CVE-2016-6790

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability in the NVIDIA libomx library (libnvomx) could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as High because it could be used to gain local access to elevated capabilities, which are not normally accessible to a third-party application. Product: Android. Versions: Kernel-3.18. Android ID: A-31251628. References: N-CVE-2016-6790.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-284

Affected software

Vendor	Product	Versions
n/a	Android Kernel-3.18	Android Kernel-3.18

References

http://www.securityfocus.com/bid/94678Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2016-12-01.htmlVendor Advisory
http://www.securityfocus.com/bid/94678Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2016-12-01.htmlVendor Advisory

Timeline

Published: Jan 12, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-67917.0An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to execute arbitrary code wi CVE-2016-67939.1The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infi CVE-2016-67945.3When a SecurityManager is configured, a web application's ability to read system properties should be controlled by the SecurityManager. In CVE-2016-67959.8In the Convention plugin in Apache Struts 2.3.x before 2.3.31, and 2.5.x before 2.5.5, it is possible to prepare a special URL which will be CVE-2016-67967.5A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to CVE-2016-67977.5The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 CVE-2016-67989.8In the XSS Protection API module before 1.0.12 in Apache Sling, the method XSS.getValidXML() uses an insecure SAX parser to validate the inp CVE-2016-67997.5Product: Apache Cordova Android 5.2.2 and earlier. The application calls methods of the Log class. Messages passed to these methods (Log.v()CVE-2016-68006.1The default configuration of the Apache OFBiz framework offers a blog functionality. Different users are able to operate blogs which are rel CVE-2016-68018.8Cross-site request forgery (CSRF) vulnerability in the CSRF content-type check in Jackrabbit-Webdav in Apache Jackrabbit 2.4.x before 2.4.6,CVE-2016-68027.5Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet contex CVE-2016-68037.8An installer defect known as an "unquoted Windows search path vulnerability" affected the Apache OpenOffice before 4.1.3 installers for Wind