Description

Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information via a crafted application, aka internal bug 24106146.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

• http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-6644

• https://github.com/bcgit/bc-java/issues/177

• https://bugzilla.redhat.com/show_bug.cgi?id=1444015