CVE-2014-9894

CVE-2014-9894 affects drivers/misc/qseecom.c in the Qualcomm component used in Android on Nexus 7 (2013) devices. The root cause is that certain name strings may not end with a null terminator ('\0'), enabling a crafted application to obtain sensitive information. The vulnerability is described f...

CVE-2014-9877

Technical details about CVE-2014-9877 are not publicly provided in the supplied documents. The Nexus/Qualcomm vulnerability description is present, but precise affected products, versions, root cause, or fixes are not detailed here. Monitor for updates.

CVE-2014-9881

CVE-2014-9881 affects Qualcomm components in Android on Nexus 7 (2013) where drivers/media/radio/radio-iris.c uses an incorrect integer data type, enabling privilege escalation or denial of service (buffer overflow) via a crafted app. The issue is documented in CVE descriptions and mapped to Andr...

CVE-2014-9867

The CVE-2014-9867 issue affects Qualcomm camera components in Android (Nexus 5/7 2013) where msm_isp_axi_util.c fails to validate the number of streams, enabling privilege escalation via a crafted app. Root cause: missing validation in the camera driver path. Impact: local privilege escalation wi...

CVE-2014-9895

Technical details for CVE-2014-9895 are not publicly available in the provided documents. The materials reference an information disclosure in media-device.c but do not specify affected versions, root cause, impact, or fixes within this corpus. Monitor for updates.

CVE-2014-9888

CVE-2014-9888 affects the Linux kernel on ARM: memory allocated for DMA buffers could be mapped with executable permissions due to insufficient validation in arch/arm/mm/dma-mapping.c, before version 3.13. This is noted as affecting Android on Nexus devices (Nexus 5 and 7 2013) prior to 2016-08-0...

CVE-2014-9890

CVE-2014-9890 describes an off-by-one error in the MSM camera_v2 CCI driver (Qualcomm components) used on Nexus 5 and Nexus 7 (2013). The vulnerability allows a local attacker to gain privileges by sending a crafted I2C command, due to a boundary handling flaw in msm_cci.c. Affected firmware is A...

CVE-2014-9879

The CVE-2014-9879 issue affects the mdss mdp3 driver in the Qualcomm components on Nexus 5 devices running Android prior to 2016-08-05. The vulnerability arises because user-space data is not validated, enabling a locally staged attacker to gain privileges via a crafted application (Android inter...

CVE-2014-9893

drivers/video/msm/mdss/mdssmdppp.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 devices does not properly determine the size of Gamut LUT data, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28747914 and Qualcomm...

CVE-2014-9898

arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices does not properly validate input parameters, which allows attackers to obtain sensitive information via a crafted application, aka Android internal bug 28814690 and...

CVE-2014-9884

drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 2013 devices does not validate certain pointers, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28769920 and Qualcomm internal bug CR580740...

CVE-2014-9889

CVE-2014-9889 affects Android on Nexus 5, where drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c does not validate CPP frame messages, enabling privilege escalation via a crafted app. Root cause: lack of CPP frame message validation in Qualcomm component. Impact stated: attacker could gai...

CVE-2014-9897

CVE-2014-9897 affects Android on Nexus 5, in Qualcomm components (sound/soc/msm/qdsp6v2/msm-lsm-client.c). The vulnerability arises because the code path in msm-lsm-client.c does not validate certain user-space data, enabling an attacker to obtain sensitive information via a crafted application. ...

CVE-2014-9900

CVE-2014-9900 affects the Linux kernel (ethtool_get_wol in net/core/ethtool.c) up to version 4.7. It can leak kernel memory due to uninitialized data, enabling local information disclosure. Reported impact seen on Android devices (Nexus 5/2013 era) with Android before 2016-08-05. Public advisorie...

CVE-2014-9898

CVE-2014-9898 affects Android on Nexus 5 and Nexus 7 (2013) devices due to a flaw in arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c where input parameters are not properly validated. This enables a crafted application to obtain sensitive information. The issue is associated with Android internal bug ...

CVE-2014-9863

The CVE-2014-9863 issue is a local privilege escalation in Android due to an integer underflow in the Qualcomm diag driver used on Nexus 5 and Nexus 7 (2013). A crafted app could exploit this to gain privileges or access sensitive data. Affected software is Android on Nexus devices prior to the 2...

CVE-2014-9880

CVE-2014-9880 affects Android on Nexus 7 (2013) via Qualcomm drivers: the venc.c video engine fails to validate VEN_IOCTL_GET_SEQUENCE_HDR ioctl, enabling privilege escalation with a crafted app. Root cause: lack of validation in drivers/video/msm/vidc/common/enc/venc.c. Android bug 28769352 and ...

CVE-2014-9866

CVE-2014-9866 affects Qualcomm MSM camera driver on Nexus 5/Nexus 7 (2013) running Android with pre-2016-08-05 patch levels. The vulnerable file is drivers/media/platform/msm/camera_v2/sensor/csid/msm_csid.c, where a parameter is not validated, enabling elevation of privilege via a crafted applic...

CVE-2014-9868

CVE-2014-9868 affects Qualcomm MSM camera_v2 sensor code (msm_csiphy.c) in Android prior to 2016-08-05 on Nexus 5 and Nexus 7 (2013). A crafted mask value provided by an application can lead to privilege escalation. The vulnerability is documented in the Android/Qualcomm context and is addressed ...

CVE-2014-9882

CVE-2014-9882 is a buffer overflow in drivers/media/radio/radio-iris.c within the Qualcomm component used on Android devices (notably Nexus 7 2013). Exploitation via a crafted application could allow an attacker to gain privileges on the device. Multiple connected sources corroborate this issue a...