CVE-2015-8996

CVE-2015-8996 describes a time-of-check time-of-use race condition in a TrustZone QFPROM routine affecting Android builds from CAF using the Linux kernel. The issue centers on the TrustZone protected QFPROM path; the root cause is a TOCTOU race in the QFPROM routine, potentially enabling incorrec...

CVE-2015-9000

Technical details about CVE-2015-9000 are not publicly available in the provided Connected documents; the description only states a TrustZone untrusted pointer dereference in a DRM routine across CAF Android kernel releases.

CVE-2015-9001

Technical details, affected components, and remediation for CVE-2015-9001 are not publicly provided in the connected documents. Monitor updates from NVD/Android sources.

CVE-2015-9011

CVE-2015-9011 is a privilege-escalation vulnerability reported in Qualcomm closed-source components affecting the Android kernel. The connected sources confirm the issue as elevation of privilege, with Android kernel involvement and no publicly disclosed exploit details in the provided documents....

CVE-2016-0846

CVE-2016-0846 affects the IMemory Native Interface (libs/binder/IMemory.cpp) in Android, where the heap size is not properly accounted for, enabling a local attacker to gain privileged execution (Signature or SignatureOrSystem) via a crafted app. The issue affects Android 4.x up to 4.4.3/4.4.4, 5...

CVE-2016-10238

CVE-2016-10238 concerns the QSEE component in CAF Android builds. The issue stems from a page-alignment problem that could potentially bypass the Linux kernel access control. The vulnerability is described as a local issue within QSEE across Android releases from CAF, with the impact explicitly s...

CVE-2016-10335

CVE-2016-10335 involves Android CAF builds; connected documents indicate that the Linux kernel usage within CAF Android releases involves an update to libtomcrypt. The available sources do not provide explicit vulnerability details, affected vendor/product version ranges, root cause analysis, exp...

CVE-2016-10386

CVE-2016-10386 describes an array index out of bounds vulnerability in LPP within Qualcomm CAF Android/Linux kernel components. Public docs confirm the issue affects Qualcomm-labeled CAF Linux kernel code and characterize it as an out-of-bounds condition in LPP, with high-severity impact (per CVS...

CVE-2016-10387

CVE-2016-10387 concerns Qualcomm CAF Android devices using the Linux kernel, where an assertion could be reachable during a handover. The CVSS3/3.0 score is 9.8 (CRITICAL) with high impact to confidentiality, integrity, and availability, indicating severe risk if exploitable. The provided Connect...

CVE-2016-11026

CVE-2016-11026 affects Samsung mobile devices running KK (4.4), L (5.0/5.1) and M (6.0). The issue is in BootReceiver where improper exception handling can trigger a system crash (DoS). Public details across NVD, Red Hat, CNVD, and CVE listings consistently describe the crash trigger but do not d...

CVE-2016-2418

Summary: CVE-2016-2418 affects Android 6.x mediaserver’s media/libmedia/IOMX.cpp where certain metadata buffer pointers are not initialized, enabling an attacker to read sensitive process memory and bypass a protection mechanism to gain Signature or SignatureOrSystem privileges. Affected componen...

CVE-2016-3753

Technical details about CVE-2016-3753 are not publicly provided in the supplied documents. Mediaserver information disclosure vulnerability is described, but there is no version-specific or exploit information in the connected sources. Monitor for updates.

CVE-2016-3821

CVE-2016-3821 affects libmedia in mediaserver (Android Mediaserver). Affected Android versions include 4.x before 4.4.4, 5.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01; the issue arises from certain incorrect declarations that allow remote code execution or a denial of service (N...

CVE-2016-3876

CVE-2016-3876 affects Android 6.x before 2016-09-01 and 7.0 before 2016-09-01. The issue, described in SettingsProvider.java, enables physically proximate attackers to bypass SAFE_BOOT_DISALLOWED and boot to safe mode via the Android Debug Bridge (ADB). Root cause is a local bypass of safe-boot p...

CVE-2016-3911

CVE-2016-3911 affects Android’s Zygote process: core/java/android/os/Process.java in Zygote allows a crafted application to gain privileges, impacting Android 4.x (before 4.4.4), 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), 6.x (before 2016-10-01), and 7.0 (before 2016-10-01). Root cause is an ele...

CVE-2016-3914

CVE-2016-3914 describes a race condition in Telephony’s MmsProvider.java that could let a local attacker escalate privileges by crafting an app to manipulate the Telephony database between two open operations. Affected platforms include Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1....

CVE-2016-3924

Technical details beyond the initial description are not provided in the connected documents. Public information about affected products, specific versions, root cause, or patch status is not available here. Monitor for updates and new disclosures.

