Integer overflow

In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not...

CVE-2017-13209

This CVE (CVE-2017-13209) affects Android 8.0–8.1 and is due to an insecure permissions check in ServiceManager::add of the hardware service manager. The check based on the caller’s PID could allow an application or service to replace a HAL service with its own, enabling local elevation of privil...

CVE-2017-13180

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution a...

CVE-2017-13182

CVE-2017-13182 affects Android 8.0 and 8.1. The issue is in ACodec::sendFormatChange, where an integer overflow can cause an out-of-bounds write, enabling local privilege escalation with code execution in a privileged process and no user interaction required. The vulnerability is documented in mu...

CVE-2017-13184

In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for...

CVE-2017-13182

In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not...

CVE-2017-13217

In DisplayFtmItem in the bootloader, there is an out-of-bounds write due to reading a string without verifying that it's null-terminated. This could lead to a secure boot bypass and a local elevation of privilege enabling code execution as a privileged process with no additional execution...

CVE-2017-13217

CVE-2017-13217 affects the LG Bootloader’s DisplayFtmItem in Android. It is an out-of-bounds write caused by reading a string without verifying it is null-terminated, enabling a local elevation of privilege and a secure-boot bypass that could let code execute with high privileges. Exploitation is...

CVE-2017-13209

In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller which could allow an application or service to replace a HAL service with its own service. This could lead to a local elevation of privilege enabling code...

CVE-2017-13183: Concurrent Execution using Shared Resource with Improper Synchronization

In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condition if the user frees the buffer while it's being used in another thread. This could lead to a local elevation of privilege enabling code execution as a privileged process with...

CVE-2017-13217: Out-of-bounds Write

In DisplayFtmItem in the bootloader, there is an out-of-bounds write due to reading a string without verifying that it's null-terminated. This could lead to a secure boot bypass and a local elevation of privilege enabling code execution as a privileged process with no additional execution...

CVE-2017-13209: Missing Authorization

In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the PID of the caller which could allow an application or service to replace a HAL service with its own service. This could lead to a local elevation of privilege enabling code...

CVE-2017-13210: Out-of-bounds Write

In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is n...

CVE-2017-13181: Double Free

In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. This could lead to an local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is...

CVE-2017-13182: Integer Overflow or Wraparound

In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds write. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not...

CVE-2017-13184: Use After Free

In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for...

CVE-2017-13216: Out-of-bounds Write

In ashmemioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for...

CVE-2017-13180: Use After Free

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution a...

VMware vCenter Server Appliance Local Elevation of Privilege Vulnerability

The VMware vCenter Server Appliance vCSA is a suite of server and virtualization management software from VMware. The software provides a centralized platform for managing VMware vSphere environments. A local lift vulnerability exists in VMware vCSA. A local attacker could exploit this...

Intel Graphics Driver Content Protection HECI Service Local Elevation of Privilege Vulnerability

Intel Graphics Driver is an integrated graphics driver developed by Intel Corporation.Content Protection HECI Service is one of the content protection services. A local elevation of privilege vulnerability exists in the Content Protection HECI Service in Intel Graphics Driver. An attacker can...