CVE-2015-6631

CVE-2015-6631 affects the Android libstagefright component. The vulnerability in libstagefright allows remote attackers on affected Android builds (pre-5.1.1 LMY48Z and pre-6.0) to obtain sensitive information and bypass an unspecified protection mechanism via unknown vectors, e.g., by obtaining ...

CVE-2015-8596

CVE-2015-8596 concerns a buffer length validation flaw in Qualcomm closed‑source malware protection components used in Android CAF builds running the Linux kernel. The root cause is missing validation of buffer lengths, described across multiple sources as a buffer overflow/length-check omission....

CVE-2015-9001

Technical details, affected components, and remediation for CVE-2015-9001 are not publicly provided in the connected documents. Monitor updates from NVD/Android sources.

CVE-2015-9032

CVE-2015-9032: In CAF Android releases using the Linux kernel, a DRM key was exposed to QTEE applications, enabling information disclosure of DRM secrets. The description does not provide remediation details or explicit root-cause fixes in the supplied documents.

CVE-2016-0812

The CVE-2016-0812 entry concerns the Setup Wizard in Android 5.1.x before 5.1.1 LMY49G and Android 6.0 before 2016-02-01. The vulnerability arises from the interceptKeyBeforeDispatching function in policy/src/com/android/internal/policy/impl/PhoneWindowManager.java, where setup completion is not ...

CVE-2016-0838

CVE-2016-0838 affects Sonivox in mediaserver on Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x prior to 2016-04-01. The flaw occurs when mediaserver’s Sonivox component does not check for a negative number of samples, allowing remote attackers to execute arbitrary code or ...

CVE-2016-0849

CVE-2016-0849 describes an Elevation of Privilege in Android’s Recovery Procedure due to multiple integer overflows in minzip/SysUtil.c. A local attacker could exploit a crafted application to gain Signature or SignatureOrSystem privileges. Affected versions: Android 5.0.x prior to 5.0.2, 5.1.x p...

CVE-2016-10238

CVE-2016-10238 concerns the QSEE component in CAF Android builds. The issue stems from a page-alignment problem that could potentially bypass the Linux kernel access control. The vulnerability is described as a local issue within QSEE across Android releases from CAF, with the impact explicitly s...

CVE-2016-10332

CVE-2016-10332 : Affects Android builds from CAF using the Linux kernel where stack protection was not enabled for secure applications. The available description specifies the missing stack-protection bit but provides no details on affected products/versions beyond “Android releases from CAF usin...

CVE-2016-10335

CVE-2016-10335 involves Android CAF builds; connected documents indicate that the Linux kernel usage within CAF Android releases involves an update to libtomcrypt. The available sources do not provide explicit vulnerability details, affected vendor/product version ranges, root cause analysis, exp...

CVE-2016-11027

CVE-2016-11027 affects Samsung mobile devices running M(6.0) software. In the Shade Locked state, a physically proximate attacker can read notifications on the lock screen. The entry provides the Samsung ID SVE-2016-7132 but does not specify exploit details, affected models, versions beyond Andro...

CVE-2016-11034

CVE-2016-11034 affects Samsung mobile devices running L/5.0–5.1 and M/6.0 where the decode function in Qjpeg (Qt 5.7) can trigger a system crash via a malformed image. Root cause: improper handling in Qjpeg decoding. Affected component: Qt 5.7 Qjpeg on Samsung devices (SVE-2016-6560). Impact: sys...

CVE-2016-11045

The CVE-2016-11045 entry relates to Samsung mobile devices running Lollipop (5.0/5.1) where the Gallery library is vulnerable to memory corruption triggered by a malformed image. Documented impact indicates potential data/process integrity concerns within the Gallery component. The issue is assoc...

CVE-2016-2461

CVE-2016-2461 affects OpenSSLCipher.java in Conscrypt on Android 6.x. The issue arises from mishandling resets of the AAD array, allowing a local attacker to spoof message authentication via unspecified vectors (internal bugs 27324690, 27696681). The vulnerability is tied to Conscrypt in the Andr...

CVE-2016-2496

The CVE-2016-2496 issue concerns the Framework UI permission-dialog in Android 6.x before 2016-06-01. A partially overlapping window allows tapjacking and access to arbitrary private-storage files due to an internal bug (26677796). The vulnerability’s impact is described as elevated access to pri...

CVE-2016-3746

CVE-2016-3746 is a use-after-free vulnerability in the mm-video-v4l2 vdec component of Mediaserver on Android. It affects Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01. The underlying issue is a use-after-free that can allow attackers to escalate priv...