CVE-2016-3928

CVE-2016-3928 concerns the MediaTek video driver in Android prior to the 2016-10-05 patch level. The issue is an elevation of privilege: a local, crafted application could gain elevated privileges. The entry explicitly notes Android internal bug 30019362 and MediaTek internal bug ALPS02829384. No...

CVE-2016-6678

Summary: CVE-2016-6678 affects the Motorola USBNet driver on Nexus 6 devices running Android prior to 2016-10-05. Vulnerability: The issue is an information-disclosure flaw in the USBNet driver that could allow a local malicious application to access data outside its normal permissions. Root caus...

CVE-2016-6700

CVE-2016-6700 affects the libzipfile component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1. The issue is an elevation of privilege that could allow a local malicious app to execute arbitrary code in the context of a privileged process (Android ID A-30916186). Public vu...

CVE-2016-6704

CVE-2016-6704 is an elevation-of-privilege issue in Android’s Mediaserver. The vulnerability could allow a local malicious app to execute arbitrary code within a privileged process. It affects multiple Android releases (4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, 6.x up to 2016-11-01, ...

CVE-2016-6705

CVE-2016-6705 is an elevation of privilege in Android’s Mediaserver. The issue could let a local malicious app execute arbitrary code within the context of a privileged process. Affected Android versions are 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-11-01, and 7.0 before 2016-11-01....

CVE-2016-6723

CVE-2016-6723 is a denial-of-service vulnerability in Android’s Proxy Auto Config (PAC) handling. A specially crafted PAC file could cause a device to hang or reboot. Affected: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before 2016-11-01; 7.0 before 2016-11-01. Root cau...

CVE-2016-6731

CVE-2016-6731 describes an elevation of privilege vulnerability in the NVIDIA GPU driver on Android prior to 2016-11-05. A local malicious app could execute arbitrary code in the kernel context , enabling a potential permanent device compromise. The issue is listed in public vulnerability tracker...

CVE-2016-6769

CVE-2016-6769 is an elevation-of-privilege vulnerability in Android’s Smart Lock. A local attacker could access Smart Lock settings without a PIN on an unlocked device where Smart Lock was the last settings pane accessed. Affected products/versions: Android 5.0.2, 5.1.1, 6.0, 6.0.1 (Android ID A-...

CVE-2017-0480

Technical details about CVE-2017-0480 are not publicly provided in the supplied documents. Monitor updates; current entries summarize impact but lack specific vulnerable components/versions within this dataset.

CVE-2017-0499

Technical details for CVE-2017-0499 are not publicly available in the provided connected documents. The Initial Description notes a Low impact DoS in Audioserver for specific Android versions, but no deeper exploit, root cause, or remediation details are supplied here.

CVE-2017-0601

CVE-2017-0601 is an Elevation of Privilege in Android Bluetooth, affecting Android 7.0/7.1.1/7.1.2 via the Bluetooth Share provider (content://com.android.bluetooth.opp/btopp). The vulnerability arises because an untrusted app could broadcast an ACCEPT action to the BluetoothOppReceiver, changing...

CVE-2017-0669

Technical details about CVE-2017-0669 are not publicly provided in the supplied documents. The records confirm an information-disclosure issue in the Android framework affecting Android 6.0–7.1.x, but do not specify root cause, vulnerable component, or fixes. Monitor for updates.

CVE-2017-0689

CVE-2017-0689 is a denial-of-service vulnerability in the Android media framework. It affects Android devices running versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 and 7.1.2. The connected documents corroborate that the issue is a DoS in the media framework, with attacker-controlled input possibl...

CVE-2017-0746

CVE-2017-0746 is a privilege-escalation in the Qualcomm IPA driver within the Android kernel. The vulnerability affects Android before patched releases (Android 7.1.2 and earlier per CNVD-2017-23419), with a remote attacker able to exploit to gain privileges. Patches were released as part of the ...

CVE-2017-0748

CVE-2017-0748 is an information-disclosure vulnerability in the Qualcomm audio driver affecting Android kernel. The issue is documented as an Android/Qualcomm component problem with Android ID A-35764875. Public references include QC-CR#2029798. The NVD entry confirms a partial confidentiality im...

CVE-2017-0838

CVE-2017-0838 is an elevation of privilege in Android’s media framework (libstagefright). Affected products are Android 7.0, 7.1.1, and 7.1.2 (Pixel/Nexus devices). The vulnerability is in the Media framework (libstagefright) and is classified as EoP with High severity in the Pixel/Nexus security...

CVE-2017-0873

CVE-2017-0873 is a DoS vulnerability in Android's media framework libmpeg2. The issue affects Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0, and is classified as DoS with impact to availability. The Android Security Bulletin lists this CVE under the Media framework with a high severity,...

