ -1276,7 +1276,7 @@ October 2016 security bulletins. * The severity rating for these vulnerabilities was determined by the vendor. </p> <p> -* The patch for this issue is not publicly available. The update is contained +** The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the <a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>. diff --git a/en/security/bulletin/2017-04-01.html b/en/security/bulletin/2017-04-01.html index d17ddb43..cbd734d0 100644 --- a/en/security/bulletin/2017-04-01.html +++ b/en/security/bulletin/2017-04-01.html @@ -2564,7 +2564,7 @@ patch level. </p> </tr> </table> <p>* The severity rating for these vulnerabilities was determined by the vendor.</p> -<p>* The patch for this issue is not publicly available. The update is contained +<p>** The patch for this issue is not publicly available. The update is contained in the latest binary drivers for Nexus devices available from the <a href="https://developers.google.com/android/nexus/drivers"> Google Developer site</a>.</p> diff --git a/en/security/bulletin/2018-06-01.html b/en/security/bulletin/2018-06-01.html new file mode 100644 index 00000000..29ba106a --- /dev/null +++ b/en/security/bulletin/2018-06-01.html @@ -0,0 +1,951 @@ +<html devsite> + <head> + <title>Android Security Bulletin—June 2018</title> + <meta name="project_path" value="/_project.yaml" /> + <meta name="book_path" value="/_book.yaml" /> + </head> + <body> + <!-- + Copyright 2018 The Android Open Source Project + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + //www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + --> +<p><em>Published June 4, 2018 | Updated June 6, 2018</em></p> + +<p> +The Android Security Bulletin contains details of security vulnerabilities +affecting Android devices. Security patch levels of 2018-06-05 or later address +all of these issues. To learn how to check a device's security patch level, see +<a href="https://support.google.com/pixelphone/answer/4457705">Check and update +your Android version</a>. +</p> +<p> +Android partners are notified of all issues at least a month before +publication. Source code patches for these issues have been released to the +Android Open Source Project (AOSP) repository and linked from this bulletin. +This bulletin also includes links to patches outside of AOSP. +</p> +<p> +The most severe of these issues is a critical security vulnerability in Media +framework that could enable a remote attacker using a specially crafted file to +execute arbitrary code within the context of a privileged process. The +<a href="/security/overview/updates-resources.html#severity">severity +assessment</a> is based on the effect that exploiting the vulnerability would +possibly have on an affected device, assuming the platform and service +mitigations are turned off for development purposes or if successfully bypassed. +</p> +<p> +We have had no reports of active customer exploitation or abuse of these newly +reported issues. Refer to the +<a href="#mitigations">Android and Google Play Protect mitigations</a> +section for details on the +<a href="/security/enhancements/index.html">Android security platform protections</a> +and Google Play Protect, which improve the security of the Android platform. +</p> +<p class="note"> +<strong>Note:</strong> Information on the latest over-the-air update (OTA) and +firmware images for Google devices is available in the +<a href="/security/bulletin/pixel/2018-06-01.html">June 2018 +Pixel / Nexus Security Bulletin</a>. +</p> + +<h2 id="mitigations">Android and Google service mitigations</h2> +<p> +This is a summary of the mitigations provided by the +<a href="/security/enhancements/index.html">Android security platform</a> +and service protections such as +<a href="https://www.android.com/play-protect">Google Play Protect</a>. +These capabilities reduce the likelihood that security vulnerabilities +could be successfully exploited on Android. +</p> +<ul> +<li>Exploitation for many issues on Android is made more difficult by +enhancements in newer versions of the Android platform. We encourage all users +to update to the latest version of Android where possible.</li> +<li>The Android security team actively monitors for abuse through +<a href="https://www.android.com/play-protect">Google Play Protect</a> +and warns users about +<a href="/security/reports/Google_Android_Security_PHA_classifications.pdf">Potentially +Harmful Applications</a>. Google Play Protect is enabled by default on devices +with <a href="http://www.android.com/gms">Google Mobile Services</a>, and is +especially important for users who install apps from outside of Google +Play.</li> +</ul> +<h2 id="2018-06-01-details">2018-06-01 security patch level vulnerability details</h2> +<p> +In the sections below, we provide details for each of the security +vulnerabilities that apply to the 2018-06-01 patch level. Vulnerabilities are +grouped under the component that they affect. There is a description of the +issue and a table with the CVE, associated references, +<a href="#type">type of vulnerability</a>, +<a href="/security/overview/updates-resources.html#severity">severity</a>, +and updated AOSP versions (where applicable). When available, we link the public +change that addressed the issue to the bug ID, like the AOSP change list. When +multiple changes relate to a single bug, additional references are linked to +numbers following the bug ID. +</p> + +<h3 id="framework">Framework</h3> + + +<p> +The most severe vulnerability in this section could enable a local malicious application to bypass +user interaction requirements in order to gain access to additional permissions. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9338</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/5a11d9bb5b55543c9b97d38da1a658c42b99a906">A-71361168</a></td> + <td>EoP</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9339</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/82306b4ed120eab59849a21ae85074ab10a67b23">A-71508348</a></td> + <td>EoP</td> + <td>High</td> + <td>8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2017-13227</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/173d37569997fdf7eaf7b05912c760352e724893">A-69981710</a></td> + <td>ID</td> + <td>High</td> + <td>8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9340</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/5a11d9bb5b55543c9b97d38da1a658c42b99a906">A-71360999</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> +</table> + + +<h3 id="media-framework">Media framework</h3> + + +<p> +The most severe vulnerability in this section could enable a remote attacker using a specially +crafted file to execute arbitrary code within the context of a privileged process. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9341</td> + <td><a href="https://android.googlesource.com/platform/external/libmpeg2/+/69ac35d37c0fcf43ac3dac6c99dbec5ecb258c41">A-74016277</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-5146</td> + <td>A-77284393<a href="#asterisk">*</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2017-13230</td> + <td><a href="https://android.googlesource.com/platform/external/libhevc/+/b0e1239a611617d598ebc8a93c2edae77430dd39">A-65483665</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0</td> + </tr> + <tr> + <td>CVE-2018-9344</td> + <td><a href="https://android.googlesource.com/platform/hardware/interfaces/+/6a6c9a891b8e91a9bc84784909f800ba670c873b">A-73172817</a></td> + <td>EoP</td> + <td>High</td> + <td>8.1</td> + </tr> + <tr> + <td>CVE-2018-9345</td> + <td><a href="https://android.googlesource.com/platform/frameworks/av/+/d6bd6091686dd7ea3b410fb8dce3794429066453">A-77238250</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9346</td> + <td><a href="https://android.googlesource.com/platform/frameworks/av/+/d6bd6091686dd7ea3b410fb8dce3794429066453">A-77238762</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9347</td> + <td><a href="https://android.googlesource.com/platform/external/sonivox/+/b237378c682f84e020f2c612c215967a7e5cd30a">A-68664359</a></td> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9348</td> + <td><a href="https://android.googlesource.com/platform/external/sonivox/+/b237378c682f84e020f2c612c215967a7e5cd30a">A-68953854</a></td> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> +</table> + + +<h3 id="system">System</h3> + + +<p> +The most severe vulnerability in this section could enable a remote attacker using a specially +crafted file to execute arbitrary code within the context of a privileged process. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9355</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/99a263a7f04c5c6f101388007baa18cf1e8c30bf">A-74016921</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9356</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/d7d4d5686b2e3c37c7bf10a6a2adff1c95251a13">A-74950468</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9357</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/9164ee1aaf3609b4771d39302e3af649f44c9e66">A-74947856</a></td> + <td>RCE</td> + <td>Critical</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9358</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/0d7c2f5a14d1055f3b4f69035451c66bf8f1b08e">A-73172115</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9359</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/b66fc16410ff96e9119f8eb282e67960e79075c8">A-74196706</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9360</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/b66fc16410ff96e9119f8eb282e67960e79075c8">A-74201143</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9361</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/b66fc16410ff96e9119f8eb282e67960e79075c8">A-74202041</a></td> + <td>ID</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9362</td> + <td><a href="https://android.googlesource.com/platform/frameworks/opt/telephony/+/a42870e1df7dbf384aa1d7a02584eb755e821417">A-72298611</a></td> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> +</table> + + +<h2 id="2018-06-05-details">2018-06-05 security patch level—Vulnerability details</h2> + + +<p> +In the sections below, we provide details for each of the security vulnerabilities that apply to +the 2018-06-05 patch level. Vulnerabilities are grouped under the component that they affect and +include details such as the CVE, associated references, <a href="#type"> +type of vulnerability</a>, <a href="/security/overview/updates-resources.html#severity"> +severity</a>, component (where applicable), and updated AOSP versions (where applicable). +When available, we link the public change that addressed the issue to the bug ID, like the AOSP +change list. When multiple changes relate to a single bug, additional references are linked to +numbers following the bug ID. +</p> +<h3 id="kernel-components">Kernel components</h3> + + +<p> +The most severe vulnerability in this section could enable a local malicious application to +execute arbitrary code within the context of a privileged process. