CVE-2015-9008

CVE-2015-9008 is an elevation-of-privilege vulnerability in Qualcomm closed‑source components used by Android kernel (Android ID A-36384689). The issue is described as a privilege escalation in Qualcomm components; no public exploitation details are provided in the connected docs. Remediation is ...

CVE-2015-9040

Technical details (affected product/version, root cause, exploitability) for CVE-2015-9040 are not publicly provided in the connected documents; monitor for updates.

CVE-2015-9064

CVE-2015-9064 affects Qualcomm components used in Android CAF builds on the Linux kernel. The issue enables a UE to send its IMEI or IMEISV to the network in response to a network request before NAS security is activated. This vulnerability is described consistently across multiple sources (NVD/N...

CVE-2015-9070

CVE-2015-9070 describes a buffer over-read vulnerability in the TrustZone syscall of Qualcomm closed-source components used in Android builds (CAF Linux kernel). The issue affects Qualcomm components within Android devices that rely on CAF Linux kernels and TrustZone. The root cause is a buffer o...

CVE-2016-0844

The CVE-2016-0844 issue affects the Qualcomm RF driver in Android 6.x prior to 2016-04-01. The underlying flaw is improper restriction of socket ioctl calls, enabling a local attacker with a crafted app to execute code with kernel context privileges (privilege escalation). This vulnerability is l...

CVE-2016-10334

CVE-2016-10334 affects Android CAF builds using the Linux kernel; a dynamically-protected DDR region could potentially be overwritten. The available documents identify the issue and reference Android security bulletins, but do not provide specific root-cause details, affected product versions, or...

CVE-2016-10343

CVE-2016-10343 describes a memory leak in Qualcomm components across Android CAF builds when an SSL handshake failure with ClientHello rejection occurs. Affected are Qualcomm-provided, closed-source components used in Qualcomm-based Android devices; root cause is memory being leaked during the TL...

CVE-2016-10389

Technical details about CVE-2016-10389 are not publicly provided in the supplied documents; no affected product/version or remediation details are specified. Monitor for updates from official sources.

CVE-2016-11031

The CVE-2016-11031 entry applies to Samsung mobile devices running Android KK/4.4, L/5.0–5.1, and M/6.0. It involves the AntService component, where an issue can cause the system_server to crash and reboot. Connected sources corroborate the same affected platform and impact; no explicit exploit d...

CVE-2016-11040

Technical details for CVE-2016-11040 are not publicly provided in the supplied documents. Monitor for updates and future disclosures.

CVE-2016-11053

CVE-2016-11053 concerns a Factory Reset Protection (FRP) bypass on Samsung mobile devices with software up to 2015-11-11 (FRP/RL support). The entry notes the Samsung ID SVE-2015-5131 (January 2016). The description indicates an FRP bypass vulnerability, but does not provide technical details on ...

CVE-2016-1155

The CVE-2016-1155 entry concerns an HTTP header injection vulnerability in the URLConnection class across Android OS versions 2.2–6.0. The root cause is HTTP header injection that enables a remote attacker to execute arbitrary scripts or set arbitrary values in cookies. Public references in the c...

CVE-2016-2420

CVE-2016-2420 affects Android 4.x up to before 4.4.4, where the Debuggerd component fails to ensure the /data/tombstones directory exists via rootdir/init.rc. This can allow a crafted local app to gain privileges and potentially execute arbitrary code, enabling elevation of privilege from system ...

CVE-2016-2426

The CVE-2016-2426 entry describes an Information Disclosure vulnerability in Android Framework’s ContentService (Android 4.x up to 6.x). The root cause is that ContentService.java does not check GET_ACCOUNTS permission, allowing a crafted local application to obtain sensitive information from aff...

CVE-2016-2450

CVE-2016-2450 affects Android Mediaserver (libstagefright) where codecs/on2/enc/SoftVPXEncoder.cpp does not validate OMX buffer sizes. The issue resides in mediaserver’s handling of certain video/codec operations and enables local privilege escalation to Signature or SignatureOrSystem via a craft...

CVE-2016-2465

CVE-2016-2465 is an elevation-of-privilege vulnerability in the Qualcomm video driver on Android devices (Nexus 5, 5X, 6, 6P) prior to 2016-06-01. A crafted application could gain kernel-level privileges. The issue stems from the Qualcomm video driver bug 27407865. Mitigation, as documented in th...

CVE-2016-2470

CVE-2016-2470 concerns the Qualcomm Wi‑Fi driver in Android on Nexus 7 (2013) prior to 2016-06-01. A crafted app could grant privileges via the Wi‑Fi driver, i.e., a local elevation of privilege vulnerability. The Android 2016-06-01 security bulletin notes a patch level of June 01, 2016 or later;...