CVE-2017-11003

CVE-2017-11003 affects Android for MSM, Firefox OS for MSM, and QRD Android builds via CAF Linux kernel. The issue arises during firmware image update where data is read from flash into RAM without confirming it fits allotted RAM, enabling potential memory mismanagement. Documented impact include...

CVE-2017-11006

CVE-2017-11006 is a Use-After-Free vulnerability in Android for MSM, Firefox OS for MSM, and QRD Android (CAF Linux kernel lineage) during positioning. The connected NVD entry confirms the issue and classifies it as high-severity with CVSS v3.0 base score 9.8 (Network, No user interaction, privil...

CVE-2017-11029

The CVE-2017-11029 issue is a Qualcomm Camera elevation vulnerability in Android on MSM devices. The vulnerability stems from the Camera CPP module Linux driver directly accessing a user-space buffer, with an unchecked ioctl_ptr->len used to copy data into a kernel buffer, enabling kernel memo...

CVE-2017-11044

The CVE-2017-11044 entry involves Android for MSM, Firefox OS for MSM, and QRD Android on CAF Linux kernel builds, where a race condition in a KGSL driver function can cause a Use-After-Free condition. The vulnerability is tied to a race in a KGSL driver path, leading to potential memory misuse. ...

CVE-2017-11047

CVE-2017-11047 applies to Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel; the issue is in a graphics-driver ioctl handler where missing copy_from_user() calls can allow writes to kernel memory. Impact per CVSS indicates LOCAL access with LOW user interaction an...

CVE-2017-11057

CVE-2017-11057 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel in compatibility mode. The vulnerability arises from flash_data handling in 64-bit userspace, where a userspace-provided address can lead to kernel memory disclosure or a fault. Impact is inf...

CVE-2017-11090

CVE-2017-11090 involves a buffer overread in the WLAN PMKID handling path (__wlan_hdd_cfg80211_set_pmksa) when a PMKID shorter than WLAN_PMKID_LEN is provided. Affected platforms include Android for MSM, Firefox OS for MSM, QRD Android, and CAF-based Android builds using the Linux kernel. The roo...

CVE-2017-11091

CVE-2017-11091 concerns a Use-After-Free condition in the Android MSM/CAF Linux kernel driver path /dev/mdss_rotator, triggered in the function mdss_rotator_ioctl. The issue is described as a Use-After-Free potentially occurring due to a fence being installed too early, affecting Android builds a...

CVE-2017-13159

CVE-2017-13159 is an information-disclosure flaw in Android’s activitymanagerservice. The Android Security Bulletin (Dec 2017) lists it under the System component with bug ID A-32879772 and affected Android versions 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0. Patch levels 2017-12-01 and 2017-1...

CVE-2017-13163

CVE-2017-13163 is an elevation of privilege in the Android kernel’s MTP USB driver. The vulnerability affects the kernel MTP USB driver component and allows a local attacker to escalate privileges with a vulnerability characterized as EoP in the Pixel/Nexus security bulletin context. The CVE entr...

CVE-2017-13193

CVE-2017-13193 affects Android via the Media/HEVC decoding path. The issue is an infinite loop in ihevcd_decode.c triggered by an sps with an unsupported resolution, causing the same SPS to be fed repeatedly. This can lead to a remote denial of service on a critical system process with no user in...

CVE-2017-13217

CVE-2017-13217 affects the LG Bootloader’s DisplayFtmItem in Android. It is an out-of-bounds write caused by reading a string without verifying it is null-terminated, enabling a local elevation of privilege and a secure-boot bypass that could let code execute with high privileges. Exploitation is...

CVE-2017-13238

CVE-2017-13238 corresponds to an information-disclosure issue in the HTC Android bootloader (XBLRamDump in the Bootloader). In XBLRamDump mode a debug feature can dump memory contents, enabling local information disclosure for an attacker with physical access and without additional privileges or ...

CVE-2017-13263

CVE-2017-13263 affects the Android framework (Android 8.0 and 8.1). The incident is classified as an Elevation of Privilege (EoP) in the framework; no specific root-cause technical details are provided in the documents. The accessible sources identify it under the Framework category with a Modera...

CVE-2017-13284

CVE-2017-13284 affects Android (Android 6.0 to 8.1). It is caused by improper input validation in config_set_string of config.cc, allowing a second Bluetooth keyboard to be paired without user approval, leading to remote elevation of privilege with no user interaction required. The Android bullet...

CVE-2017-13302

Concrete details for CVE-2017-13302 indicate a DoS in Android 8.0's System UI. Affected product: Android (System UI component) on Pixel/Nexus devices. The vulnerability is a denial of service (DoS) in System UI, with the Android Pixel/Nexus security bulletin noting patches at the 2018-04-05 patch...