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2018-9363</td> + <td>A-65853588<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>High</td> + <td>bluetooth</td> + </tr> + <tr> + <td>CVE-2017-17806</td> + <td>A-71752561<br /> + <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=af3ff8045bbf3e32f1a448542e73abb4c8ceb6f1"> +Upstream kernel</a></td> + <td>EoP</td> + <td>High</td> + <td>crypto</td> + </tr> + <tr> + <td>CVE-2017-17807</td> + <td>A-71751178<br /> + <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4dca6ea1d9432052afb06baf2e3ae78188a4410b"> +Upstream kernel</a></td> + <td>EoP</td> + <td>High</td> + <td>Keyring</td> + </tr> + <tr> + <td>CVE-2017-17558</td> + <td>A-71751622<br /> + <a +href="https://www.spinics.net/lists/linux-usb/msg163644.html">Upstream kernel</a></td> + <td>EoP</td> + <td>High</td> + <td>USB</td> + </tr> +</table> + + +<h3 id="lg-components">LG components</h3> + + +<p> +The most severe vulnerability in this section could enable a local attacker to bypass user +interaction requirements in order to gain access to additional permissions. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2018-9364</td> + <td>A-69163111<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Critical</td> + <td>Bootloader</td> + </tr> +</table> + + +<h3 id="media-framework-05">Media framework</h3> + + +<p> +The most severe vulnerability in this section could enable a local malicious application to +bypass user interaction requirements in order to gain access to additional permissions. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9409 +</td> + <td>A-63144992<a href="#asterisk">*</a><br /> +QC-CR#2114346</td> + <td>EoP</td> + <td>High</td> + <td>8.1</td> + </tr> +</table> + + +<h3 id="mediatek-components">MediaTek components</h3> + + +<p> +The most severe vulnerability in this section could enable a remote attacker to execute +arbitrary code within the context of the TCB. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2018-9373</td> + <td>A-71867247<a href="#asterisk">*</a><br /> + M-ALPS03740330</td> + <td>EoP</td> + <td>Critical</td> + <td>Mediatek WLAN TDLS</td> + </tr> + <tr> + <td>CVE-2018-9366</td> + <td>A-72314499<a href="#asterisk">*</a><br /> + M-ALPS03762526</td> + <td>EoP</td> + <td>High</td> + <td>IMSA</td> + </tr> + <tr> + <td>CVE-2018-9367</td> + <td>A-72314219<a href="#asterisk">*</a><br /> + M-ALPS03762692</td> + <td>EoP</td> + <td>High</td> + <td>Cameratool CCAP</td> + </tr> + <tr> + <td>CVE-2018-9368</td> + <td>A-70727446<a href="#asterisk">*</a><br /> + M-ALPS03730693</td> + <td>EoP</td> + <td>High</td> + <td>mtksocaudio</td> + </tr> + <tr> + <td>CVE-2018-9369</td> + <td>A-70514573<a href="#asterisk">*</a><br /> + M-ALPS03666161</td> + <td>EoP</td> + <td>High</td> + <td>bootloader</td> + </tr> + <tr> + <td>CVE-2018-9370</td> + <td>A-70515281<a href="#asterisk">*</a><br /> + M-ALPS03693488</td> + <td>EoP</td> + <td>High</td> + <td>bootloader</td> + </tr> + <tr> + <td>CVE-2018-9371</td> + <td>A-70515752<a href="#asterisk">*</a><br /> + M-ALPS03683903</td> + <td>EoP</td> + <td>High</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-9372</td> + <td>A-70730215<a href="#asterisk">*</a><br /> + M-ALPS03676237</td> + <td>EoP</td> + <td>High</td> + <td>bootloader</td> + </tr> +</table> + + +<h3 id="nvidia-components">NVIDIA components</h3> + + +<p> +The most severe vulnerability in this section could enable a local malicious application +to execute arbitrary code within the context of a privileged process. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2017-6290</td> + <td>A-69559414<a href="#asterisk">*</a><br /> + N-200373895</td> + <td>EoP</td> + <td>High</td> + <td>TLK TrustZone</td> + </tr> + <tr> + <td>CVE-2017-6294</td> + <td>A-69316825<a href="#asterisk">*</a><br /> + N-200369095</td> + <td>EoP</td> + <td>High</td> + <td>NVIDIA Tegra X1 TZ</td> + </tr> + <tr> + <td>CVE-2017-6292</td> + <td>A-69480285<a href="#asterisk">*</a><br /> + N-200373888</td> + <td>EoP</td> + <td>High</td> + <td>TLZ TrustZone</td> + </tr> +</table> + + +<h3 id="qualcomm-components">Qualcomm components</h3> + + +<p> +The most severe vulnerability in this section could enable a local attacker to bypass +user interaction requirements in order to gain access to additional permissions. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2017-18158</td> + <td>A-68992400<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=316136f292cedaecf17823d6f3b63cf2d11314b3"> +QC-CR#2104056</a></td> + <td>EoP</td> + <td>Critical</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-3569</td> + <td>A-74237215<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=fe9ea02140c4be952171251515da90bc3a1a2bc0"> +QC-CR#2161920</a></td> + <td>EoP</td> + <td>Critical</td> + <td>WLAN Host</td> + </tr> + <tr> + <td>CVE-2017-18155</td> + <td>A-66734153<a href="#asterisk">*</a><br /> + QC-CR#1050893</td> + <td>RCE</td> + <td>Critical</td> + <td>Hardware codec</td> + </tr> + <tr> + <td>CVE-2018-5854</td> + <td>A-71800779<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=aedca87c9a42723dfb5f7084ba855da1208f1889"> +QC-CR#2183877</a></td> + <td>EoP</td> + <td>Critical</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2017-13077</td> + <td>A-63165064<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>High</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2018-5896</td> + <td>A-70399602<a href="#asterisk">*</a><br /> + QC-CR#2163793</td> + <td>ID</td> + <td>High</td> + <td>Diag driver</td> + </tr> + <tr> + <td>CVE-2018-5829</td> + <td>A-74237546<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=27381e9d253629180dcdaa698d3fd01bec28d351"> +QC-CR#2151241</a></td> + <td>ID</td> + <td>High</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2017-18159</td> + <td>A-68992405<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=633fa4ffb38bbfb0fad79204e19b9f59d42d7680">QC-CR#2105697</a> + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=3129148e5a4cfe83003449a1048660823bfddc51">2</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=bcceb2ceeea07aedaa5f97207cc88f9d8b4416ea">3</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=04f23441b8c0c897644f9bf391b691039fa0ab70">4</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=b6b318431983f35a7734cae227478df3dc93a818">5</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=7dcbee530800b16534d0f3e8db375492c03b3e0a">6</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=9057a8b3339abc4eb2c4e462279f34bbe6410e7c">7</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=4a63a848c062851776123d4bc7ec10eb498a70dd">8</a>] + [<a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=5471b0cdf4bace12d872d074b97eae29f1317e6a">9</a>]</td> + <td>EoP</td> + <td>High</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2017-18158</td> + <td>A-67782849<a href="#asterisk">*</a><br /> + QC-CR#2104056</td> + <td>EoP</td> + <td>High</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-5835</td> + <td>A-74237148<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/prima/commit/?id=5a0eeb72c3cde7dcb8096967561a88a678ad9aec"> +QC-CR#2153553</a></td> + <td>EoP</td> + <td>High</td> + <td>WLAN Host</td> + </tr> + <tr> + <td>CVE-2018-5834</td> + <td>A-74237804<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=ede0f8a4d11ec56ee87177478cc0c25af0894860"> +QC-CR#2153326</a></td> + <td>EoP</td> + <td>High</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2018-5831</td> + <td>A-74237606<br /> + <a href="https://source.codeaurora.org/quic/la/kernel/msm-3.18/commit/?id=e3e13d745238ad8853af47c2d938344ea8d3c77f"> +QC-CR#2161310</a></td> + <td>EoP</td> + <td>High</td> + <td>GPU driver</td> + </tr> + <tr> + <td>CVE-2018-5830</td> + <td>A-74237532<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=129e76e0ea923b319555f37ea601dfb974a06bfe">QC-CR#2157917</a> + [<a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=8174eb0235a7e581153ea1d4a401e7ea8354cc08">2</a>]</td> + <td>EoP</td> + <td>High</td> + <td>WLAN Host</td> + </tr> +</table> + + +<h3 id="qualcomm-closed-source-components">Qualcomm closed-source components</h3> + +<p> +These vulnerabilities affect Qualcomm components and are described in further detail in +the appropriate Qualcomm AMSS security bulletin or security alert. The severity +assessment of these issues is provided directly by Qualcomm. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2017-18157</td> + <td>A-73539080<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2017-18156</td> + <td>A-73539065<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2018-5892</td> + <td>A-72951191<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2018-5891</td> + <td>A-72950815<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2018-5885</td> + <td>A-72950554<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2018-5894</td> + <td>A-74236854<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2018-5884</td> + <td>A-74235510<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>High</td> + <td>Closed-source component</td> + </tr> +</table> + + +<h2 id="common-questions-and-answers">Common questions and answers</h2> +<p>This section answers common questions that may occur after reading this bulletin.</p> +<p><strong>1. How do I determine if my device is updated to address these issues?</strong></p> +<p>To learn how to check a device's security patch level, see +<a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Check +and update your Android version</a>.</p> +<ul> +<li>Security patch levels of 2018-06-01 or later address all issues associated +with the 2018-06-01 security patch level.</li> +<li>Security patch levels of 2018-06-05 or later address all issues associated +with the 2018-06-05 security patch level and all previous patch levels.</li> +</ul> +<p>Device manufacturers that include these updates should set the patch string level to:</p> +<ul> + <li>[ro.build.version.security_patch]:[2018-06-01]</li> + <li>[ro.build.version.security_patch]:[2018-06-05]</li> +</ul> +<p><strong>2. Why does this bulletin have two security patch levels?</strong></p> +<p> +This bulletin has two security patch levels so that Android partners have the +flexibility to fix a subset of vulnerabilities that are similar across all +Android devices more quickly. Android partners are encouraged to fix all issues +in this bulletin and use the latest security patch level. +</p> +<ul> +<li>Devices that use the 2018-06-01 security patch level must include all issues +associated with that security patch level, as well as fixes for all issues +reported in previous security bulletins.</li> +<li>Devices that use the security patch level of 2018-06-05 or newer must +include all applicable patches in this (and previous) security +bulletins.</li> +</ul> +<p> +Partners are encouraged to bundle the fixes for all issues they are addressing +in a single update. +</p> +<p id="type"> +<strong>3. What do the entries in the <em>Type</em> column mean?</strong> +</p> +<p> +Entries in the <em>Type</em> column of the vulnerability details table reference +the classification of the security vulnerability. +</p> +<table> + <col width="25%"> + <col width="75%"> + <tr> + <th>Abbreviation</th> + <th>Definition</th> + </tr> + <tr> + <td>RCE</td> + <td>Remote code execution</td> + </tr> + <tr> + <td>EoP</td> + <td>Elevation of privilege</td> + </tr> + <tr> + <td>ID</td> + <td>Information disclosure</td> + </tr> + <tr> + <td>DoS</td> + <td>Denial of service</td> + </tr> + <tr> + <td>N/A</td> + <td>Classification not available</td> + </tr> +</table> +<p> +<strong>4. What do the entries in the <em>References</em> column mean?</strong> +</p> +<p> +Entries under the <em>References</em> column of the vulnerability details table +may contain a prefix identifying the organization to which the reference value belongs. +</p> +<table> + <col width="25%"> + <col width="75%"> + <tr> + <th>Prefix</th> + <th>Reference</th> + </tr> + <tr> + <td>A-</td> + <td>Android bug ID</td> + </tr> + <tr> + <td>QC-</td> + <td>Qualcomm reference number</td> + </tr> + <tr> + <td>M-</td> + <td>MediaTek reference number</td> + </tr> + <tr> + <td>N-</td> + <td>NVIDIA reference number</td> + </tr> + <tr> + <td>B-</td> + <td>Broadcom reference number</td> + </tr> +</table> +<p id="asterisk"> +<strong>5. What does a * next to the Android bug ID in the <em>References</em> +column mean?