Android Security Bulletin

https://source.android.com/security/bulletin/2016-07-01.html

by pjmlp • 10 years ago

40 24 10 years ago

source.android.com

andybak• 10 years ago

This can be turned into a nice 'name and shame'. If someone could document currently shipping devices that are still vulnerable. Then everyone can tweet/blog/complain the hell out of it until OEMs and carriers start taking some responsibility.

timgws• 10 years ago

If someone could document currently shipping devices that are still vulnerable Chances are at this point in time: every single device.

piquadrat• 10 years ago

Security patch levels of July 05, 2016 or later address all applicable issues in this bulletin

My Nexus 6P is on the July 05 patch level. So is my 3 year old Nexus 7.

Unfortunately, most OEMs lag far behind what Nexus users are accustomed to.

drewg123• 10 years ago

In general, you can really only count on having supported Nexus devices patched in a timely fashion. This is the reason that my employer only allows corporate access from Android phones when they are Nexuses.

j0rd• 10 years ago

Media server remote code execution. No way!

For those interested in an old talk about rooting phones via media server & MMS watch this great talk.

https://youtu.be/71YP65UANP0

owly• 10 years ago

https://copperhead.co/android/ Try it out!

verytrivial• 10 years ago

Sigh. I have a well functioning Nexus 4. According to https://support.google.com/nexus/answer/4457705 this device is no longer supported. I wondered why I wasn't seeing update prompts as often as my partner. Time to grit my teeth and install CyanogenMod I guess. Planned obsolescence depresses me.

lorenzhs• 10 years ago

You have no idea how lucky you are to have received ~3.5yrs of updates on an Android phone. Sadly that's the exception, not the norm. (The oldest iPhone still receiving updates is the 4S, which predates the Nexus 4 by a full year)

simonmales• 10 years ago

I use Fake Nexus ROM to stay up to date. Not ideal, but if you want the latest security patches, you don't have any other choice.

http://forum.xda-developers.com/nexus-4/development/fake-nex...

billpg• 10 years ago

"Partners were notified about the issues described"

I left Android a year or so from the aftermath of the "Stage Fright" incident. I was very disappointed when my fairly new Android handset didn't get any updates to that problem.

It will be interesting to see if the Android ecosystem has learned anything since then. (Other than it is a good way to sell new handsets.)

pjmlp4• 10 years ago

No they have not, OEMs and Handset manufactures rather sell new devices than provide updates, just like they used to do with Symbian and similar proprietary handsets.

http://www.androidauthority.com/android-7-0-update-679175/

bitmapbrother3• 10 years ago

Blackberry has released Android security updates every month.

zokier• 10 years ago

Could someone explain why we still have monolithic "firmwares" on our phones instead of PC style OS which could be updated directly from Google? That wouldn't preclude OEMs and carriers adding their crapware (and drivers), but it sure would make the landscape bit more secure.

the_trapper2• 10 years ago

Since there really isn't any good technical reason for that not to be the case, it is painfully obvious that Google doesn't care enough to actually fix the problem and the OEMs and carriers have no incentive to provide updates, so most of them don't.

erelde• 10 years ago

What is the incentive for carriers to limit updates ? To save cost on bandwidth ? (...)

Another related/unrelated rhetorical question, should I prepare to buy another Nexus when my Nexus 5 is no longer supported ? (which should be soonish)

pjmlp4• 10 years ago

They usually provide their own customizations also they are very keen in exchanging devices for a contract renewal for those customers on contracts.

Android Security Bulletin

Related Stories