In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel prtd is assigned substream->runtime->private_data. Later prtd is freed. However prtd is not sanitized and set to NULL resulting in a dangling pointer. There are other functions that access the same memory (substream->runtime->private_data) with a NULL check such as msm_pcm_volume_ctl_put() which means this freed memory could be used.

...

The vulnerability of the Linux operating system’s interrupt handler snd_cs5535audio_interrupt allows a hacker to trigger a service failure.

The vulnerability of the interrupt handler sndcs5535audiointerrupt in the Linux kernel’s sound/pci/cs5535audio/snd-cs5535audio.ko module arises due to the swapping of the null pointer. Exploiting this vulnerability could allow an attacker to cause a system failure by connecting a CS5535 Audio...

Microsoft Excel Substream Parsing Integer Overflow

Added: 11/08/2011 CVE: CVE-2011-0097 OSVDB: 71758 Background Microsoft Excel, part of the Microsoft Office product suite, is a spreadsheet application for Windows and Macintosh platforms. Problem Microsoft Excel 2007 versions lacking the patch KB2464583 detailed in Microsoft Security Advisory...