</strong> +</p> +<p> +Issues that are not publicly available have a * next to the Android bug ID in +the <em>References</em> column. The update for that issue is generally contained +in the latest binary drivers for Nexus devices available from the +<a href="https://developers.google.com/android/nexus/drivers">Google Developer site</a>. +</p> +<p> +<strong>6. Why are security vulnerabilities split between this bulletin and +device/partner security bulletins, such as the Pixel / Nexus bulletin?</strong> +</p> +<p> +Security vulnerabilities that are documented in this security bulletin are +required in order to declare the latest security patch level on Android devices. +Additional security vulnerabilities that are documented in the +device / partner security bulletins are not required for declaring +a security patch level. Android device and chipset manufacturers are encouraged +to document the presence of other fixes on their devices through their own security +websites, such as the +<a href="https://security.samsungmobile.com/securityUpdate.smsb">Samsung</a>, +<a href="https://lgsecurity.lge.com/security_updates.html">LGE</a>, or +<a href="/security/bulletin/pixel/">Pixel / Nexus</a> +security bulletins. +</p> +<h2 id="versions">Versions</h2> +<table> + <col width="25%"> + <col width="25%"> + <col width="50%"> + <tr> + <th>Version</th> + <th>Date</th> + <th>Notes</th> + </tr> + <tr> + <td>1.0</td> + <td>June 4, 2018</td> + <td>Bulletin published.</td> + </tr> + <tr> + <td>1.1</td> + <td>June 6, 2018</td> + <td>Bulletin revised to include AOSP links.</td> + </tr> +</table> +</body></html> diff --git a/en/security/bulletin/2018.html b/en/security/bulletin/2018.html index a333d670..61c67635 100644 --- a/en/security/bulletin/2018.html +++ b/en/security/bulletin/2018.html @@ -37,6 +37,22 @@ of all bulletins, see the <a href="/security/bulletin/index.html">Android Securi <th>Security patch level</th> </tr> <tr> + <td><a href="/security/bulletin/2018-06-01.html">June 2018</a></td> + <td>Coming soon + <!-- + <a href="/security/bulletin/2018-06-01.html">English</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ja">日本語</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ko">한국어</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ru">ру́сский</a> / + <a href="/security/bulletin/2018-06-01.html?hl=zh-cn">中文 (中国)</a> / + <a href="/security/bulletin/2018-06-01.html?hl=zh-tw">中文 (台灣)</a> + --> + </td> + <td>June 4, 2018</td> + <td>2018-06-01<br> + 2018-06-05</td> + </tr> + <tr> <td><a href="/security/bulletin/2018-05-01.html">May 2018</a></td> <td> <a href="/security/bulletin/2018-05-01.html">English</a> / diff --git a/en/security/bulletin/index.html b/en/security/bulletin/index.html index 1b996c08..27bd60a1 100644 --- a/en/security/bulletin/index.html +++ b/en/security/bulletin/index.html @@ -69,6 +69,21 @@ Android Open Source Project (AOSP), the upstream Linux kernel, and system-on-chi <th>Security patch level</th> </tr> <tr> + <td><a href="/security/bulletin/2018-06-01.html">June 2018</a></td> + <td>Coming soon + <!-- + <a href="/security/bulletin/2018-06-01.html">English</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ja">日本語</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ko">한국어</a> / + <a href="/security/bulletin/2018-06-01.html?hl=ru">ру́сский</a> / + <a href="/security/bulletin/2018-06-01.html?hl=zh-cn">中文 (中国)</a> / + <a href="/security/bulletin/2018-06-01.html?hl=zh-tw">中文 (台灣)</a> + --> + </td> + <td>June 4, 2018</td> + <td>2018-06-01<br> + 2018-06-05</td> + <tr> <td><a href="/security/bulletin/2018-05-01.html">May 2018</a></td> <td> <a href="/security/bulletin/2018-05-01.html">English</a> / diff --git a/en/security/bulletin/pixel/2018-06-01.html b/en/security/bulletin/pixel/2018-06-01.html new file mode 100644 index 00000000..8e27697c --- /dev/null +++ b/en/security/bulletin/pixel/2018-06-01.html @@ -0,0 +1,937 @@ +<html devsite> + <head> + <title>Pixel / Nexus Security Bulletin—June 2018</title> + <meta name="project_path" value="/_project.yaml" /> + <meta name="book_path" value="/_book.yaml" /> + </head> + <body> + <!-- + Copyright 2018 The Android Open Source Project + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + //www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. + --> + +<p><em>Published June 4, 2018 | Updated June 6, 2018</em></p> + +<p> +The Pixel / Nexus Security Bulletin contains details of security +vulnerabilities and functional improvements affecting +<a href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">supported +Google Pixel and Nexus devices</a> (Google devices). +For Google devices, security patch levels of 2018-06-05 or later address all +issues in this bulletin and all issues in the June 2018 Android Security +Bulletin. To learn how to check a device's security patch level, see +<a href="https://support.google.com/pixelphone/answer/4457705">Check & update your +Android version</a>. +</p> +<p> +All supported Google devices will receive an update to the 2018-06-05 patch +level. We encourage all customers to accept these updates to their devices. +</p> +<p class="note"> +<strong>Note:</strong> The Google device firmware images are available on the +<a href="https://developers.google.com/android/images">Google Developer +site</a>. +</p> +<h2 id="announcements">Announcements</h2> +<p>In addition to the security vulnerabilities described in the June 2018 +Android Security Bulletin, Pixel and Nexus devices also contain patches for the +security vulnerabilities described below. Partners were notified of these issues +at least a month ago and may choose to incorporate them as part of their device +updates.</p> +<h2 id="security-patches">Security patches</h2> +<p> +Vulnerabilities are grouped under the component that they affect. There is a +description of the issue and a table with the CVE, associated references, +<a href="#type">type of vulnerability</a>, +<a href="https://source.android.com/security/overview/updates-resources.html#severity">severity</a>, +and updated Android Open Source Project (AOSP) versions (where applicable). When +available, we link the public change that addressed the issue to the bug ID, +like the AOSP change list. When multiple changes relate to a single bug, +additional references are linked to numbers following the bug ID. +</p> + +<h3 id="framework">Framework</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9374</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/62b500f99595e99e1db8f0c068f719e68c73551e">A-72710897</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9375</td> + <td><a href="https://android.googlesource.com/platform/packages/providers/UserDictionaryProvider/+/cccf7d5c98fc81ff4483f921fb4ebfa974add9c6">A-75298708</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9377</td> + <td>A-64752751<a href="#asterisk">*</a></td> + <td>ID</td> + <td>Moderate</td> + <td>6.0, 6.0.1</td> + </tr> +</table> + + +<h3 id="media-framework">Media framework</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9378</td> + <td><a href="https://android.googlesource.com/platform/frameworks/av/+/e0c09e4dd62e033aa9688634844d19136c0d34bc">A-73126106</a></td> + <td>ID</td> + <td>Moderate</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9379</td> + <td><a href="https://android.googlesource.com/platform/frameworks/base/+/42e5aed1d106bef1f8913ffe87aa1f9df6aae90c">A-63766886</a> + [<a href="https://android.googlesource.com/platform/packages/providers/MediaProvider/+/76ffd8258c483b7170af49a8a67702426df07f2f">2</a>]</td> + <td>ID</td> + <td>Moderate</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9349</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/external/libvpx/+/69ddad629d1db85d8531af694c910626a1e80a9f">A-72510002</a></td> + <td>ID</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9350</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/external/libavc/+/fde8eda71e8f7bc9c973fe6fbdd3846951b340ed">A-73552574</a></td> + <td>ID</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9351</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/external/libavc/+/27c639d897fb0f1f0acf6a58b5c013d65c63bd04">A-73625898</a></td> + <td>ID</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9352</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/external/libhevc/+/a7303e887a40ab164b19b310068e13ac4f123edc">A-73965867</a> + [<a href="https://android.googlesource.com/platform/external/libhevc/+/9434d4d8846241f0575aaf48ee7d4342e926ae77">2</a>]</td> + <td>ID</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9353</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/external/libhevc/+/7ea8a36d5de35d71ace260a695199093fcc1f08f">A-73965890</a></td> + <td>ID</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> + <tr> + <td rowspan="2">CVE-2018-9354</td> + <td rowspan="2"><a href="https://android.googlesource.com/platform/frameworks/av/+/f5d61ac18c72c9abdbbd971bfae7ce8b073eb08a">A-74067957</a></td> + <td>NSI</td> + <td>NSI</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>DoS</td> + <td>High</td> + <td>6.0, 6.0.1</td> + </tr> +</table> + + +<h3 id="system">System</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Updated AOSP versions</th> + </tr> + <tr> + <td>CVE-2018-9380</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/85677abe2cc90bcd8b9df127088a97657d17c986">A-75298652</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>7.0, 7.1.1, 7.1.2, 8.0, 8.1</td> + </tr> + <tr> + <td>CVE-2018-9381</td> + <td><a href="https://android.googlesource.com/platform/system/bt/+/0519f6aa5345be0917ad52188479230148adf8bd">A-73125709</a></td> + <td>ID</td> + <td>Moderate</td> + <td>8.1</td> + </tr> + <tr> + <td>CVE-2018-9382</td> + <td>A-35765136<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>6.0, 6.0.1, 7.0, 7.1.1, 7.1.2</td> + </tr> +</table> + + +<h3 id="kernel-components">Kernel components</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2018-9383</td> + <td>A-73827422<a href="#asterisk">*</a></td> + <td>ID</td> + <td>Moderate</td> + <td>asn1_decoder</td> + </tr> + <tr> + <td>CVE-2018-9384</td> + <td>A-74356909<br /> + <a href="https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c02433dd6de32f042cf3ffe476746b1115b8c096">Upstream kernel</a></td> + <td>ID</td> + <td>Moderate</td> + <td>Kernel</td> + </tr> + <tr> + <td>CVE-2018-9385</td> + <td>A-74128061<br /> + <a href="https://patchwork.kernel.org/patch/10175611/">Upstream kernel</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>amba</td> + </tr> + <tr> + <td>CVE-2018-9386</td> + <td>A-71363680<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>HTC reboot_block driver</td> + </tr> + <tr> + <td>CVE-2018-9387</td> + <td>A-69006385<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>mnh_sm driver</td> + </tr> + <tr> + <td>CVE-2018-9388</td> + <td>A-68343441<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>ftm4_touch</td> + </tr> + <tr> + <td>CVE-2018-9389</td> + <td>A-65023306<a href="#asterisk">*</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>ipv4/ipv6</td> + </tr> + <tr> + <td>CVE-2018-7480</td> + <td>A-76106168<br /> + <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b54d816e00425c3a517514e0d677bb3cec49258"> +Upstream kernel</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>Block