CVE-2016-3882

Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service reboot via an access point that provides a crafted 1 Venue Group or 2 Venue Type value, aka internal bug 29464811...

Design/Logic Flaw

CORE/HDD/src/wlanhddhostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes a setwpaie ioctl call, aka Android internal bug 29915601 and Qualcomm internal bug CR...

Code injection

Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service reboot via an access point that provides a crafted 1 Venue Group or 2 Venue Type value, aka internal bug 29464811...

CVE-2016-3925

server/wifi/anqp/ANQPFactory.java in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows attackers to cause a denial of service blocked Wi-Fi usage via a crafted application, aka internal bug 30230534...

Buffer overflow

Off-by-one error in CORE/HDD/src/wlanhddhostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service buffer overflow via a crafted application that makes a linkspeed ioctl call, aka Android...

Buffer overflow

Off-by-one error in CORE/HDD/src/wlanhddcfg.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service buffer overflow via a crafted application that makes a GETCFG ioctl call, aka Android intern...

Design/Logic Flaw

CORE/HDD/src/wlanhddwext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes an iwsetpriv ioctl call, aka Android internal bug 29982678 and Qualcomm internal bug CR...

CVE-2016-3882

CVE-2016-3882 describes an off-by-one error in server/wifi/anqp/VenueNameElement.java within Android’s Wi‑Fi stack. Affected products are Android 6.x before 2016-10-01 and Android 7.0 before 2016-10-01. By connecting to a crafted access point that supplies a targeted (Venue Group or Venue Type) v...

CVE-2016-3882

Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service reboot via an access point that provides a crafted 1 Venue Group or 2 Venue Type value, aka internal bug 29464811...

CVE-2016-3905

CVE-2016-3905 affects the Qualcomm Wi‑Fi driver (CORE/HDD/wlan_hdd_main.c) in Android, before the 2016-10-05 patch, on Nexus 5X. A crafted application sending SENDACTIONFRAME can elevate privileges locally. The issue is documented with a High impact (CVE-2016-3905) and a CVSS3 base score of 7.8, ...

CVE-2016-6675

Off-by-one error in CORE/HDD/src/wlanhddhostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to gain privileges or cause a denial of service buffer overflow via a crafted application that makes a linkspeed ioctl call, aka Android...

CVE-2016-6680

CORE/HDD/src/wlanhddwext.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes an iwsetpriv ioctl call, aka Android internal bug 29982678 and Qualcomm internal bug CR...

CVE-2016-3905

CORE/HDD/src/wlanhddmain.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application that sends a SENDACTIONFRAME command, aka Android internal bug 28061823 and Qualcomm internal bug CR 1001449...

CVE-2016-6676

CVE-2016-6676 is an off-by-one error in CORE/HDD/src/wlan_hdd_cfg.c of the Qualcomm Wi‑Fi driver affecting Android on Nexus 5X and Android One devices prior to 2016-10-05. The vulnerability allows a local attacker to gain privileges or cause a denial of service (buffer overflow) by a crafted appl...

CVE-2016-6679

CVE-2016-6679 affects Qualcomm Wi‑Fi driver in Android on Nexus 5X and Android One devices, targeting CORE/HDD/src/wlan_hdd_hostapd.c. A crafted app calling setwpaie ioctl can disclose sensitive information. Affected OS versions are Android before 2016-10-05. The vulnerability is documented in th...

CVE-2016-6691

service/jni/comandroidserverwifiGbk2Utf.cpp in the Qualcomm Wi-Fi gbk2utf module in Android before 2016-10-05 allows remote attackers to cause a denial of service framework crash or possibly have unspecified other impact via an access point that has a malformed SSID with GBK encoding, aka Qualcom...

CVE-2016-6691

CVE-2016-6691 affects the Qualcomm Wi-Fi gbk2utf module in Android. The vulnerability allows remote attackers to cause a denial of service (framework crash) or potentially other unspecified impact by connecting to an AP presenting a malformed GBK-encoded SSID, due to improper handling in service/...

CVE-2016-6680

CNVD-2016-09390 describes CVE-2016-6680 as an information disclosure vulnerability in the Qualcomm CORE/HDD WLAN driver (wlan_hdd_wext.c) on Android devices, prior to 2016-10-05, affecting Nexus 5X and Android One. An attacker could obtain sensitive information by inducing a crafted application t...

CVE-2016-3925

CVE-2016-3925 affects Android 6.x and 7.0, where the Wi‑Fi ANQPFactory (server/wifi/anqp/ANQPFactory.java) can be triggered by a crafted app to cause a denial of service (blocked Wi‑Fi usage). Root cause: a vulnerability in the ANQPFactory path that allows a crafted application to disrupt Wi‑Fi o...

CVE-2016-6679

CORE/HDD/src/wlanhddhostapd.c in the Qualcomm Wi-Fi driver in Android before 2016-10-05 on Nexus 5X and Android One devices allows attackers to obtain sensitive information via a crafted application that makes a setwpaie ioctl call, aka Android internal bug 29915601 and Qualcomm internal bug CR...