Android Security Bulletin: Everything you need to know!

Fixing the latest bugs and exploits in Android every month.

Google has detailed the latest Android Security Bulletin and released the fixes for Nexus and Pixel devices.

These are exploits and other security concerns that affect Android as a whole. Issues with the operating system, kernel patches, and driver updates may not affect any particular device, but these need to be fixed in the Android base by the folks maintaining the operating system code. That means Google, and they've detailed the things they have improved for this month.

Updated factory images for Pixel and Nexus devices that are supported are available, and over-the-air updates are rolling out to users. If you don't want to wait, you can download and flash the factory image or OTA update file manually, and here are some handy instructions to get you started.

How to manually update your Nexus or Pixel

The company that made your phone uses these patches to send an update out to you.

These changes have been released to the people making Android phones for at least 30 days, but Google can't force anyone to deliver them to you. If you're using a phone from Samsung, LG, or anyone besides Google, you'll need to wait for them to send an update and shouldn't try to flash any of the above files.

Of course, Google has safety checks in place to prevent any problems on your phone because of any security exploits. Verify Apps and SafetyNet are at work anytime you add an app to your phone, and seamless updates to Google Play Services will keep them up to date regardless of any hold up from a manufacturer or carrier. Details and incident numbers can be found in the yearly Android Security Review (.pdf file).

Highlights for April 2018

April 2018's update comes with two patch dates: 04/01/2018 and 04/05/2018.
  • As with other months, the bulk of the fixes in April are patches to the Android runtime, Android framework, and media framework parts of the OS to prevent remote attackers from using specialized code to initiate attacks.
  • Google specifically calls out Qualcomm in this month's bulletin for "their dedicated efforts to improve the security of mobile devices." This is a result of Qualcomm's inclusion of all patches sent upstream to Android (both closed and open source) between 2014 and 2016, which are now part of the public record.
  • Google also patched a number of Nexus and Pixel-specific issues in this month's bulletin, which can be seen here.

Previous bulletin highlights

Here are summaries and highlights of recent patches from the monthly Android Security Bulletin. As with the current bulletin, these issues were also mitigated by Google's Verify Apps, Safety Net, and seamless updates to Google Play Services.

Highlights for March 2018

March 2018's update comes with two patch dates: 03/01/2018, and 03/05/2018.
  • The most severe vulnerabilities addressed in this month's patch are againtied to the media framework and an attacker's ability to run arbitrary code using a specially crafted media file. This has been and always will be an issue for all operating systems until a better way to package up media files is invented.
  • This patch also includes patches made to the upstream Linux kernel to address vulnerable issues in the USB driver
  • As usual, Android hardware vendors are doing their part, too and we see new fixes from NVIDIA and Qualcomm that will make our gear safer.
If you get an update with a patch date of 03/05/2018, you also have every issue addressed by the 03/01/2018 update in place.

Highlights for February 2018

February 2018's update comes with two patch dates: 02/01/2018, and 02/05/2018.
  • The most severe vulnerability addressed in this month's small patch is once again tied to the media framework and an attacker's ability to run arbitrary code using a specially crafted media file.
  • A second fix in the 02/01 patch blocks a malicious app from escalating its privileges or running code as a privileged user.
  • The 02/05 update entails device-specific patches from HTC, NVIDIA, Qualcomm and the Linux Kernel maintainers to address issues in the Bootloader, Wi-Fi driver(s), and media framework.
If you get an update with a patch date of 02/05/2018, you also have every issue addressed by the 02/01/2018 update in place.

Highlights for January 2018

January 2018's update comes with two patch dates: 01/01/2018, and 01/05/2018.
  • January 2018's most severe vulnerability addressed is a patch for the Android runtime that could let an attacker gain access to certain OS features without user interaction
  • Vulnerabilities that allowed code execution through the Media Framework were patched, like every month.
  • A vulnerability specific to the LG bootloader that allowed elevated privileges was patched. Life's Good, once again.
  • A vulnerability specific to the NVIDIA driver that allowed elevated privileges was found and fixed
  • Qualcomm provided a handful of closed-source fixes in addition to patches for the display driver and bootloader
If you get an update with a patch date of 01/05/2018, you also have every issue addressed by the 01/01/2018 update in place.

Highlights for December 2017

December 2017's update comes with two patch dates: 12/01/2017, and 12/05/2017.
  • If your device didn't get updated with the November 6 patch last month, December's update also comes with a fix for the KRACK WPA2 Wi-Fi vulnerability.
  • A vulnerability with Android's framework that allowed malicious apps to get past user interactions requirements to access greater permissions has been squashed.
  • The media framework has also been updated to patch a threat that allowed a remote attacker to send out an arbitrary code to your device.
  • Components for numerous MediaTek, NVIDIA, and Qualcomm components have been updated with security fixes.
If you get an update with a patch date of 12/05/2017, you also have every issue addressed by the 12/01/2017 update in place.

Highlights for November 2017

November 2017's update comes with three patch dates: 11/01/2017, 11/05/2017 and 11/06/2017.
  • This month's patch updates the network stack to patch the KRACK Wi-Fi exploit.
  • The Android framework has once again been patched to prevent an exploit that bypass user interaction requirements in order to gain access to additional permissions.
  • The media framework and the Android system itself were again patched to combat the ever-present attacks through media containers. This has been a monthly thing for over a year and will certainly continue.
  • Critical updates were applied as far back as Android 5.02 for OEMs to use to patch their existing devices if they wish.
  • Broadcom, MediaTek, NVIDIA, and Qualcomm have each patched a number of drivers that could potentially allow remote attackers to execute code.
If you get an update with a patch date of 10/05/2017, you also have every issue addressed by the 10/01/2017 update in place. Devices that receive a patch with the 11/06/2017 date have all the November fixes in place as well as all previous patches. This is something new and we're hopeful that it continues.