handler</td> + </tr> + <tr> + <td>CVE-2017-18075</td> + <td>A-73237057<br /> + <a href="http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d76c68109f37cb85b243a1cf0f40313afd2bae68"> +Upstream kernel</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>pcrypt</td> + </tr> +</table> + + +<h3 id ="mediatek-components">MediaTek components</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2018-9390</td> + <td>A-76100614<a href="#asterisk">*</a><br /> + M-ALPS03849277</td> + <td>EoP</td> + <td>Moderate</td> + <td>wlanThermo procfs entry</td> + </tr> + <tr> + <td>CVE-2018-9391</td> + <td>A-72313579<a href="#asterisk">*</a><br /> + M-ALPS03762614</td> + <td>EoP</td> + <td>Moderate</td> + <td>GPS HAL</td> + </tr> + <tr> + <td>CVE-2018-9392</td> + <td>A-72312594<a href="#asterisk">*</a><br /> + M-ALPS03762614</td> + <td>EoP</td> + <td>Moderate</td> + <td>GPS HAL</td> + </tr> + <tr> + <td>CVE-2018-9393</td> + <td>A-72312577<a href="#asterisk">*</a><br /> + M-ALPS03753748</td> + <td>EoP</td> + <td>Moderate</td> + <td>MTK wlan</td> + </tr> + <tr> + <td>CVE-2018-9394</td> + <td>A-72312468<a href="#asterisk">*</a><br /> + M-ALPS03753652</td> + <td>EoP</td> + <td>Moderate</td> + <td>MTK P2P driver</td> + </tr> + <tr> + <td>CVE-2018-9395</td> + <td>A-72312071<a href="#asterisk">*</a><br /> + M-ALPS03753735</td> + <td>EoP</td> + <td>Moderate</td> + <td>MTK cfg80211</td> + </tr> + <tr> + <td>CVE-2018-9396</td> + <td>A-71867113<a href="#asterisk">*</a><br /> + M-ALPS03740353</td> + <td>EoP</td> + <td>Moderate</td> + <td>Mediatek CCCI</td> + </tr> + <tr> + <td>CVE-2018-9397</td> + <td>A-71866634<a href="#asterisk">*</a><br /> + M-ALPS03532675<br /> + M-ALPS03479586</td> + <td>EoP</td> + <td>Moderate</td> + <td>Mediatek WMT device</td> + </tr> + <tr> + <td>CVE-2018-9398</td> + <td>A-71866289<a href="#asterisk">*</a><br /> + M-ALPS03740468</td> + <td>EoP</td> + <td>Moderate</td> + <td>FM Radio Driver</td> + </tr> + <tr> + <td>CVE-2018-9399</td> + <td>A-71866200<a href="#asterisk">*</a><br /> + M-ALPS03740489</td> + <td>EoP</td> + <td>Moderate</td> + <td>/proc/driver/wmt_dbg driver</td> + </tr> + <tr> + <td>CVE-2018-9400</td> + <td>A-71865884<a href="#asterisk">*</a><br /> + M-ALPS03753678</td> + <td>EoP</td> + <td>Moderate</td> + <td>Goodix Touchscreen Driver</td> + </tr> + <tr> + <td>CVE-2017-13308</td> + <td>A-70728757<a href="#asterisk">*</a><br /> + M-ALPS03751855</td> + <td>EoP</td> + <td>Moderate</td> + <td>thermal</td> + </tr> + <tr> + <td>CVE-2018-9401</td> + <td>A-70511226<a href="#asterisk">*</a><br /> + M-ALPS03693409</td> + <td>EoP</td> + <td>Moderate</td> + <td>cameraisp</td> + </tr> + <tr> + <td>CVE-2018-9402</td> + <td>A-70728072<a href="#asterisk">*</a><br /> + M-ALPS03684171</td> + <td>EoP</td> + <td>Moderate</td> + <td>WLAN driver</td> + </tr> + <tr> + <td>CVE-2018-9403</td> + <td>A-72313700<a href="#asterisk">*</a><br /> + M-ALPS03762413</td> + <td>EoP</td> + <td>Moderate</td> + <td>HAL</td> + </tr> + <tr> + <td>CVE-2018-9404</td> + <td>A-72314374<a href="#asterisk">*</a><br /> + M-ALPS03773299</td> + <td>EoP</td> + <td>Moderate</td> + <td>Radio Interface Layer</td> + </tr> + <tr> + <td>CVE-2018-9405</td> + <td>A-72314804<a href="#asterisk">*</a><br /> + M-ALPS03762818</td> + <td>EoP</td> + <td>Moderate</td> + <td>DmAgent</td> + </tr> + <tr> + <td>CVE-2018-9406</td> + <td>A-70726950<a href="#asterisk">*</a><br /> + M-ALPS03684231</td> + <td>ID</td> + <td>Moderate</td> + <td>NlpService</td> + </tr> + <tr> + <td>CVE-2018-9407</td> + <td>A-70728406<a href="#asterisk">*</a><br /> + M-ALPS03902529</td> + <td>ID</td> + <td>Moderate</td> + <td>emmc</td> + </tr> + <tr> + <td>CVE-2018-9408</td> + <td>A-70729980<a href="#asterisk">*</a><br /> + M-ALPS03693684</td> + <td>ID</td> + <td>Moderate</td> + <td>GPS</td> + </tr> +</table> + + +<h3 id="qualcomm-components">Qualcomm components</h3> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2017-15824</td> + <td>A-68163089<a href="#asterisk">*</a><br /> + QC-CR#2107596</td> + <td>ID</td> + <td>Moderate</td> + <td>EDK2 bootloader</td> + </tr> + <tr> + <td>CVE-2018-5897</td> + <td>A-70528036<a href="#asterisk">*</a><br /> + QC-CR#2172685</td> + <td>ID</td> + <td>Moderate</td> + <td>diag</td> + </tr> + <tr> + <td>CVE-2018-5895</td> + <td>A-70293535<a href="#asterisk">*</a><br /> + QC-CR#2161027</td> + <td>ID</td> + <td>Moderate</td> + <td>qcacld</td> + </tr> + <tr> + <td>CVE-2018-5836</td> + <td>A-74237168<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=12a789c2e0e9fd2df40ac13ac27fe99487263887">QC-CR#2160375</a></td> + <td>ID</td> + <td>Moderate</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2018-3577</td> + <td>A-72957387<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=cf1c43ce8840021d2907afaa6c514e6971d7ebac"> +QC-CR#2129566</a></td> + <td>ID</td> + <td>Moderate</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2017-15824</td> + <td>A-68992463<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=6ad7ccfee4f78d23b4b8f5ebda0eef54dced32e3"> +QC-CR#2107596</a></td> + <td>ID</td> + <td>Moderate</td> + <td>bootloader</td> + </tr> + <tr> + <td>CVE-2017-14893</td> + <td>A-68992461<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=c8dc3bf07ee909e6e57ad7887f9d3c0ffa5df795"> +QC-CR#2104835</a></td> + <td>ID</td> + <td>Moderate</td> + <td>bootloader</td> + </tr> + <tr> + <td>CVE-2017-14872</td> + <td>A-68992457<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=1daa83baa41d1e6291e89f69e6487695b6890c01"> +QC-CR#2073366</a></td> + <td>ID</td> + <td>Moderate</td> + <td>bootloader</td> + </tr> + <tr> + <td>CVE-2018-5893</td> + <td>A-74237664<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-3.0/commit/?id=4cc54a30958d2a8d989364aa45a27fde3dd17352"> +QC-CR#2146949</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>WLAN</td> + </tr> + <tr> + <td>CVE-2016-5342, CVE-2016-5080</td> + <td>A-72232294<a href="#asterisk">*</a><br /> + QC-CR#1032174</td> + <td>EoP</td> + <td>Moderate</td> + <td>WLAN Driver</td> + </tr> + <tr> + <td>CVE-2018-5899</td> + <td>A-71638332<a href="#asterisk">*</a><br /> + QC-CR#1040612</td> + <td>EoP</td> + <td>Moderate</td> + <td>WLAN Driver</td> + </tr> + <tr> + <td>CVE-2018-5890</td> + <td>A-71501675<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=c9c8de8000ff32f8d1e24e697d861d92d8ed0b7a"> +QC-CR#2127348</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-5889</td> + <td>A-71501674<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=a95ca8e2eeb8a030e977f033cff122cad408158c"> +QC-CR#2127341</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-5888</td> + <td>A-71501672<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=5388803fa6d004382f4a857056ce06d963698d9c"> +QC-CR#2127312</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-5887</td> + <td>A-71501669<br /> + <a href="https://source.codeaurora.org/quic/la/abl/tianocore/edk2/commit/?id=c8415f6f2271008aef5056689950236df627d9b1"> +QC-CR#2127305</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>Bootloader</td> + </tr> + <tr> + <td>CVE-2018-5898</td> + <td>A-71363804<a href="#asterisk">*</a><br /> + QC-CR#2173850</td> + <td>EoP</td> + <td>Moderate</td> + <td>QC Audio Driver</td> + </tr> + <tr> + <td>CVE-2018-5832</td> + <td>A-69065862<a href="#asterisk">*</a><br /> + QC-CR#2149998</td> + <td>EoP</td> + <td>Moderate</td> + <td>Camerav2</td> + </tr> + <tr> + <td>CVE-2018-5857</td> + <td>A-62536960<a href="#asterisk">*</a><br /> + QC-CR#2169403</td> + <td>EoP</td> + <td>Moderate</td> + <td>wcd_cpe_core</td> + </tr> + <tr> + <td>CVE-2018-3597</td> + <td>A-74237782<br /> + <a href="https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=e569b915a246627d0449016408a9c0d388ee4ab4"> +QC-CR#2143070</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>DSP_Services</td> + </tr> + <tr> + <td>CVE-2018-3564</td> + <td>A-72957546<br /> + <a href="https://source.codeaurora.org/quic/la/kernel/msm-4.4/commit/?id=782cd411398e3cf2aca1615ab2649df0c46920ee"> +QC-CR#2062648</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>DSP_Services</td> + </tr> + <tr> + <td>CVE-2017-15856</td> + <td>A-72957506<br /> + <a href="https://source.codeaurora.org/quic/la/platform/vendor/qcom-opensource/wlan/qcacld-2.0/commit/?id=ed02c0ccd6f7461a69d64903738372eaf21babcd">QC-CR#2111922</a></td> + <td>EoP</td> + <td>Moderate</td> + <td>power_stats debugfs node</td> + </tr> +</table> + + +<h3 id="qualcomm-closed-source-components">Qualcomm closed-source components</h3> + +<p> +These vulnerabilities affect Qualcomm components and are described in further detail in the +appropriate Qualcomm AMSS security bulletin or security alert. The severity assessment of +these issues is provided directly by Qualcomm. +</p> + +<table> + <col width="21%"> + <col width="21%"> + <col width="14%"> + <col width="14%"> + <col width="30%"> + <tr> + <th>CVE</th> + <th>References</th> + <th>Type</th> + <th>Severity</th> + <th>Component</th> + </tr> + <tr> + <td>CVE-2017-11088</td> + <td>A-72951251<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>Moderate</td> + <td>Closed-source component</td> + </tr> + <tr> + <td>CVE-2017-11076</td> + <td>A-65049457<a href="#asterisk">*</a></td> + <td>N/A</td> + <td>Moderate</td> + <td>Closed-source component</td> + </tr> +</table> + + +<h2 id="functional-patches">Functional patches</h2> +<p> +These updates are included for affected Pixel devices to address functionality +issues not related to the security of Pixel devices. The table includes +associated references; the affected category, such as Bluetooth or mobile data; +and a summary of the issue. +</p> + + +<table> + <tr> + <th>References</th> + <th>Category</th> + <th>Improvements</th> + <th>Devices</th> + </tr> + <tr> + <td>A-74413120</td> + <td>Bluetooth</td> + <td>Improve BLE performance</td> + <td>All</td> + </tr> + <tr> + <td>A-76022834</td> + <td>Performance</td> + <td>Improve antenna-switching behavior in areas of weak coverage</td> + <td>Pixel 2, Pixel 2 XL</td> + </tr> + <tr> + <td>A-77963927</td> + <td>Wi-Fi</td> + <td>Improve Wi-Fi connectivity with certain Wi-Fi access points</td> + <td>Pixel, Pixel XL, Pixel 2, Pixel 2 XL</td> + </tr> + <tr> + <td>A-77458860</td> + <td>UI</td> + <td>IMEI SV format correctly displays as numeric</td> + <td>Pixel, Pixel XL, Pixel 2, Pixel 2 XL</td> + </tr> + <tr> + <td>A-68114567<br /> + +A-74058011</td> + <td>Display</td> + <td>Improve consistency of Always On Display</td> + <td>Pixel 2 XL</td> + </tr> + <tr> + <td>A-70282393</td> + <td>Performance</td> + <td>Improve proximity sensor behavior</td> + <td>Pixel 2 XL</td> + </tr> +</table> + + +<h2 id="common-questions-and-answers">Common questions and answers</h2> +<p> +This section answers common questions that may occur after reading this +bulletin. +</p> +<p> +<strong>1. How do I determine if my device is updated to address these issues? +</strong> +</p> +<p> +Security patch levels of 2018-06-05 or later address all issues associated with +the 2018-06-05 security patch level and all previous patch levels. To learn how +to check a device's security patch level, read the instructions on the <a +href="https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices">Pixel +and Nexus update schedule</a>. +</p> +<p id="type"> +<strong>2. What do the entries in the <em>Type</em> column mean?