PT-2018-3974 · Google +2 · Android Kernel +2

Name of the Vulnerable Software and Affected Versions: Android kernel versions affected versions not specified Description: The issue is related to a possible use after free due to a race condition in the pppol2tp create function of l2tp ppp.c. This could lead to local escalation of privilege,...

PT-2018-5525 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions prior to the fixed version Description: The issue concerns a debug feature in XBLRamDump mode that can be exploited to dump memory contents, potentially leading to local information disclosure. This can be achieved with...

CVE-2017-13197

In the ihevcdparseslice.c function, slave threads are not joined if there is an error. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1...

CVE-2017-13208

In receivepacket of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2017-13199

In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException later on. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2017-13210

In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is too small. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is n...

CVE-2017-13192

In the ihevcdparsesliceheader function of ihevcdparsesliceheader.c a slice address of zero after the first slice could result in an infinite loop. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction is not...

CVE-2017-13180

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad header causes the decoder to get caught in a loop while another thread frees the memory it's accessing. This could lead to a local elevation of privilege enabling code execution a...

Remote code execution

In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8....

CVE-2017-13181

In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a freed pointer. This could lead to an local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interaction is...

CVE-2017-13193

In ihevcddecode.c there is a possible infinite loop due to bytes for an sps of unsupported resolution resulting in the same sps being fed in over and over. This could lead to a remote denial of service of a critical system process with no additional execution privileges needed. User interaction i...

Android PAN Remote Code Execution Vulnerability

The Bluetooth Network Encapsulation Protocol BNEP is used to transfer data from another protocol stack via L2CAP. A remote code execution vulnerability exists in the BNEP service's high-level-Personal Area Network PAN configuration file, which is used to establish an IP network connection between...

Android BNEP Remote Code Execution Vulnerability

The Bluetooth Network Encapsulation Protocol BNEP is used to transfer data from another protocol stack via L2CAP. A remote code execution vulnerability exists in Android BNEP. The vulnerability is in the Bluetooth Network Encapsulation Protocol BNEP service, which allows Internet sharing over a...

PT-2017-3953 · Google +4 · Android Kernel +4

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a use after free in the pppol2tp connect function, which could lead to memory corruption. This might allow an attacker to escalate privileges locally with System execution privileges. No use...

Oracle E-Business Suite 12.2.3 - 'IESFOOTPRINT' SQL Injection

Application: Oracle E-Business Suite Versions Affected: Oracle EBS 12.2.3 Vendor URL: http://oracle.com Bug: SQL injection Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU April 2017 Author: Dmitry Chastuhin ERPScan Description 1. ADVISORY...

Oracle E-Business Suite 12.2.3 SQL Injection

Application: Oracle E-Business Suite Versions Affected: Oracle EBS 12.2.3 Vendor URL: http://oracle.com Bug: SQL injection Reported: 23.12.2016 Vendor response: 24.12.2016 Date of Public Advisory: 18.04.2017 Reference: Oracle CPU April 2017 Author: Dmitry Chastuhin ERPScan Description 1. ADVISORY...

Broadcom WiFi SoC Privilege Acquisition Vulnerability

The WiFi SoC is a Wifie NIC chip from Broadcom Corporation. The Broadcom WiFi SoC contains a privilege acquisition vulnerability that can be exploited by an attacker to completely take over a device that is using a Broadcom wireless card on the same WiFi network and does not require interaction...

Mail.ru: Stored XSS in e.mail.ru (payload affect multiple users)

Hi, We have found a high risk level STORED XSS in e.mail.ru chat, the status change function allow to inject malicious payload in javascript & HTML, The attack affect multiple users and run in auto mode, no need a user interaction. Vulnerability affect any user that have been invited to your chat...

CVE-2017-2787

A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has ro...

Heap overflow

A buffer overflows exists in the psnotifyd application of the Pharos PopUp printer client version 9.0. A specially crafted packet can be sent to the victim's computer and can lead to a heap based buffer overflow resulting in potential remote code execution. This client is always listening, has ro...