CVE-2016-3771

The CVE-2016-3771 entry concerns privilege escalation in MediaTek drivers on Android One devices running before 2016-07-05. The root cause is a vulnerability in the MediaTek driver stack that can be exploited by a specially crafted application to gain elevated privileges within the device, aligne...

CVE-2016-3826

The CVE-2016-3826 advisory affects Android’s Mediaserver component, specifically the AudioFlinger path (services/audioflinger/Effects.cpp). The root cause is that the reply size for an AudioFlinger effect command is not validated, enabling a crafted application to escalate privileges within the d...

CVE-2016-3828

CVE-2016-3828 affects Android Mediaserver (decoder/ih264d_api.c) in Android 6.x prior to the 2016-08-01 patch, where invalid PPS/SPS NAL units are mishandled, enabling a crafted media file to cause a denial of service (device hang or reboot). The issue is categorized as a Mediaserver DoS vulnerab...

CVE-2016-3832

CVE-2016-3832 targets Android’s framework APIs. The vulnerability arises because Android 4.x–6.x runtime framework code does not consistently verify that package data originates from the Package Manager, potentially bypassing a protection mechanism via a crafted application. Affected versions inc...

CVE-2016-3840

CVE-2016-3840 affects Conscrypt in Android: versions 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x up to 2016-08-05 fail to properly identify session reuse, enabling remote arbitrary code execution via unspecified vectors. The NVD entry mirrors this description with a high/critic...

CVE-2016-3911

CVE-2016-3911 affects Android’s Zygote process: core/java/android/os/Process.java in Zygote allows a crafted application to gain privileges, impacting Android 4.x (before 4.4.4), 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), 6.x (before 2016-10-01), and 7.0 (before 2016-10-01). Root cause is an ele...

CVE-2016-3913

CVE-2016-3913 affects media/libmediaplayerservice/MediaPlayerService.cpp in Mediaserver on Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, 6.x up to 2016-10-01, and 7.0 up to 2016-10-01. The root cause is that a certain static_cast is not validated, enabling privilege escalation vi...

CVE-2016-3924

Technical details beyond the initial description are not provided in the connected documents. Public information about affected products, specific versions, root cause, or patch status is not available here. Monitor for updates and new disclosures.

CVE-2016-5341

CVE-2016-5341 : Denial-of-service in the Android GPS component caused by spoofed xtra.bin/xtra2.bin files. The issue affects Android GPS logic prior to 2016-12-05, allowing a remote attacker (via a spoofed Qualcomm hosting domain) to trigger GPS signal-acquisition delays, potentially causing devi...

CVE-2016-5859

CVE-2016-5859 involves a vulnerability in the Qualcomm sound driver across Android for MSM, Firefox OS for MSM, and QRD Android. The issue arises when a function is called with a very large length, triggering an integer overflow that is followed by a buffer overflow. The description identifies me...

CVE-2016-6678

Summary: CVE-2016-6678 affects the Motorola USBNet driver on Nexus 6 devices running Android prior to 2016-10-05. Vulnerability: The issue is an information-disclosure flaw in the USBNet driver that could allow a local malicious application to access data outside its normal permissions. Root caus...

CVE-2016-6699

CVE-2016-6699 is a remote code execution in Mediaserver’s libstagefright on Android 7.0 (before 2016-11-01). The issue allows memory corruption during media file and data processing when a specially crafted file is processed. Impact is remote code execution within Mediaserver. The vulnerability i...

CVE-2016-6708

CVE-2016-6708 affects Android 7.0 System UI. It enables a local attacker to bypass the work-profile security prompt in Multi-Window mode, i.e., a local elevation of privilege without requiring user interaction. The issue is described as a local bypass of user interaction requirements and is categ...

CVE-2016-6723

CVE-2016-6723 is a denial-of-service vulnerability in Android’s Proxy Auto Config (PAC) handling. A specially crafted PAC file could cause a device to hang or reboot. Affected: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before 2016-11-01; 7.0 before 2016-11-01. Root cau...

CVE-2016-6724

CVE-2016-6724 details: A denial of service in the Android Input Manager Service could allow a local malicious app to cause the device to continually reboot. Affected: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before 2016-11-01; 7.0 before 2016-11-01. Impact is a tempor...

CVE-2016-6743

CVE-2016-6743 affects the Synaptics touchscreen driver on Android prior to 2016-11-05. It is an elevation-of-privilege flaw that could let a local, privileged-execution attacker run arbitrary code in the kernel context. The issue requires compromising a privileged process and is described as High...

CVE-2017-0389

CVE-2017-0389 is a denial-of-service vulnerability in Android’s core networking that could be triggered by a specially crafted network packet, leading to a device hang or reboot. Affected versions per the records are Android 6.0, 6.0.1, 7.0, and 7.1 (Android ID A-31850211). Public references in t...