</strong> +</p> +<p> +Entries in the <em>Type</em> column of the vulnerability details table reference +the classification of the security vulnerability. +</p> +<table> + <col width="25%"> + <col width="75%"> + <tr> + <th>Abbreviation</th> + <th>Definition</th> + </tr> + <tr> + <td>RCE</td> + <td>Remote code execution</td> + </tr> + <tr> + <td>EoP</td> + <td>Elevation of privilege</td> + </tr> + <tr> + <td>ID</td> + <td>Information disclosure</td> + </tr> + <tr> + <td>DoS</td> + <td>Denial of service</td> + </tr> + <tr> + <td>N/A</td> + <td>Classification not available</td> + </tr> +</table> +<p> +<strong>3. What do the entries in the <em>References</em> column mean?</strong> +</p> +<p> +Entries under the <em>References</em> column of the vulnerability details table +may contain a prefix identifying the organization to which the reference value +belongs. +</p> +<table> + <col width="25%"> + <col width="75%"> + <tr> + <th>Prefix</th> + <th>Reference</th> + </tr> + <tr> + <td>A-</td> + <td>Android bug ID</td> + </tr> + <tr> + <td>QC-</td> + <td>Qualcomm reference number</td> + </tr> + <tr> + <td>M-</td> + <td>MediaTek reference number</td> + </tr> + <tr> + <td>N-</td> + <td>NVIDIA reference number</td> + </tr> + <tr> + <td>B-</td> + <td>Broadcom reference number</td> + </tr> +</table> +<p id="asterisk"> +<strong>4. What does a * next to the Android bug ID in the <em>References</em> +column mean?</strong> +</p> +<p> +Issues that are not publicly available have a * next to the Android bug ID in +the <em>References</em> column. The update for that issue is generally contained +in the latest binary drivers for Pixel / Nexus devices available +from the <a href="https://developers.google.com/android/nexus/drivers">Google +Developer site</a>. +</p> +<p> +<strong>5. Why are security vulnerabilities split between this bulletin and the +Android Security Bulletins?</strong> +</p> +<p> +Security vulnerabilities that are documented in the Android Security Bulletins +are required in order to declare the latest security patch level on Android +devices. Additional security vulnerabilities, such as those documented in this +bulletin are not required for declaring a security patch level. +</p> +<h2 id="versions">Versions</h2> +<table> + <col width="25%"> + <col width="25%"> + <col width="50%"> + <tr> + <th>Version</th> + <th>Date</th> + <th>Notes</th> + </tr> + <tr> + <td>1.0</td> + <td>June 4, 2018</td> + <td>Bulletin published.</td> + </tr> + <tr> + <td>1.1</td> + <td>June 6, 2018</td> + <td>Bulletin revised to include AOSP links.</td> + </tr> +</table> + + </body> +</html> diff --git a/en/security/bulletin/pixel/2018.html b/en/security/bulletin/pixel/2018.html index f7ee9164..cd9ef382 100644 --- a/en/security/bulletin/pixel/2018.html +++ b/en/security/bulletin/pixel/2018.html @@ -39,6 +39,21 @@ Bulletins</a> homepage.</p> <th>Security patch level</th> </tr> <tr> + <td><a href="/security/bulletin/pixel/2018-06-01.html">June 2018</a></td> + <td>Coming soon + <!-- + <a href="/security/bulletin/pixel/2018-06-01.html">English</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ja">日本語</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ko">한국어</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ru">ру́сский</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=zh-cn">中文 (中国)</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=zh-tw">中文 (台灣)</a> + --> + </td> + <td>June 4, 2018</td> + <td>2018-06-05</td> + </tr> + <tr> <td><a href="/security/bulletin/pixel/2018-05-01.html">May 2018</a></td> <td> <a href="/security/bulletin/pixel/2018-05-01.html">English</a> / diff --git a/en/security/bulletin/pixel/index.html b/en/security/bulletin/pixel/index.html index 249599f8..c00d7058 100644 --- a/en/security/bulletin/pixel/index.html +++ b/en/security/bulletin/pixel/index.html @@ -59,6 +59,21 @@ AOSP 24–48 hours after the Pixel / Nexus bulletin is release <th>Security patch level</th> </tr> <tr> + <td><a href="/security/bulletin/pixel/2018-06-01.html">June 2018</a></td> + <td>Coming soon + <!-- + <a href="/security/bulletin/pixel/2018-06-01.html">English</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ja">日本語</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ko">한국어</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=ru">ру́сский</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=zh-cn">中文 (中国)</a> / + <a href="/security/bulletin/pixel/2018-06-01.html?hl=zh-tw">中文 (台灣)</a> + --> + </td> + <td>June 4, 2018</td> + <td>2018-06-05</td> + </tr> + <tr> <td><a href="/security/bulletin/pixel/2018-05-01.html">May 2018</a></td> <td> <a href="/security/bulletin/pixel/2018-05-01.html">English</a> / @@ -91,9 +106,7 @@ AOSP 24–48 hours after the Pixel / Nexus bulletin is release <a href="/security/bulletin/pixel/2018-03-01.html?hl=ja">日本語</a> / <a href="/security/bulletin/pixel/2018-03-01.html?hl=ko">한국어</a> / <a href="/security/bulletin/pixel/2018-03-01.html?hl=ru">ру́сский</a> / - <!-- <a href="/security/bulletin/pixel/2018-03-01.html?hl=zh-cn">中文 (中国)</a> / - --> <a href="/security/bulletin/pixel/2018-03-01.html?hl=zh-tw">中文 (台灣)</a> </td> <td>March 5, 2018</td> diff --git a/en/security/overview/acknowledgements.html b/en/security/overview/acknowledgements.html index 20d43ae7..efd56c97 100644 --- a/en/security/overview/acknowledgements.html +++ b/en/security/overview/acknowledgements.html @@ -37,7 +37,152 @@ Rewards</a> program.</p> <p>In 2018, the security acknowledgements are listed by month. In prior years, acknowledgements were listed together.</p> -<h4 id="may-2018">May</h4> +<h4 id="june-2018">June</h4> +<table> + <col width="70%"> + <col width="30%"> + <tr> + <th>Researchers</th> + <th>CVEs</th> + </tr> + <tr> + <td>Baozeng Ding (丁保增) (<a href="https://twitter.com/sploving">@sploving</a>), + Pandora Lab of Ali Security + </td> + <td>CVE-2018-5857, CVE-2018-9389 + </td> + </tr> + <tr> + <td>Daniel Kachakil of IOActive + </td> + <td>CVE-2018-9375 + </td> + </tr> + <tr> + <td>Elphet and Gong Guang of Alpha Team, Qihoo 360 Technology Co. Ltd. + </td> + <td>CVE-2018-9348 + </td> + </tr> + <tr> + <td>Hao Chen and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd.</td> + <td>CVE-2018-5899 + </td> + </tr> + <tr> + <td>Jianjun Dai (<a href="https://twitter.com/Jioun_dai">@Jioun_dai</a>) and Guang Gong + (<a href="https://twitter.com/oldfresher">@oldfresher</a>) of Alpha Team,<br /> + Qihoo 360 Technology Co. Ltd</td> + <td>CVE-2018-9381, CVE-2018-9358,<br /> + CVE-2018-9359, CVE-2018-9360,<br /> + CVE-2018-9361, CVE-2018-9357,<br /> + CVE-2018-9356</td> + </tr> + <tr> + <td>joe0x20@gmail.com + </td> + <td>CVE-2018-5898 + </td> + </tr> + <tr> + <td><a href="https://www.linkedin.com/in/jose-maria-ariel-martinez-juarez-7910a189/"> + Jose Martinez</a> + </td> + <td>CVE-2018-5146 + </td> + </tr> + <tr> + <td>Julien Thomas (<a href="https://twitter.com/julien_thomas">@Julien_Thomas</a>) of + <a href="http://protektoid.com/">Protektoid.com</a> + </td> + <td>CVE-2018-9374 + </td> + </tr> + <tr> + <td><a href="https://github.com/michalbednarski">Michał Bednarski</a> + </td> + <td>CVE-2018-9339 + </td> + </tr> + <tr> + <td>Mingjian Zhou (周明建) + (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) + of C0RE Team + </td> + <td>CVE-2018-9344 + </td> + </tr> + <tr> + <td>Niky1235 (<a href="https://twitter.com/jiych_guru">@jiych_guru</a>) + </td> + <td>CVE-2017-13230, CVE-2018-9347 + </td> + </tr> + <tr> + <td>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬)<br /> + of Baidu X-Lab (百度安全实验室) + </td> + <td>CVE-2018-5832 + </td> + </tr> + <tr> + <td>Qing Dong of 360 Beaconlab + </td> + <td>CVE-2018-9386 + </td> + </tr> + <tr> + <td>Scott Bauer (<a href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>) + </td> + <td>CVE-2018-9388, CVE-2018-9355,<br /> + CVE-2018-9380 + </td> + </tr> + <tr> + <td><a href="https://github.com/stze">Stephan Zeisberg</a> of + <a href="https://srlabs.de/">Security Research Labs</a> + </td> + <td>CVE-2018-9350, CVE-2018-9352,<br /> + CVE-2018-9353, CVE-2018-9341 + </td> + </tr> + <tr> + <td>Tencent Blade Team + </td> + <td>CVE-2018-9345, CVE-2018-9346 + </td> + </tr> + <tr> + <td>Yonggang Guo (<a href="https://twitter.com/guoygang">@guoygang</a>) + of IceSword Lab, Qihoo 360 Technology Co. Ltd. + </td> + <td>CVE-2017-0564 + </td> + </tr> + <tr> + <td>Yuan-Tsung Lo of C0RE Team + </td> + <td>CVE-2017-13079, CVE-2017-13081 + </td> + </tr> + <tr> + <td>华为移动安全实验室的钱育波 + </td> + <td>CVE-2018-9363 + </td> + </tr> + <tr> + <td>Zinuo Han of Chengdu Security Response Center, + Qihoo 360 Technology Co. Ltd. + </td> + <td>CVE-2018-9340, CVE-2018-9338,<br /> + CVE-2018-9378 + </td> + </tr> +</table> + + + <h4 id="may-2018">May</h4> <table> <col width="70%"> <col width="30%"> @@ -79,7 +224,8 @@ acknowledgements were listed together.</p> <td>CVE-2017-13310, CVE-2017-13311</td> </tr> <tr> - <td>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬) of Baidu X-Lab (百度安全实验室)</td> + <td>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), and Lenx Wei (韦韬) + of Baidu X-Lab (百度安全实验室)</td> <td>CVE-2017-15857, CVE-2018-5852</td> </tr> <tr> @@ -115,8 +261,8 @@ acknowledgements were listed together.</p> </tr> <tr> <td><a href="http://weibo.com/csddl">Chong Wang</a> and - <a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of Chengdu Security Response Center, Qihoo 360 - Technology Co. Ltd + <a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of Chengdu Security Response Center, + Qihoo 360 Technology Co. Ltd </td> <td>CVE-2017-13289, CVE-2017-13286 </td> @@ -134,8 +280,8 @@ acknowledgements were listed together.</p> </td> </tr> <tr> - <td>Dinesh Venkatesan (<a href="https://twitter.com/malwareresearch">@malwareresearch</a>) of - Symantec + <td>Dinesh Venkatesan (<a href="https://twitter.com/malwareresearch">@malwareresearch</a>) + of Symantec </td> <td>CVE-2017-13295 </td> @@ -178,8 +324,8 @@ acknowledgements were listed together.</p> </td> </tr> <tr> - <td>Jianjun Dai (<a href="https://twitter.com/Jioun_dai">@Jioun_dai</a>) and Guang Gong of Alpha - Team, Qihoo 360 Technology Co. Ltd + <td>Jianjun Dai (<a href="https://twitter.com/Jioun_dai">@Jioun_dai</a>) and + Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd </td> <td>CVE-2017-13291, CVE-2017-13283, CVE-2017-13282, CVE-2017-13281, CVE-2017-13267 </td> @@ -238,7 +384,8 @@ acknowledgements were listed together.</p> <td><a href="http://weibo.com/ele7enxxh">Zinuo Han</a> of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd </td> - <td>CVE-2017-13288, CVE-2017-13298, CVE-2017-13296, CVE-2017-13299, CVE-2017-13275, CVE-2017-13285 + <td>CVE-2017-13288, CVE-2017-13298, CVE-2017-13296, CVE-2017-13299, + CVE-2017-13275, CVE-2017-13285 </td> </tr> </table> @@ -284,18 +431,19 @@ Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd.