Read the docs
TI-2016-05638 Aliases CVE-2016-6587GHSA-9hjc-v342-97r7

Information disclosure in Symantec Norton Mobile Security for Android

Priority LOW 25CWE-200Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-200.

Summary

An Information Disclosure vulnerability exists in the mid.dat file stored on the SD card in Symantec Norton Mobile Security for Android before 3.16, which could let a local malicious user obtain sensitive information.

Why it matters now

EPSS 0.00455 39th percentileScored 2026-11-07
Fix Fixed Norton Mobile Security for Android (Symantec): 3.16

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
SymantecNorton Mobile Security for Androidbefore 3.163.16Patch availableCNA
  • Norton Mobile Security for Android VendorSymantec Affected before 3.16 Fixed in 3.16 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:symantec:norton_mobile_security:*:*:*:*:*:android:*:*before 3.16VulnerableSymantec
  • cpe:2.3:a:symantec:norton_mobile_security:*:*:*:*:*:android:*:* Versions before 3.16 Vulnerable ·Symantec

Remediation

  • Fix · CNA Norton Mobile Security for Android (Symantec) Fixed in 3.16

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-6587
  2. 2026-10-03 Alias added: GHSA-9hjc-v342-97r7

References

Advisory 1

  • TI-2016-05636 Improper input validation in Symantec Norton Mobile Security for Android CVSS 3.1MEDIUM 5.3
  • TI-2016-05637 Improper input validation in Symantec Norton Mobile Security for Android CVSS 3.1LOW 3.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences