VDB
CVE-2016-3917
CVE-2016-3917
PUBLISHED
CVSS 7.800000190734863 HIGH
The fingerprint login feature in Android 6.0.1 before 2016-10-01 and 7.0 before 2016-10-01 does not track the user account during the authentication process, which allows physically proximate attackers to authenticate as an arbitrary user by leveraging lockscreen access, aka internal bug 30744668.
EPSS 0.19% · 8.5th percentile
Risk Scores
CVSS 3.0
7.800000190734863
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score
0.19%
8.5th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ubuntu:16.04:LTS | android | 20150818-1500-0ubuntu2, 20150818-1500-0ubuntu3, 20160330-0939-0ubuntu1 |
Timeline
- Oct 4, 2016 CVE Published
- Feb 4, 2022 EPSS Score
- Mar 29, 2022 EPSS Score
- May 21, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Sep 4, 2022 EPSS Score
- Oct 27, 2022 EPSS Score
- Dec 19, 2022 EPSS Score
- Feb 9, 2023 EPSS Score
- Mar 7, 2023 EPSS Score
- Apr 3, 2023 EPSS Score
- May 26, 2023 EPSS Score
References
- https://ubuntu.com/security/CVE-2016-3917 third-party-advisory
- http://source.android.com/security/bulletin/2016-10-01.html third-party-advisory
- https://android.googlesource.com/platform/frameworks/base/+/f5334952131afa835dd3f08601fb3bced7b781cd third-party-advisory
- https://www.cve.org/CVERecord?id=CVE-2016-3917 third-party-advisory