CVE-2016-0818

Publication date 12 March 2016

Last updated 25 August 2025

Ubuntu priority

Cvss 3 Severity Score

Description

The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
android	18.04 LTS bionic	Not in release
	17.10 artful	Not in release
	17.04 zesty	Fixed 20160307-0742-0ubuntu3
	16.10 yakkety	Fixed 20160307-0742-0ubuntu3
	16.04 LTS xenial	Fixed 20160307-0742-0ubuntu3
	15.10 wily	Ignored end of life
	14.04 LTS trusty	Not in release
	12.04 LTS precise	Not in release

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
android	Upstream: https://android.googlesource.com/platform/external/conscrypt/+/4c9f9c2201116acf790fca25af43995d29980ee0 Upstream: https://android.googlesource.com/platform/external/conscrypt/+/c4ab1b959280413fb11bf4fd7f6b4c2ba38bd779

Severity score breakdown

Parameter	Value
Base score	5.9 · Medium
Attack vector	Network
Attack complexity	High
Privileges required	None
User interaction	None
Scope	Unchanged
Confidentiality	None
Integrity impact	High
Availability impact	None
Vector	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE-2016-0818

Cvss 3 Severity Score

Description

Status

Patch details

Severity score breakdown

References

Other references

Access our resources on patching vulnerabilities