Highlights for October 2017

October 2017's update comes with two patch dates: 10/01/2017 and 10/05/2017.
  • This month's patch updates several critical components to prevent privileged code execution, both locally and remote.
  • The Android framework has been patched to prevent an exploit that bypass user interaction requirements in order to gain access to additional permissions.
  • The media framework and the Android system itself were patched to prevent execute arbitrary code within the context of a privileged process.
  • Critical updates were applied as far back as Android 4.4
  • Broadcom, MediaTek, and Qualcomm have each patched a number of drivers that could potentially allow remote attackers to execute code.
If you get an update with a patch date of 10/05/2017, you also have every issue addressed by the 10/01/2017 update in place.

Highlights for September 2017

September 2017's update comes with two patch dates: 09/01/2017 and 09/05/2017.
  • The main issue this month revolves, once again, around a vulnerability in the media framework that, when paired with exploitative code, could remotely execute malware on a user's device.
  • Some of these patches go back to Android 4.4 KitKat.
  • A runtime bug has been patched that would allow a remote user to execute code that could cause an app to hang.
  • Broadcom has once again issued a number of patches for its Wi-Fi drivers.
  • MediaTek and Qualcomm have each patched a number of drivers that could potentially allow remote attackers to execute code.
If you get an update with a patch date of 09/05/2017, you also have every issue addressed by the 09/01/2017 update in place.

Highlights for August 2017

August 2017's update comes with two patch dates: 08/01/2017 and 08/05/2017.
  • A moderate issue in the Android runtime that could enable privileged code execution has been patched.
  • Again we see numerous issues that could allow remote code execution through the media libraries patched, with some changes going back to Android 4.4.
  • Qualcomm has patched numerous escalation of privilege issues in the Snapdragon platform. These include moderate vulnerability patches for video, the GPU, and USB input/output. Since these include closed source changes, new versions are available from Qualcomm for your device manufacturer to implement as needed.
  • MediaTek and Broadcom have also supplied patched device drivers for a range of issues rated from low to moderate. Any of these binaries that are applicable to Nexus or Pixel devices are available at the Google Developer site.
If you get an update with a patch date of 08/05/2017, you also have every issue addressed by the 08/01/2017 update in place. Archives of all previous Android Security Bulletins are available at the Android Security website. See the Android Security website for details on all bulletins

 
We are trying to bring all the content to YouTube and show every other spec and characteristics of this phone and many others, so we need your help to make it possible. Share, like, subscribe and active the notification to stay tuned and to access our giveaways.

Donate with PayPal

And we apreciate your donation to make new reviews and giveaways


Don’t forget to follow us in:

Comments

Post a Comment

Popular posts from this blog

MegaSync in Linux

Image
Install and get 50 GB in the cloud with MegaSync in Linux Mega is a storage service in the Cloud, this is the successor of the famous Megaupload, which the founder of both Kim Dotcom since the closure of Megaupload, had already promised, I raised the service, but this time something better. Mega is faster and better, this service gives us the possibility to obtain a free account, which allows us to accommodate up to 50 GB of files at a great advantage compared to other competitors such as ADrive, Dropbox, Google Drive and OneDrive. Like all file services in the cloud, we can access our data from any device with the simple requirement of using a browser and an internet connection. Given this another of the great advantages that the service has is that it has cross-platform clients, unlike some of its competitors which do not offer a client with native support for Linux. With this we have the possibility to synchronize our file files from any device and access them from any of
Read more

Zeal, a developer documentation browser

Image
In the next article we are going to take a look at Zeal. This is a tool that will provide us with an offline documentation browser for software developers. Zeal is inspired by Dash, which is a commercial application developed especially for Mac OS. Zeal provides documentation sets (docsets) for a large number of programming languages ​​and different software. You can read them all, online or by downloading the documentation to your team. This will allow any developer to find everything they need without having to search Google or check the official documentation page. You just have to download the set of documentation that we want to use. Zeal will take care of everything else. At the time that I am writing this article, there are 192 sets of useful documentation for all kinds of developers. You can consult the languages ​​available in the following screenshot. All those documents are generously provided by Dash. These documents are updated and maintained with great care. Bu
Read more

Installation guide for openSUSE novice Tumbleweed step by step

Image
This time I will take advantage of you to share this openSUSE installation guide, to be specific to your Tumbleweed version. This version, in comparison to the others offered by openSUSE, is a Rolling Release version. In this case I decided to install openSUSE Tumbleweed because it is boring and tiresome to have to update a system every time there is a new version, that's why I like the systems more relaying. For those who do not know this model, I will tell you a little, the rolling reads this is always in continuous development as it refers to a software system in constant development, we will always have the latest but stable. Without more, we will start with the installation process, there are many people who think that the system is intended for advanced users, when it is not, for those who are new to Linux they should only do their part and have patience. Just a comment, if you are not completely sure of what you are going to do, I recommend you first use a virtual m
Read more