PURPOSE OF THIS BULLETIN

BlackBerry has released a security update to address multiple vulnerabilities in BlackBerry powered by Android smartphones. We recommend users update to the latest available build, as outlined in the Available Updates section.

BlackBerry releases security bulletins to notify users of its Android smartphones about available security fixes; see BlackBerry.com/bbsirt for a complete list of monthly bulletins. This advisory is in response to the Nexus Security Bulletin (March 2016) and addresses issues in that bulletin that affect BlackBerry powered by Android smartphones.

VULNERABILITIES FIXED IN THIS UPDATE

The following vulnerabilities have been remediated in this update:

70% Off or More: #BlackBerry http://amzn.to/1Sincnj

50% Off or More: #PorscheDesign http://amzn.to/1G8m3pJ

Summary		Description		CVE
Remote Code Execution Vulnerability in Mediaserver		During media file and data processing of a specially crafted file, a vulnerability in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process. The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.		CVE-2016-0815
Remote Code Execution Vulnerabilities in libvpx		There are multiple vulnerabilities in libvpx that could allow remote code execution in the privileged process mediaserver.		CVE-2016-1621
Elevation of Privilege Vulnerability in Conscrypt		An elevation of privilege vulnerability in the Conscrypt component can enable a man in the middle to intercept, manipulate, and inject arbitrary content on an encrypted communication leading to remote code execution.		CVE-2016-0818
Elevation of Privilege Vulnerability in Keyring Component		An elevation of privilege vulnerability in the Kernel Keyring Component can enable a local malicious application to execute arbitrary code within the kernel.		CVE-2016-0728
Mitigation Bypass Vulnerability in the Kernel		A mitigation bypass vulnerability in the kernel can permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.		CVE-2016-0821
Information Disclosure Vulnerability in Kernel		An information disclosure vulnerability in the kernel can permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.		CVE-2016-0823
Elevation of Privilege Vulnerabilities in Mediaserver		Elevation of privilege vulnerabilities in mediaserver can enable a local malicious application to execute arbitrary code within the context of an elevated system application.		CVE-2016-0826 CVE-2016-0827
Information Disclosure Vulnerabilities in Mediaserver		Information disclosure vulnerabilities in mediaserver can permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform.		CVE-2016-0828 CVE-2016-0829
Information Disclosure Vulnerability in Telephony		An information disclosure vulnerability in the Telephony component could allow an application to access sensitive information.		CVE-2016-0831
Elevation of Privilege Vulnerability in Setup Wizard		A vulnerability in the Setup Wizard could enable an attacker who had physical access to the device to gain access to device settings and perform a manual device reset.		CVE-2016-0832

AVAILABLE UPDATES