CVE-2016-0831 | Vulnetix

CVE-2016-0831 PUBLISHED

Reported by google_android · Published March 12, 2016

The getDeviceIdForPhone function in internal/telephony/PhoneSubInfoController.java in Telephony in Android 5.x before 5.1.1 LMY49H and 6.x before 2016-03-01 does not check for the READ_PHONE_STATE permission, which allows attackers to obtain sensitive information via a crafted application, aka internal bug 25778215.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
android	Ubuntu:16.04:LTS	20160307-0742-0ubuntu3

Affected products

Vendor	Product	Versions
n/a	n/a	n/a
n/a	n/a	*

Timeline

Mar 8, 2016 CVE Published
Feb 4, 2022 EPSS Score (30 in total, the first dated here)
May 6, 2026 CVE Updated
Jun 1, 2026 Security Advisory
Oct 10, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2016-0831
vulnetix vdb fixes CVE-2016-0831

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2016-0831/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

x_refsource_CONFIRM
x_refsource_CONFIRM
84266 vdb-entryx_refsource_BID

Look up in the Resolve Platform →