BlackBerry

BlackBerry release BlackBerry Priv April Security Upgrade

BlackBerry have promised to deliver security patches on a monthly basis for the BlackBerry Priv, and so far they are keeping good on that promise.

The company has today rolled out the April Security upgrade (AAE298) to BlackBerry Priv’s worldwide.

The update comes in at 20.9Mb and updates 52 apps.

It should be noted that whilst this security update includes Google’s April Security update, BlackBerry have not updated the build number, which is still AAE298 from the March supplementary update last month.

The following vulnerabilities have been remediated in this update:
[table style=”table-striped”]

Summary Description CVE
Remote Code Execution Vulnerability in DHCPD A vulnerability in the Dynamic Host Configuration Protocol service could enable an attacker to cause memory corruption, which could lead to remote code execution. CVE-2016-1503
Remote Code Execution Vulnerabilities in Mediaserver During media file and data processing of a specially crafted file, vulnerabilities in mediaserver could allow an attacker to cause memory corruption and remote code execution as the mediaserver process.

The affected functionality is provided as a core part of the operating system and there are multiple applications that allow it to be reached with remote content, most notably MMS and browser playback of media.

CVE-2016-0837
CVE-2016-0838
CVE-2016-0841
Elevation of Privilege Vulnerability in Qualcomm RF component A vulnerability in the Qualcomm RF driver could enable a local malicious application to execute arbitrary code within the context of the kernel. CVE-2016-0844
Elevation of Privilege Vulnerability in IMemory Native Interface An elevation of privilege vulnerability in the IMemory Native Interface could enable a local malicious application to execute arbitrary code within the context of an elevated system application. CVE-2016-0846
Elevation of Privilege Vulnerability in Telecom Component An elevation of privilege vulnerability in the Telecom Component could enable an attacker to spoof calls to appear from any arbitrary number. CVE-2016-0847
Elevation of Privilege Vulnerability in Download Manager An elevation of privilege vulnerability in the Download Manager could enable an attacker to gain access to unauthorized files in private storage. CVE-2016-0848
Elevation of Privilege Vulnerability in Recovery Procedure An elevation of privilege vulnerability in the Recovery Procedure could enable a local malicious application to execute arbitrary code within the context of an elevated system application. CVE-2016-0849
Elevation of Privilege Vulnerability in Bluetooth An elevation of privilege vulnerability in Bluetooth could enable an untrusted device to pair with the phone during the initial pairing process. This could lead to unauthorized access of the device resources, such as the Internet Connection. CVE-2016-0850
Elevation of Privilege Vulnerability in a Qualcomm Video Kernel Driver An elevation of privilege vulnerability in a Qualcomm video kernel driver could enable a local malicious application to execute arbitrary code within the context of the kernel. CVE-2016-2410
Elevation of Privilege Vulnerability in Qualcomm Power Management component An elevation of privilege vulnerability in a Qualcomm Power Management kernel driver could enable a local malicious application to execute arbitrary code within the context of the kernel. CVE-2016-2411
Elevation of Privilege Vulnerability in System_server An elevation of privilege vulnerability in System_server could enable a local malicious application to execute arbitrary code within the context of an elevated system application. CVE-2016-2412
Elevation of Privilege Vulnerability in Mediaserver An elevation of privilege vulnerability in mediaserver could enable a local malicious application to execute arbitrary code within the context of an elevated system application. CVE-2016-2413
Denial of Service Vulnerability in Minikin A denial of service vulnerability in the Minikin library could allow a local attacker to temporarily block access to an affected device. An attacker could cause an untrusted font to be loaded and cause an overflow in the Minikin component which leads to a crash. CVE-2016-2414
Information Disclosure Vulnerability in Exchange ActiveSync An information disclosure vulnerability in Exchange ActiveSync could enable a local malicious application to gain access to user’s private information. CVE-2016-2415
Information Disclosure Vulnerabilities in Mediaserver Information disclosure vulnerabilities in mediaserver could permit a bypass of security measures in place to increase the difficulty of attackers exploiting the platform. CVE-2016-2416
CVE-2016-2417
Elevation of Privilege Vulnerability in Setup Wizard A vulnerability in the Setup Wizard could allow a malicious attacker to bypass the Factory Reset Protection and gain access to the device. CVE-2016-2421
Elevation of Privilege Vulnerability in Wi-Fi An elevation of privilege vulnerability in Wi-Fi could enable a local malicious application to execute arbitrary code within the context of an elevated system application. CVE-2016-2422
Elevation of Privilege Vulnerability in Telephony A vulnerability in Telephony could allow a malicious attacker to bypass the Factory Reset Protection and gain access to the device. CVE-2016-2423
Denial of Service Vulnerability in SyncStorageEngine A denial of service vulnerability in the SyncStorageEngine could enable a local malicious application to cause a reboot loop. CVE-2016-2424
Information Disclosure Vulnerability in Framework An information disclosure vulnerability in the Framework component could allow an application to access sensitive information. CVE-2016-2426
Information Disclosure Vulnerability in BouncyCastle An information disclosure vulnerability in BouncyCastle could allow an authentication key to be leaked. CVE-2016-2427
Elevation of Privilege Vulnerability in the Kernel An elevation of privilege vulnerability in the kernel could enable a local malicious application to execute arbitrary code within the context of the kernel.

[/table]
If you own a Priv and are not seeing the system update message, you can check manually by heading into Settings -> About phone -> System updates and checking manually.

Rapid Mobile

Rapid Mobile uses cookies, tokens, and other third party scripts to recognise visitors of our sites and services, remember your settings and privacy choices, and - depending on your settings and privacy choices - enable us and some key partners to collect information about you so that we can improve our services and deliver relevant ads.

 

By continuing to use our site or clicking I Accept, you agree that Rapid Mobile and our key partners may collect data and use cookies for personalised ads and other purposes, as described more fully in our privacy policy.

 

You can change your settings at any time by clicking Manage Settings or by visiting our Privacy Centre for more detailed information.

 

Privacy Settings saved!
Cookie Services

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

These cookies allow us to count visits and traffic sources, so we can measure and improve the performance of our site.

We track anonymized user information to improve our website.
  • _ga
  • _gid
  • _gat

Decline all Services
Accept all Services