Android

CVEs (4,715)

• CVE-2016-3750HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.00

  libs/binder/Parcel.cpp in the Parcels Framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate the return value of the dup system call, which allows attackers to bypass an isolation protection mechanism via a…

• CVE-2016-3747HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.00

  Use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or…

• CVE-2016-3746HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.00

  Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows attackers to gain privileges via a crafted application, as demonstrated by obtaining Signature or…

• CVE-2016-2508HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.02

  media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate certain track data, which allows remote attackers to execute arbitrary code or cause a denial of…

• CVE-2016-2507HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory…

• CVE-2016-2505HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  mpeg2ts/ATSParser.cpp in libstagefright in mediaserver in Android 6.x before 2016-07-01 does not validate a certain section length, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug…

• CVE-2016-2503HigJul 11, 2016
  Qualcomm

  GPU driver
  risk 0.51cvss 7.8epss 0.00

  The Qualcomm GPU driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28084795 and Qualcomm internal bug CR1006067.

• CVE-2016-2502HigJul 11, 2016
  Qualcomm

  Qualcomm USB driver
  risk 0.51cvss 7.8epss 0.00

  drivers/usb/gadget/f_serial.c in the Qualcomm USB driver in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a large size in a GSER_IOCTL ioctl call, aka Android internal bug 27657963 and Qualcomm internal bug CR997044.

• CVE-2016-2501HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  The Qualcomm camera driver in Android before 2016-07-05 on Nexus 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 27890772 and Qualcomm internal bug CR1001092.

• CVE-2016-2068HigJul 11, 2016
  Linux

  Kernel
  risk 0.51cvss 7.8epss 0.01

  The MSM QDSP6 audio driver (aka sound driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to gain privileges or cause a denial of service (integer overflow, and buffer overflow…

• CVE-2016-2067HigJul 11, 2016
  Linux

  Kernel
  risk 0.51cvss 7.8epss 0.01

  drivers/gpu/msm/kgsl.c in the MSM graphics driver (aka GPU driver) for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, mishandles the KGSL_MEMFLAGS_GPUREADONLY flag, which allows attackers to gain…

• CVE-2015-8892HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  platform/msm_shared/boot_verifier.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to bypass intended access restrictions via a digest with trailing data, aka Android internal bug 28822807 and Qualcomm internal bug CR902998.

• CVE-2015-8891HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Multiple integer overflows in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to bypass intended access restrictions via a crafted image, aka Android internal bug 28842418 and Qualcomm internal bug…

• CVE-2015-8890HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  platform/msm_shared/partition_parser.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices does not validate certain GUID Partition Table (GPT) data, which allows attackers to bypass intended access restrictions via a crafted MultiMediaCard…

• CVE-2015-8889HigJul 11, 2016
  Qualcomm

  aboot
  risk 0.51cvss 7.8epss 0.01

  The aboot implementation in the Qualcomm components in Android before 2016-07-05 on Nexus 6P devices omits the recovery PIN feature, which has unspecified impact and attack vectors, aka Android internal bug 28822677 and Qualcomm internal bug CR804067.

• CVE-2015-8888HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Integer overflow in app/aboot/aboot.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allows attackers to bypass intended access restrictions via a crafted block count and block size of a sparse header, aka Android internal bug 28822465 and Qualcomm…

• CVE-2014-9802HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Multiple integer overflows in lib/libfdt/fdt.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allow attackers to gain privileges via a crafted application, aka Android internal bug 28821965 and Qualcomm internal bug CR705108.

• CVE-2014-9801HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Multiple integer overflows in lib/libfdt/fdt_rw.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 devices allow attackers to gain privileges via a crafted application, aka Android internal bug 28822060 and Qualcomm internal bug CR705078.

• CVE-2014-9800HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  Integer overflow in lib/heap/heap.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28822150 and Qualcomm internal bug CR692478.

• CVE-2014-9799HigJul 11, 2016
  Google

  Android
  risk 0.51cvss 7.8epss 0.01

  The makefile in the Qualcomm components in Android before 2016-07-05 on Nexus 5 and 7 (2013) devices omits the -fno-strict-overflow option to gcc, which might allow attackers to gain privileges via a crafted application that leverages incorrect compiler optimization of an…