CVE-2016-3887

providers/settings/SettingsProvider.java in Android 7.0 before 2016-09-01 does not properly enforce the DISALLOWCONFIGVPN setting, which allows attackers to bypass an intended always-on VPN state via a crafted application, aka internal bug 29899712...

CVE-2016-3887

CVE-2016-3887 affects Android 7.0 (Nougat) before the 2016-09-01 patch; the issue arises from inadequate enforcement of the DISALLOW_CONFIG_VPN setting in providers/settings/SettingsProvider.java, allowing a crafted app to bypass the intended always-on VPN state. The vulnerability is described as...