</td> <td>CVE-2017-13258</td> </tr> <tr> - <td>Hongli Han (<a href="https://twitter.com/hexb1n">@hexb1n</a>), <a -href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a>, and Mingjian Zhou -(周明建) (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a></td> + <td>Hongli Han (<a href="https://twitter.com/hexb1n">@hexb1n</a>), + <a href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a>, and Mingjian Zhou +(周明建) (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-6287</td> </tr> <tr> <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>) and Mingjian Zhou (周明建)(<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a></td> - <td>CVE-2017-6286, CVE-2017-6285, CVE-2017-6281</td> +href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a></td> + <td>CVE-2017-6286, CVE-2017-6285,<br /> + CVE-2017-6281</td> </tr> <tr> <td>Pengfei Ding (丁鹏飞), Chenfu Bao (包沉浮), Lenx Wei (韦韬) of Baidu X-Lab @@ -308,8 +456,8 @@ CVE-2017-15814</td> <td>CVE-2017-13269</td> </tr> <tr> - <td>Tamir Zahavi-Brunner (<a -href="https://twitter.com/tamir_zb">@tamir_zb</a>) of Zimperium zLabs Team</td> + <td>Tamir Zahavi-Brunner + (<a href="https://twitter.com/tamir_zb">@tamir_zb</a>) of Zimperium zLabs Team</td> <td>CVE-2017-13253</td> </tr> <tr> @@ -317,8 +465,8 @@ href="https://twitter.com/tamir_zb">@tamir_zb</a>) of Zimperium zLabs Team</ <td>CVE-2017-13249, CVE-2017-13248, CVE-2017-13264</td> </tr> <tr> - <td>Wish Wu (<a href=" https://twitter.com/wish_wu">@wish_wu</a> <a -href="http://www.weibo.com/wishlinux">吴潍浠</a> 此彼) of Ant-financial Light-Year + <td>Wish Wu (<a href=" https://twitter.com/wish_wu">@wish_wu</a> + <a href="http://www.weibo.com/wishlinux">吴潍浠</a> 此彼) of Ant-financial Light-Year Security Lab</td> <td>CVE-2017-13259, CVE-2017-13272</td> </tr> @@ -392,26 +540,26 @@ of <a href="http://www.ms509.com">MS509Team</a> </td> </tr> <tr> - <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>), <a -href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a> and Mingjian Zhou (<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a> + <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>), + <a href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a> and Mingjian Zhou +(<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a> </td> <td>CVE-2017-6258 </td> </tr> <tr> <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>), Mingjian -Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a> +Zhou (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a> </td> <td>CVE-2017-17767, CVE-2017-6279 </td> </tr> <tr> <td>Mingjian Zhou (周明建) (<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a> +href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a> </td> <td>CVE-2017-13241, CVE-2017-13231 </td> @@ -423,8 +571,8 @@ href="http://c0reteam.org">C0RE Team</a> </td> </tr> <tr> - <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> (<a -href="https://twitter.com/jiych_guru">@jiych_guru</a>) + <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> + (<a href="https://twitter.com/jiych_guru">@jiych_guru</a>) </td> <td>CVE-2017-13230, CVE-2017-13234 </td> @@ -436,9 +584,8 @@ href="https://twitter.com/jiych_guru">@jiych_guru</a>) </td> </tr> <tr> - <td>Qidan He (<a -href="https://twitter.com/flanker_hqd?lang=en">@flanker_hqd</a>) of PDD Security -Team + <td>Qidan He (<a href="https://twitter.com/flanker_hqd?lang=en">@flanker_hqd</a>) + of PDD Security Team </td> <td>CVE-2017-13246 </td> @@ -481,19 +628,19 @@ Response Center of Qihoo 360 Technology Co. Ltd. <th>CVEs</th> </tr> <tr> - <td><a href="mailto:zhangadong@huawei.com">Adong Zhang</a> (张阿东), <a -href="mailto:liuchao741@huawei.com">Chao Liu</a> (刘超), and <a -href="mailto:dongjinguang@huawei.com">Jinguang Dong</a> (董金光)</td> + <td><a href="mailto:zhangadong@huawei.com">Adong Zhang</a> (张阿东), + <a href="mailto:liuchao741@huawei.com">Chao Liu</a> (刘超), and +<a href="mailto:dongjinguang@huawei.com">Jinguang Dong</a> (董金光)</td> <td>CVE-2017-13215</td> </tr> <tr> - <td><a href="https://twitter.com/amarekano">Amar Menezes</a> of <a -href="https://labs.mwrinfosecurity.com/">MWR Labs</a></td> + <td><a href="https://twitter.com/amarekano">Amar Menezes</a> of + <a href="https://labs.mwrinfosecurity.com/">MWR Labs</a></td> <td>CVE-2017-13212</td> </tr> <tr> - <td>Andy Tyler (<a href="https://twitter.com/ticarpi">@ticarpi</a>) of <a -href="http://www.e2e-assure.com ">e2e-assure</a></td> + <td>Andy Tyler (<a href="https://twitter.com/ticarpi">@ticarpi</a>) of + <a href="http://www.e2e-assure.com ">e2e-assure</a></td> <td>CVE-2017-0846</td> </tr> <tr> @@ -511,8 +658,8 @@ Chengming Yang, and Yang Song of Pandora Lab, Ali Security</td> </tr> <tr> <td><a href="mailto:zc1991@mail.ustc.edu.cn">Chi Zhang</a> and Mingjian Zhou -(<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a></td> +(<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13178, CVE-2017-13179</td> </tr> <tr> @@ -530,10 +677,10 @@ of <a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13183, CVE-2017-13180</td> </tr> <tr> - <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>), <a -href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a>, and Mingjian Zhou (<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a></td> + <td>Hongli Han (<a href="https://twitter.com/HexB1n">@HexB1n</a>), + <a href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a>, and Mingjian Zhou + (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of + <a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13194</td> </tr> <tr> @@ -541,14 +688,14 @@ href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13224</td> </tr> <tr> - <td>Mingjian Zhou (周明建) (<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org">C0RE Team</a></td> + <td>Mingjian Zhou (周明建) + (<a href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of + <a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13184, CVE-2017-13201</td> </tr> <tr> - <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> (<a -href="https://twitter.com/jiych_guru">@jiych_guru</a>)</td> + <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> + (<a href="https://twitter.com/jiych_guru">@jiych_guru</a>)</td> <td>CVE-2017-0855, CVE-2017-13195, CVE-2017-13181</td> </tr> <tr> @@ -563,9 +710,9 @@ Academy of Sciences</td> <td>CVE-2017-13176</td> </tr> <tr> - <td>V.E.O (<a href="https://twitter.com/vysea">@VYSEa</a>) of <a -href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile/">Mobile -Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro</a></td> + <td>V.E.O (<a href="https://twitter.com/vysea">@VYSEa</a>) of + <a href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile/"> + Mobile Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro</a></td> <td>CVE-2017-13196, CVE-2017-13186</td> </tr> <tr> @@ -577,8 +724,7 @@ Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro</a></t <td>CVE-2017-13217</td> </tr> <tr> - <td>Yangkang (<a href="https://twitter.com/dnpushme">@dnpushme</a>) of -Qihoo360 Qex Team</td> + <td>Yangkang (<a href="https://twitter.com/dnpushme">@dnpushme</a>) of Qihoo360 Qex Team</td> <td>CVE-2017-13200</td> </tr> <tr> @@ -587,13 +733,13 @@ and Yuebin Sun of <a href="http://xlab.tencent.com">Tencent's Xuanwu Lab</a></td <td>CVE-2017-13202</td> </tr> <tr> - <td><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a> of <a -href="http://c0reteam.org">C0RE Team</a></td> + <td><a href="mailto:computernik@gmail.com">Yuan-Tsung Lo</a> of + <a href="http://c0reteam.org">C0RE Team</a></td> <td>CVE-2017-13213, CVE-2017-13221</td> </tr> <tr> - <td><a href="http://weibo.com/panyu6325">Yu Pan</a> and <a -href="mailto:huahuaisadog@gmail.com">Yang Dai</a> of Vulpecker Team, Qihoo 360 + <td><a href="http://weibo.com/panyu6325">Yu Pan</a> and + <a href="mailto:huahuaisadog@gmail.com">Yang Dai</a> of Vulpecker Team, Qihoo 360 Technology Co. Ltd.</td> <td>CVE-2017-0869</td> </tr> @@ -694,8 +840,8 @@ CVE-2017-11000, CVE-2017-11059, CVE-2017-13170</td> <td>CVE-2017-0860</td> </tr> <tr> - <td><a href="mailto:zc1991@mail.ustc.edu.cn">Chi Zhang</a> of <a -href="https://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:zc1991@mail.ustc.edu.cn">Chi Zhang</a> of + <a href="https://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0666, CVE-2017-0681, CVE-2017-0684, CVE-2017-0765, CVE-2017-0836, CVE-2017-0857, CVE-2017-0880, CVE-2017-13166</td> </tr> @@ -727,8 +873,8 @@ Palo Alto Networks</td> <td>CVE-2017-0870</td> </tr> <tr> - <td><a href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:shaodacheng2016@gmail.com">Dacheng Shao</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0483, CVE-2017-0739, CVE-2017-0769, CVE-2017-0801</td> </tr> <tr> @@ -737,8 +883,7 @@ href="http://c0reteam.org/">C0RE Team</a></td> </tr> <tr> <td>Daniel Micay of Copperhead Security</td> - <td>CVE-2017-0397, CVE-2017-0405, CVE-2017-0410, CVE-2017-0826, - CVE-2017-13160</td> + <td>CVE-2017-0397, CVE-2017-0405, CVE-2017-0410, CVE-2017-0826, CVE-2017-13160</td> </tr> <tr> <td>Daxing Guo (<a href="https://twitter.com/freener0">@freener0</a>) of @@ -746,8 +891,8 @@ Xuanwu Lab, Tencent</td> <td>CVE-2017-0386, CVE-2017-0553, CVE-2017-0585, CVE-2017-0706</td> </tr> <tr> - <td><a href="mailto:derrek.haxx@gmail.com">derrek</a> (<a -href="https://twitter.com/derrekr6">@derrekr6</a>)</td> + <td><a href="mailto:derrek.haxx@gmail.com">derrek</a> + (<a href="https://twitter.com/derrekr6">@derrekr6</a>)</td> <td>CVE-2016-8413, CVE-2016-8477, CVE-2017-0392, CVE-2017-0521, CVE-2017-0531, CVE-2017-0576, CVE-2017-8260</td> </tr> @@ -780,8 +925,8 @@ CVE-2017-0525, CVE-2017-8265</td> <td>CVE-2017-0692, CVE-2017-0694, CVE-2017-0771, CVE-2017-0774, CVE-2017-0775</td> </tr> <tr> - <td>En He (<a href="http://twitter.com/heeeeen4x">@heeeeen4x</a>) of <a -href="http://www.ms509.com/">MS509Team</a></td> + <td>En He (<a href="http://twitter.com/heeeeen4x">@heeeeen4x</a>) of + <a href="http://www.ms509.com/">MS509Team</a></td> <td>CVE-2017-0394, CVE-2017-0490, CVE-2017-0601, CVE-2017-0639, CVE-2017-0645, CVE-2017-0784, CVE-2017-11042</td> </tr> @@ -808,8 +953,8 @@ CVE-2017-0645, CVE-2017-0784, CVE-2017-11042</td> CVE-2017-0570, CVE-2017-0571, CVE-2017-0572</td> </tr> <tr> - <td>Gengjia Chen (<a -href="https://twitter.com/chengjia4574">@chengjia4574</a>) of IceSword Lab, + <td>Gengjia Chen + (<a href="https://twitter.com/chengjia4574">@chengjia4574</a>) of IceSword Lab, Qihoo 360 Technology Co. Ltd.</td> <td>CVE-2016-8464, CVE-2016-10285, CVE-2016-10288, CVE-2016-10290, CVE-2016-10294, CVE-2016-10295, CVE-2016-10296, CVE-2017-0329, CVE-2017-0332, @@ -853,8 +998,8 @@ CVE-2017-0825, CVE-2017-6424, CVE-2017-14904</td> <td>CVE-2017-0496</td> </tr> <tr> - <td><a -href="https://www.linkedin.com/in/g%C3%BCliz-seray-tuncay-952a1b9/">Güliz Seray + <td> + <a href="https://www.linkedin.com/in/g%C3%BCliz-seray-tuncay-952a1b9/">Güliz Seray Tuncay</a> of the <a href="http://tuncay2.web.engr.illinois.edu/">University of Illinois at Urbana-Champaign</a></td> <td>CVE-2017-0593</td> @@ -864,8 +1009,8 @@ Illinois at Urbana-Champaign</a></td> <td>CVE-2017-13172</td> </tr> <tr> - <td><a href="mailto:arnow117@gmail.com">Hanxiang Wen</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:arnow117@gmail.com">Hanxiang Wen</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0400, CVE-2017-0418, CVE-2017-0479, CVE-2017-0480, CVE-2017-0665, CVE-2017-0681, CVE-2017-0737, CVE-2017-14904</td> </tr> @@ -936,9 +1081,8 @@ CVE-2017-0792, CVE-2017-0825, CVE-2017-6424</td> <td>CVE-2017-0478, CVE-2017-0541, CVE-2017-0559</td> </tr> <tr> - <td>Jianqiang Zhao (<a -href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) of IceSword Lab, -Qihoo 360</td> + <td>Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) + of IceSword Lab, Qihoo 360</td> <td>CVE-2016-5346, CVE-2016-8416, CVE-2016-8475, CVE-2016-8478, CVE-2017-0445, CVE-2017-0458, CVE-2017-0459, CVE-2017-0518, CVE-2017-0519, CVE-2017-0533, CVE-2017-0534, CVE-2017-0862, CVE-2017-6425, CVE-2017-8233, @@ -953,9 +1097,8 @@ CVE-2017-8261, CVE-2017-8268, CVE-2017-9718, CVE-2017-1000380</td> <td>CVE-2016-8461, CVE-2016-8462</td> </tr> <tr> - <td><a -href="https://www.linkedin.com/in/jose-maria-ariel-martinez-juarez-7910a189/">Jose -Martinez</a></td> + <td><a href="https://www.linkedin.com/in/jose-maria-ariel-martinez-juarez-7910a189/"> + Jose Martinez</a></td> <td>CVE-2017-0841</td> </tr> <tr> @@ -991,8 +1134,8 @@ CVE-2017-11060, CVE-2017-11061, CVE-2017-11064, CVE-2017-11089, CVE-2017-11090</ <td>CVE-2017-13165</td> </tr> <tr> - <td><a href="mailto:zlbzlb815@163.com">Lubo Zhang</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:zlbzlb815@163.com">Lubo Zhang</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2016-8479, CVE-2017-0564, CVE-2017-7368</td> </tr> <tr> @@ -1030,8 +1173,8 @@ Tesla Motors Product Security Team</td> </tr> <tr> <td>Mingjian Zhou (<a -href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of <a -href="http://c0reteam.org/">C0RE Team</a></td> +href="https://twitter.com/Mingjian_Zhou">@Mingjian_Zhou</a>) of +<a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0383, CVE-2017-0417, CVE-2017-0418, CVE-2017-0425, CVE-2017-0450, CVE-2017-0479, CVE-2017-0480, CVE-2017-0483, CVE-2017-0665, CVE-2017-0666, CVE-2017-0681, CVE-2017-0684, CVE-2017-0731, CVE-2017-0737, @@ -1068,8 +1211,8 @@ CVE-2017-0606, CVE-2017-8242, CVE-2017-9679</td> <td>CVE-2016-5552</td> </tr> <tr> - <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> (<a -href="https://twitter.com/jiych_guru">@jiych_guru</a>)</td> + <td><a href="mailto:jiych.guru@gmail.com">Niky1235</a> + (<a href="https://twitter.com/jiych_guru">@jiych_guru</a>)</td> <td>CVE-2017-0603, CVE-2017-0670, CVE-2017-0697, CVE-2017-0726, CVE-2017-0818</td> </tr> <tr> @@ -1127,9 +1270,8 @@ CVE-2017-8243, CVE-2017-8244, CVE-2017-8261, CVE-2017-8266, CVE-2017-8268, CVE-2017-8270, CVE-2017-9691, CVE-2017-9718, CVE-2017-10997, CVE-2017-1000380</td> </tr> <tr> - <td>Qidan He (何淇丹) (<a -href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) of KeenLab, Tencent -(腾讯科恩实验室)</td> + <td>Qidan He (何淇丹) (<a href="https://twitter.com/flanker_hqd">@flanker_hqd</a>) + of KeenLab, Tencent (腾讯科恩实验室)</td> <td>CVE-2017-0325, CVE-2017-0337, CVE-2017-0382, CVE-2017-0427, CVE-2017-0476, CVE-2017-0544, CVE-2017-0861, CVE-2017-0866, CVE-2017-13167, CVE-2017-15868</td> @@ -1171,15 +1313,14 @@ Shellphish Grill Team, UC Santa Barbara</td> <td>CVE-2017-0505, CVE-2017-13168</td> </tr> <tr> - <td><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a> (<a -href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>)</td> + <td><a href="mailto:sbauer@plzdonthack.me">Scott Bauer</a> + (<a href="https://twitter.com/ScottyBauer1">@ScottyBauer1</a>)</td> <td>CVE-2016-10274, CVE-2017-0339, CVE-2017-0405, CVE-2017-0504, CVE-2017-0516, CVE-2017-0521, CVE-2017-0562, CVE-2017-0576, CVE-2017-0705, CVE-2017-0740, CVE-2017-8259, CVE-2017-8260, CVE-2017-9680, CVE-2017-11053, CVE-2017-13160</td> </tr> <tr> - <td>Sean Beaupre (<a -href="https://twitter.com/firewaterdevs">@firewaterdevs</a>)</td> + <td>Sean Beaupre (<a href="https://twitter.com/firewaterdevs">@firewaterdevs</a>)</td> <td>CVE-2016-8461, CVE-2016-8462, CVE-2017-0455</td> </tr> <tr> @@ -1198,8 +1339,8 @@ CVE-2017-0780, CVE-2017-6247, CVE-2017-6248, CVE-2017-6249, CVE-2017-7369</td> <td>CVE-2017-0860</td> </tr> <tr> - <td><a href="mailto:smarques84@gmail.com">Stéphane Marques</a> of <a -href="http://www.byterev.com/">ByteRev</a></td> + <td><a href="mailto:smarques84@gmail.com">Stéphane Marques</a> of + <a href="http://www.byterev.com/">ByteRev</a></td> <td>CVE-2017-0489</td> </tr> <tr> @@ -1219,15 +1360,15 @@ href="http://www.byterev.com/">ByteRev</a></td> <td>CVE-2017-0667, CVE-2017-0732, CVE-2017-0805</td> </tr> <tr> - <td><a href="mailto:segfault5514@gmail.com">Tong Lin</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:segfault5514@gmail.com">Tong Lin</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2016-8425, CVE-2016-8426, CVE-2016-8449, CVE-2016-8479, CVE-2016-8481, CVE-2016-10291, CVE-2017-0333, CVE-2017-0428, CVE-2017-0435, CVE-2017-0436, CVE-2017-10661</td> </tr> <tr> - <td>Uma Sankar Pradhan (<a -href="https://twitter.com/umasankar_iitd">@umasankar_iitd</a>)</td> + <td>Uma Sankar Pradhan + (<a href="https://twitter.com/umasankar_iitd">@umasankar_iitd</a>)</td> <td>CVE-2017-0560</td> </tr> <tr> @@ -1271,8 +1412,8 @@ Alibaba Inc.</td> <td>CVE-2017-0860</td> </tr> <tr> - <td><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0384, CVE-2017-0385, CVE-2017-0398, CVE-2017-0400, CVE-2017-0401, CVE-2017-0402, CVE-2017-0417, CVE-2017-0418, CVE-2017-0450, CVE-2017-0483, CVE-2017-0768, CVE-2017-0779, CVE-2017-0812, CVE-2017-0815, @@ -1284,9 +1425,9 @@ of Alpha Team, Qihoo 360 Technology Co. Ltd.</td> <td>CVE-2017-0577, CVE-2017-0580</td> </tr> <tr> - <td>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) (<a -href="http://www.weibo.com/wishlinux">吴潍浠</a> 此彼) of Ant-financial Light-Year -Security Lab</td> + <td>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) + (<a href="http://www.weibo.com/wishlinux">吴潍浠</a> 此彼) + of Ant-financial Light-Year Security Lab</td> <td>CVE-2017-0408, CVE-2017-0477, CVE-2017-11063, CVE-2017-11092</td> </tr> <tr> @@ -1303,8 +1444,8 @@ CVE-2017-11073, CVE-2017-11093</td> <td>CVE-2017-0752</td> </tr> <tr> - <td><a href="mailto:wisedd@gmail.com">Xiaodong Wang</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:wisedd@gmail.com">Xiaodong Wang</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2017-0429, CVE-2017-0448</td> </tr> <tr> @@ -1338,8 +1479,8 @@ CVE-2017-0801, CVE-2017-7368, CVE-2017-8264, CVE-2017-10661</td> <td>CVE-2017-9678</td> </tr> <tr> - <td><a href="mailto:bigwyfone@gmail.com">Yanfeng Wang</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:bigwyfone@gmail.com">Yanfeng Wang</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2016-8430, CVE-2016-8482</td> </tr> <tr> @@ -1372,8 +1513,8 @@ Team, Qihoo 360</td> <td>CVE-2017-0647, CVE-2017-0690, CVE-2017-0753</td> </tr> <tr> - <td><a href="mailto:yaojun8558363@gmail.com">Yao Jun</a> of <a -href="http://c0reteam.org/">C0RE Team</a></td> + <td><a href="mailto:yaojun8558363@gmail.com">Yao Jun</a> of + <a href="http://c0reteam.org/">C0RE Team</a></td> <td>CVE-2016-8431, CVE-2016-8432, CVE-2016-8435, CVE-2016-8480</td> </tr> <tr> @@ -1450,9 +1591,9 @@ Co. Ltd.</td> <td>CVE-2017-0758, CVE-2017-0760</td> </tr> <tr> - <td><a href="mailto:zhouzhenster@gmail.com">Zhen Zhou</a> (<a -href="https://twitter.com/henices">@henices</a>) of <a -href="http://www.nsfocus.com/">NSFocus</a></td> + <td><a href="mailto:zhouzhenster@gmail.com">Zhen Zhou</a> + (<a href="https://twitter.com/henices">@henices</a>) of +<a href="http://www.nsfocus.com/">NSFocus</a></td> <td>CVE-2017-0406</td> </tr> <tr> @@ -1575,7 +1716,8 @@ Telecommunications</a></p> <p><a href="mailto:dshe002@ucr.edu">Dongdong She</a> of UC Riverside</p> -<p>Dongkwan Kim (<a href="mailto:dkay@kaist.ac.kr">dkay@kaist.ac.kr</a>) of System Security Lab, KAIST</p> +<p>Dongkwan Kim (<a href="mailto:dkay@kaist.ac.kr">dkay@kaist.ac.kr</a>) +of System Security Lab, KAIST</p> <p>dosomder</p> @@ -1622,7 +1764,8 @@ Telecommunications</a></p> <p>Herbert Bos of Vrije Universiteit Amsterdam</p> -<p>Hongil Kim (<a href="mailto:hongilk@kaist.ac.kr">hongilk@kaist.ac.kr</a>) of System Security Lab, KAIST</p> +<p>Hongil Kim (<a href="mailto:hongilk@kaist.ac.kr">hongilk@kaist.ac.kr</a>) +of System Security Lab, KAIST</p> <p>Imre Rad of <a href="http://www.search-lab.hu/">Search-Lab Ltd.</a></p> @@ -1640,7 +1783,8 @@ Telecommunications</a></p> <p>jfang of KEEN lab, Tencent (<a href="https://twitter.com/k33nteam">@K33nTeam</a>)</p> -<p>Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) of IceSword Lab, Qihoo 360</p> +<p>Jianqiang Zhao (<a href="https://twitter.com/jianqiangzhao">@jianqiangzhao</a>) +of IceSword Lab, Qihoo 360</p> <p>Joshua Drake (<a href="https://twitter.com/jduck">@jduck</a>)</p> @@ -1681,10 +1825,10 @@ Fortinet's FortiGuard Labs</p> <p>Max Spector of Google</p> -<p>MengLuo Gou (<a href="https://twitter.com/idhyt3r">@idhyt3r</a>) of Bottle - Tech</p> +<p>MengLuo Gou (<a href="https://twitter.com/idhyt3r">@idhyt3r</a>) of Bottle Tech</p> -<p>Michał Bednarski (<a href="https://github.com/michalbednarski">github.com/michalbednarski</a>)</p> +<p>Michał Bednarski (<a href="https://github.com/michalbednarski"> +github.com/michalbednarski</a>)</p> <p>Mike Maarse</p> @@ -1702,7 +1846,8 @@ Fortinet's FortiGuard Labs</p> <p>Nathan Crandall (<a href="https://twitter.com/natecray">@natecray</a>) of Tesla Motors Product Security Team</p> -<p>Nico Golde (<a href="https://twitter.com/iamnion">@iamnion</a>) of Qualcomm Product Security Initiative</p> +<p>Nico Golde (<a href="https://twitter.com/iamnion">@iamnion</a>) of +Qualcomm Product Security Initiative</p> <p>Nightwatch Cybersecurity Research (<a href="https://twitter.com/nightwatchcyber">@nightwatchcyber</a>)</p> @@ -1768,8 +1913,8 @@ of TEAM Lv51</p> <p>Sharvil Nanavati of Google</p> <p>Shinjo Park (<a href="https://twitter.com/ad_ili_rai">@ad_ili_rai</a>) of -<a href="http://www.isti.tu-berlin.de/security_in_telecommunications">Security in -Telecommunications</a></p> +<a href="http://www.isti.tu-berlin.de/security_in_telecommunications"> +Security in Telecommunications</a></p> <p>Stuart Henderson</p> @@ -1805,25 +1950,25 @@ SentinelOne / RedNaga</p> <p>Vishwath Mohan of Android Security</p> -<p>Wei Wei (<a href="https://twitter.com/Danny__Wei">@Danny__Wei</a>) of Xuanwu - LAB, Tencent</p> +<p>Wei Wei (<a href="https://twitter.com/Danny__Wei">@Danny__Wei</a>) of Xuanwu LAB, Tencent</p> <p>Weichao Sun (<a href="https://twitter.com/sunblate">@sunblate</a>) of Alibaba Inc</p> <p>Wen Niu (<a href="https://twitter.com/NWMonster">@NWMonster</a>) of KeenLab (<a href="https://twitter.com/keen_lab">@keen_lab</a>), Tencent</p> -<p><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a> of <a href="http://c0reteam.org">C0RE Team</a></p> +<p><a href="mailto:vancouverdou@gmail.com">Wenke Dou</a> of <a href="http://c0reteam.org"> +C0RE Team</a></p> <p>Wenlin Yang of Alpha Team, Qihoo 360 Technology Co. Ltd.</p> -<p>William Roberts (<a href="mailto:william.c.roberts@intel.com">william.c.roberts@intel.com</a>)</p> +<p>William Roberts (<a href="mailto:william.c.roberts@intel.com"> +william.c.roberts@intel.com</a>)</p> -<p>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) (<a - href="http://weibo.com/wishlinux">吴潍浠</a>) of <a - href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile/">Mobile - Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro - Inc.</a></p> +<p>Wish Wu (<a href="https://twitter.com/wish_wu">@wish_wu</a>) +(<a href="http://weibo.com/wishlinux">吴潍浠</a>) of +<a href="http://blog.trendmicro.com/trendlabs-security-intelligence/category/mobile/"> +Mobile Threat Response Team</a>, <a href="http://www.trendmicro.com">Trend Micro Inc.</a></p> <p><a href="mailto:wisedd@gmail.com">Xiaodong Wang</a> of @@ -1930,9 +2075,11 @@ of Alibaba Inc.