CVE-2017-0401

CVE-2017-0401 is an information-disclosure vulnerability in the Qualcomm audio post-processor path (lvm/wrapper/Bundle/EffectBundle.cpp in libeffects). A locally running malicious application could access data outside its permissions on Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. T...

CVE-2017-0487

CVE-2017-0487 describes a denial-of-service vulnerability in Android’s Mediaserver. A specially crafted media file could cause a device hang or reboot, impacting Android 6.0/6.0.1/7.0/7.1.1. The vulnerability is exposed via Mediaserver’s media processing path and is classified with higher risk du...

CVE-2017-0529

CVE-2017-0529 is an information-disclosure vulnerability in the MediaTek driver for Android. A local malicious app could access data outside its permission levels due to the driver’s data exposure. Primary affected component: MediaTek driver in Android. Root cause: information disclosure (no expl...

CVE-2017-0560

CVE-2017-0560 is an information-disclosure vulnerability in the Android factory reset process that could allow a local attacker to access data from the previous owner. The NVD description lists affected Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1, with Android ID A-30681079. ...

CVE-2017-0671

CVE-2017-0671: A remote code execution vulnerability in the Android libraries affecting Android 4.4.4 (Library component). The available documents confirm RCE in the Libraries area of Android 4.4.4, but do not provide the exact root cause details, affected subcomponents, or concrete exploit vecto...

CVE-2017-0689

CVE-2017-0689 is a denial-of-service vulnerability in the Android media framework. It affects Android devices running versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 and 7.1.2. The connected documents corroborate that the issue is a DoS in the media framework, with attacker-controlled input possibl...

CVE-2017-0690

CVE-2017-0690 is a DoS vulnerability in Android’s media framework. Connected CNVD/NVD entries describe a denial of service that can be triggered by a remote attacker, with the backreference triggering a null pointer scenario. Affected Android versions include 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0,...

CVE-2017-0739

CVE-2017-0739 is an information-disclosure vulnerability in the Android media framework component libhevc. The issue affects Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2, and is related to information disclosure via media decoding. The connected documents confirm the affected ...

CVE-2017-0748

CVE-2017-0748 is an information-disclosure vulnerability in the Qualcomm audio driver affecting Android kernel. The issue is documented as an Android/Qualcomm component problem with Android ID A-35764875. Public references include QC-CR#2029798. The NVD entry confirms a partial confidentiality im...

CVE-2017-0808

CVE-2017-0808 is an information-disclosure vulnerability in the Android framework file system affecting Android 7.0, 7.1.1, 7.1.2 and 8.0 (Android ID A-62301183). The issue is documented across multiple sources; the core detail is unauthorized access to sensitive information via the framework fil...

CVE-2017-0828

CVE-2017-0828 is described across multiple sources as an elevation of privilege affecting Huawei bootloader within Android kernel contexts. The primary affected component is the bootloader on Huawei devices, enabling an attacker to escalate privileges. Public descriptions consistently label it as...

CVE-2017-0838

CVE-2017-0838 is an elevation of privilege in Android’s media framework (libstagefright). Affected products are Android 7.0, 7.1.1, and 7.1.2 (Pixel/Nexus devices). The vulnerability is in the Media framework (libstagefright) and is classified as EoP with High severity in the Pixel/Nexus security...

CVE-2017-0862

CVE-2017-0862 is an elevation of privilege in the Android upstream kernel (Kernel component). The connected records consistently describe it as a Kernel EoP issue affecting the Android kernel; no specific vulnerable version ranges or fixed versions are provided in the supplied documents. The mate...

CVE-2017-11023

Technical details (affected products, versions, root cause, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2017-11026

CVE-2017-11026 affects Android on Qualcomm MSM devices with CAF Linux kernel during FRP partition flashing. Descriptions in NVD/CNVD indicate an authentication flaw where the authentication method can be compromised for static keys when flashing the FRP partition using a reference FRP unlock. Thi...

CVE-2017-11049

CVE-2017-11049 describes a race condition in a video driver on Android devices (MSM/Qualcomm display stack) that can potentially lead to a buffer overflow. The affected scope includes Android builds for MSM, Firefox OS for MSM, and QRD Android, with CAF Linux kernel-based releases. The issue is c...

CVE-2017-11069

CVE-2017-11069 is a heap overflow in the SafeSwitch image handling, reported for Android for MSM platforms (CAF/Linux kernel) and associated Qualcomm bootloader contexts. The vulnerability arises from manipulation of SafeSwitch Image data, and is categorized in the Qualcomm bootloader area as an ...