</p> <p>dragonltx of Alibaba Mobile Security Team</p> -<p>Gal Beniamini (<a href="http://bits-please.blogspot.com/">http://bits-please.blogspot.com</a>)</p> +<p>Gal Beniamini (<a href="http://bits-please.blogspot.com/"> +http://bits-please.blogspot.com</a>)</p> -<p>Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>, higongguang@gmail.com) of <a href="http://www.360.cn/">Qihoo 360 Technology Co.Ltd</a></p> +<p>Guang Gong (龚广) (<a href="https://twitter.com/oldfresher">@oldfresher</a>, +higongguang@gmail.com) of <a href="http://www.360.cn/">Qihoo 360 Technology Co.Ltd</a></p> <p>Hongil Kim of System Security Lab, KAIST (hongilk@kaist.ac.kr)</p> @@ -1954,15 +2101,19 @@ Buenos Aires Argentina</p> <p>Lei Wu of C0RE Team from Qihoo 360</p> -<p>Marco Grassi (<a href="https://twitter.com/marcograss">@marcograss</a>) of <a href="http://k33nteam.org/">KeenTeam</a> (<a href="https://twitter.com/k33nteam">@K33nTeam</a>)</p> +<p>Marco Grassi (<a href="https://twitter.com/marcograss">@marcograss</a>) of +<a href="http://k33nteam.org/">KeenTeam</a> +(<a href="https://twitter.com/k33nteam">@K33nTeam</a>)</p> -<p>Mark Carter (<a href="https://twitter.com/hanpingchinese">@hanpingchinese</a>) of EmberMitre Ltd</p> +<p>Mark Carter (<a href="https://twitter.com/hanpingchinese">@hanpingchinese</a>) +of EmberMitre Ltd</p> <p>Martin Barbella, Google Chrome Security Team</p> <p>Michael Peck of <a href="https://www.mitre.org/">The MITRE Corporation</a> (mpeck@mitre.org)</p> -<p>Michał Bednarski (<a href="https://github.com/michalbednarski">https://github.com/michalbednarski</a>)</p> +<p>Michał Bednarski (<a href="https://github.com/michalbednarski"> +https://github.com/michalbednarski</a>)</p> <p>Michael Roland of JR-Center u'smile at University of Applied Scienses, Upper Austria/Hagenberg</p> @@ -1975,7 +2126,8 @@ Austria/Hagenberg</p> <p>Ping Li of Qihoo 360 Technology Co. Ltd</p> -<p>Qidan He (@flanker_hqd) from KeenTeam (@K33nTeam, <a href="http://k33nteam.org/">http://k33nteam.org/</a>)</p> +<p>Qidan He (@flanker_hqd) from KeenTeam (@K33nTeam, <a href="http://k33nteam.org/"> +http://k33nteam.org/</a>)</p> <p>Roee Hay and Or Peles</p> @@ -1984,7 +2136,8 @@ Austria/Hagenberg</p> <p>Siegfried Rasthofer of <a href="https://blogs.uni-paderborn.de/sse/"> Secure Software Engineering Group</a>, EC SPRIDE Technische Universität</p> -<p>Stephan Huber of Testlab Mobile Security, <a href="https://www.sit.fraunhofer.de/">Fraunhofer SIT</a> (Stephan.Huber@sit.fraunhofer.de)</p> +<p>Stephan Huber of Testlab Mobile Security, <a href="https://www.sit.fraunhofer.de/">F +raunhofer SIT</a> (Stephan.Huber@sit.fraunhofer.de)</p> <p>Steven Vittitoe of Google Project Zero</p> @@ -1996,9 +2149,11 @@ href="http://tonybeltramelli.com/">tonybeltramelli.com</a></p> <p>Wangtao(neobyte) of Baidu X-Team</p> -<p>Wen Xu (@antlr7) from KeenTeam (@K33nTeam, <a href="http://k33nteam.org/">http://k33nteam.org/</a>)</p> +<p>Wen Xu (@antlr7) from KeenTeam (@K33nTeam, <a href="http://k33nteam.org/"> +http://k33nteam.org/</a>)</p> -<p>William Roberts (<a href="mailto:william.c.roberts@intel.com">william.c.roberts@intel.com</a>)</p> +<p>William Roberts (<a href="mailto:william.c.roberts@intel.com"> +william.c.roberts@intel.com</a>)</p> <p>Wish Wu of Trend Micro Inc. (@wish_wu)</p> @@ -2018,14 +2173,17 @@ href="mailto:amangel@gmail.com">amangel@gmail.com</a>)</p> <p>Alexandru Gheorghita</p> -<p><a href="https://twitter.com/isciurus">Andrey Labunets</a> of <a href="https://www.facebook.com">Facebook</a></p> +<p><a href="https://twitter.com/isciurus">Andrey Labunets</a> +of <a href="https://www.facebook.com">Facebook</a></p> <p><a href="http://www.corkami.com">Ange Albertini</a> (<a href="https://twitter.com/angealbertini">@angealbertini</a>)</p> <p>Axelle Apvrille of Fortinet, FortiGuards Labs</p> -<p><a href="http://www.linkedin.com/in/danamodio">Dan Amodio</a> of <a href="https://www.aspectsecurity.com/">Aspect Security</a> (<a href="https://twitter.com/DanAmodio">@DanAmodio</a>)</p> +<p><a href="http://www.linkedin.com/in/danamodio">Dan Amodio</a> of +<a href="https://www.aspectsecurity.com/">Aspect Security</a> +(<a href="https://twitter.com/DanAmodio">@DanAmodio</a>)</p> <p><a href="http://davidmurdoch.com">David Murdoch</a></p> @@ -2034,14 +2192,14 @@ href="https://twitter.com/henryhoggard">@HenryHoggard</a>)</p> <p>Imre Rad of <a href="http://www.search-lab.hu/">Search-Lab Ltd.</a></p> -<p><a href="http://thejh.net/">Jann Horn</a> <a href="https://android-review.googlesource.com/#/c/98197/"> +<p><a href="http://thejh.net/">Jann Horn</a> +<a href="https://android-review.googlesource.com/#/c/98197/"> <img style="vertical-align:middle;" src="../images/tiny-robot.png" alt="Green Droid Patch Symbol" title="This person contributed code that improved Android security"> </a></p> -<p>Jeff Forristal of <a href="http://www.bluebox.com/">Bluebox -Security</a></p> +<p>Jeff Forristal of <a href="http://www.bluebox.com/">Bluebox Security</a></p> <p><a href="http://blog.redfern.me/">Joseph Redfern</a> of <a href="https://labs.mwrinfosecurity.com/">MWR Labs</a> <br>(<a @@ -2072,7 +2230,8 @@ title="This person contributed code that improved Android security"></a></p> <p><a href="http://www.samsung.com">Samsung Mobile</a></p> -<p>Scotty Bauer of University of Utah (<a href="mailto:sbauer@eng.utah.edu">sbauer@eng.utah.edu</a>)</p> +<p>Scotty Bauer of University of Utah +(<a href="mailto:sbauer@eng.utah.edu">sbauer@eng.utah.edu</a>)</p> <p>Sebastian Brenza</p> @@ -2098,7 +2257,8 @@ alt="Patch Symbol" title="This person contributed code that improved Android sec Engineering Group</a>, EC SPRIDE Technische Universität Darmstadt (<a href="mailto:Steven.Arzt@ec-spride.de">Steven.Arzt@ec-spride.de</a>)</p> -<p><a href="http://www.subodh.io">Subodh Iyengar</a> of <a href="https://www.facebook.com">Facebook</a></p> +<p><a href="http://www.subodh.io">Subodh Iyengar</a> of +<a href="https://www.facebook.com">Facebook</a></p> <p>Tongxin Li of Peking University (<a href="mailto:litongxin1991@gmail.com">litongxin1991@gmail.com</a>)</p> @@ -2113,11 +2273,14 @@ href="https://twitter.com/tushardalvi">@tushardalvi</a>)</p> <p><a href="https://plus.google.com/u/0/109528607786970714118">Valera Neronov</a></p> -<p>Wang Tao of <a href="http://xteam.baidu.com">Baidu X-Team</a> (<a href="mailto:wintao@gmail.com">wintao@gmail.com</a>)</p> +<p>Wang Tao of <a href="http://xteam.baidu.com">Baidu X-Team</a> +(<a href="mailto:wintao@gmail.com">wintao@gmail.com</a>)</p> -<p>Wang Yu of <a href="http://xteam.baidu.com">Baidu X-Team</a> (<a href="https://twitter.com/xi4oyu">@xi4oyu</a>)</p> +<p>Wang Yu of <a href="http://xteam.baidu.com">Baidu X-Team</a> +(<a href="https://twitter.com/xi4oyu">@xi4oyu</a>)</p> -<p><a href="http://www.shackleton.io/">Will Shackleton</a> of <a href="https://www.facebook.com">Facebook</a></p> +<p><a href="http://www.shackleton.io/">Will Shackleton</a> of +<a href="https://www.facebook.com">Facebook</a></p> <p><a href="http://www.linkedin.com/in/billcroberts"> William Roberts</a> (<a href="mailto:bill.c.roberts@gmail.com">bill.c.roberts@gmail.com</a>) @@ -2127,24 +2290,24 @@ William Roberts</a> (<a href="mailto:bill.c.roberts@gmail.com">bill.c.roberts@gm alt="Patch Symbol" title="This person contributed code that improved Android security"></a></p> <p><a href="http://www.informatics.indiana.edu/xw7/">Xiaofeng Wang</a> of -Indiana University Bloomington (<a -href="mailto:xw7@indiana.edu">xw7@indiana.edu</a>)</p> +Indiana University Bloomington (<a href="mailto:xw7@indiana.edu">xw7@indiana.edu</a>)</p> -<p>Xiaoyong Zhou of <a -href="http://www.cs.indiana.edu/~zhou/">Indiana University Bloomington</a> <br>(<a -href="https://twitter.com/xzhou">@xzhou</a>, <a -href="mailto:zhou.xiaoyong@gmail.com">zhou.xiaoyong@gmail.com</a>)</p> +<p>Xiaoyong Zhou of <a href="http://www.cs.indiana.edu/~zhou/"> +Indiana University Bloomington</a> <br> +(<a href="https://twitter.com/xzhou">@xzhou</a>, +<a href="mailto:zhou.xiaoyong@gmail.com">zhou.xiaoyong@gmail.com</a>)</p> -<p>Xinhui Han of Peking University (<a -href="mailto:hanxinhui@pku.edu.cn">hanxinhui@pku.edu.cn</a>)</p> +<p>Xinhui Han of Peking University +(<a href="mailto:hanxinhui@pku.edu.cn">hanxinhui@pku.edu.cn</a>)</p> -<p>Yeonjoon Lee of Indiana University Bloomington (<a -href="mailto:luc2yj@gmail.com">luc2yj@gmail.com</a>)</p> +<p>Yeonjoon Lee of Indiana University Bloomington +(<a href="mailto:luc2yj@gmail.com">luc2yj@gmail.com</a>)</p> -<p><a href="http://www.androbugs.com">Yu-Cheng Lin 林禹成</a> (<a -href="https://twitter.com/AndroBugs">@AndroBugs</a>)</p> +<p><a href="http://www.androbugs.com">Yu-Cheng Lin 林禹成</a> +(<a href="https://twitter.com/AndroBugs">@AndroBugs</a>)</p> -<p>Zhang Dong Hui of <a href="http://xteam.baidu.com">Baidu X-Team</a> (<a href="http://weibo.com/shineastdh">shineastdh</a>)</p> +<p>Zhang Dong Hui of <a href="http://xteam.baidu.com">Baidu X-Team</a> +(<a href="http://weibo.com/shineastdh">shineastdh</a>)</p> </div> @@ -2188,7 +2351,8 @@ at Urbana-Champaign</a> <p>Qualcomm Product Security Initiative</p> -<p><a href="https://securityresear.ch/">Roee Hay</a> (<a href="https://twitter.com/roeehay">@roeehay</a>, +<p><a href="https://securityresear.ch/">Roee Hay</a> +(<a href="https://twitter.com/roeehay">@roeehay</a>, <a href="mailto:roeehay@gmail.com">roeehay@gmail.com</a>)</p> <p>Robert Craig of <a href="https://www.nsa.gov/research/ia_research/"> @@ -2214,9 +2378,11 @@ William Roberts</a> (<a href="mailto:bill.c.roberts@gmail.com">bill.c.roberts@gm <img style="vertical-align:middle" src="../images/tiny-robot.png" alt="Patch Symbol" title="This person contributed code that improved Android security"></a></p> -<p>Xiaorui Pan of Indiana University Bloomington (<a href="mailto:eagle200467@gmail.com">eagle200467@gmail.com</a>)</p> +<p>Xiaorui Pan of Indiana University Bloomington +(<a href="mailto:eagle200467@gmail.com">eagle200467@gmail.com</a>)</p> -<p>XiaoFeng Wang of Indiana University Bloomington (<a href="mailto:xw7@indiana.edu">xw7@indiana.edu</a>)</p> +<p>XiaoFeng Wang of Indiana University Bloomington +(<a href="mailto:xw7@indiana.edu">xw7@indiana.edu</a>)</p> </div> @@ -2230,7 +2396,8 @@ of <a href="https://viaforensics.com/">viaForensics</a></p> <p><a href="http://thejh.net/">Jann Horn</a></p> -<p>Ravishankar Borgaonkari (<a href="https://twitter.com/raviborgaonkar">@raviborgaonkar</a>) of TU Berlin</p> +<p>Ravishankar Borgaonkari (<a href="https://twitter.com/raviborgaonkar">@raviborgaonkar</a>) +of TU Berlin</p> <p>Robert Craig of <a href="https://www.nsa.gov/research/ia_research/"> Trusted Systems Research Group</a>, US National Security Agency @@ -2238,7 +2405,8 @@ Trusted Systems Research Group</a>, US National Security Agency <img style="vertical-align:middle" src="../images/tiny-robot.png" alt="Patch Symbol" title="This person contributed code that improved Android security"></a></p> -<p><a href="https://securityresear.ch/">Roee Hay</a> (<a href="https://twitter.com/roeehay">@roeehay</a>, +<p><a href="https://securityresear.ch/">Roee Hay</a> +(<a href="https://twitter.com/roeehay">@roeehay</a>, <a href="mailto:roeehay@gmail.com">roeehay@gmail.com</a>)</p> <p>Stephen Smalley of <a href="https://www.nsa.gov/research/ia_research/"> diff --git a/en/setup/contribute/read-bug-reports.html b/en/setup/contribute/read-bug-reports.html index 63ff5cc0..0d9cbc4e 100644 --- a/en/setup/contribute/read-bug-reports.html +++ b/en/setup/contribute/read-bug-reports.html @@ -566,7 +566,7 @@ foreground broadcasts and the last 300 background broadcasts.</p> last 50 foreground broadcasts and the last 50 background broadcasts, as well as the receivers for each broadcast. Receivers that have a:</p> <ul> -<li><code>BroadcastRecord</code> entry are registered at runtime and are sent +<li><code>BroadcastFilter</code> entry are registered at runtime and are sent only to already running processes.</li> <li><code>ResolveInfo</code> entry are registered through manifest entries. The ActivityManager starts the process for each <code>ResolveInfo</code> if it is diff --git a/en/setup/start/build-numbers.html b/en/setup/start/build-numbers.html index da4644b9..842d8f1a 100644 --- a/en/setup/start/build-numbers.html +++ b/en/setup/start/build-numbers.html @@ -235,6 +235,30 @@ following table. </thead> <tbody> <tr> + <td>OPM6.171019.030.B1</td> + <td>android-8.1.0_r33</td> + <td>Oreo</td> + <td>Nexus 6P, Nexus 5X</td> + </tr> + <tr> + <td>OPM4.171019.021.E1</td> + <td>android-8.1.0_r32</td> + <td>Oreo</td> + <td>Pixel 2 XL, Pixel 2</td> + </tr> + <tr> + <td>OPM4.171019.021.D1</td> + <td>android-8.1.0_r31</td> + <td>Oreo</td> + <td>Pixel XL, Pixel</td> + </tr> + <tr> + <td>OPM2.171026.006.C1</td> + <td>android-8.1.0_r30</td> + <td>Oreo</td> + <td>Pixel 2 XL, Pixel 2</td> + </tr> + <tr> <td>OPM4.171019.016.C1</td> <td>android-8.1.0_r29</td> <td>Oreo</td> |