CVE-2016-2486

CVE-2016-2486 affects Android Mediaserver’s libstagefright component (mp3dec/SoftMP3.cpp). The flaw stems from not validating the relationship between allocated memory and the frame size, enabling memory corruption that can be exploited by a crafted Android app to gain privileges (Signature or Si...

CVE-2016-2496

The CVE-2016-2496 issue concerns the Framework UI permission-dialog in Android 6.x before 2016-06-01. A partially overlapping window allows tapjacking and access to arbitrary private-storage files due to an internal bug (26677796). The vulnerability’s impact is described as elevated access to pri...

CVE-2016-3743

CVE-2016-3743 affects Android 6.x Mediaserver: the file decoder/ih264d_api.c in mediaserver may have uninitialized data structures, enabling remote attackers to trigger memory corruption and potentially achieve remote code execution or cause a denial of service when processing a crafted media fil...

CVE-2016-3746

CVE-2016-3746 is a use-after-free vulnerability in the mm-video-v4l2 vdec component of Mediaserver on Android. It affects Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01. The underlying issue is a use-after-free that can allow attackers to escalate priv...

CVE-2016-3766

CVE-2016-3766 affects MPEG4Extractor.cpp in libstagefright within Android MediaServer. The vulnerability arises because memory allocation success is not checked, enabling a crafted media file to cause a denial of service (device hang or reboot). Affected Android lines include 4.x up to 4.4.4, 5.0...

CVE-2016-3812

CVE-2016-3812 describes an information-disclosure vulnerability in the MediaTek video codec driver on Android One devices, prior to 2016-07-05. A crafted app could cause data leakage to the attacker via the MediaTek/Android pipeline (Android internal bug 28174833 and MediaTek internal bug ALPS026...

CVE-2016-3829

CVE-2016-3829 affects the ih264d decoder in mediaserver on Android 6.x prior to 2016-08-01. The root cause is uninitialized structure members in the decoder, allowing a crafted media file to cause a denial of service (device hang or reboot). The impact is limited to Mediaserver processing media c...

CVE-2016-3830

CVE-2016-3830 affects Android Mediaserver’s Mediaserver component, specifically codecs/aacdec/SoftAAC2.cpp in libstagefright. The underlying flaw allows a crafted ADTS data packet to trigger a denial of service, causing device hang or reboot. Affected Android branch versions are 4.x before 4.4.4,...

CVE-2016-3839

CVE-2016-3839 affects Android Bluetooth stack across multiple releases: Android 4.x up to 4.4.3, 5.0.x up to 5.0.1, 5.1.x up to 5.1.0, and 6.x prior to 2016-08-01. A crafted application can send a signal to the Bluetooth process, exploiting internal bug 28885210 to cause a denial of service (loss...

CVE-2016-3873

CVE-2016-3873 affects the NVIDIA kernel on Android (Nexus 9) prior to 2016-09-05. An attacker can gain privileges via a crafted application due to improper validation in the DVS Framework input, aka internal bug 29518457. Connected sources confirm affected platform (Android/Nexus 9) and root caus...

CVE-2016-3874

CVE-2016-3874 affects the Qualcomm Wi‑Fi driver (Android) in Nexus 5X prior to 2016-09-05. The flaw is in CORE/HDD/src/wlan_hdd_wext.c where the arguments array is not properly validated, allowing a crafted application sending WE_UNIT_TEST_CMD to gain privileges. Root cause noted as Android inter...

CVE-2016-3893

CVE-2016-3893 affects the Qualcomm sound codec on Android devices (Nexus 6P) prior to 2016-09-05. The vulnerability lies in the wcdcal_hwdep_ioctl_shared function in sound/soc/codecs/wcdcal-hwdep.c, which does not properly copy firmware data, enabling a crafted application to cause information di...

CVE-2016-3899

CVE-2016-3899 affects OMXCodec.cpp in libstagefright within Android’s Mediaserver. The vulnerability arises because a pointer is not properly validated, enabling a crafted media file to trigger a denial of service (device hang or reboot). Affected ranges per the entry are Android 4.x before 4.4.4...

CVE-2016-3909

The CVE-2016-3909 entry affects Android’s Mediaserver (libstagefright) SoftMPEG4 in the MediaServer component. The vulnerability enables privilege escalation via a crafted application and is tied to specific Android versions: 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 20...

CVE-2016-3936

CVE-2016-3936 concerns the MediaTek video driver in Android prior to the 2016-10-05 patch level. A crafted application could exploit an elevation-of-privilege flaw in the MediaTek video driver (Android internal bug 30019037; MediaTek ALPS02829568) to gain privileges within the kernel. The issue i...

CVE-2016-3940

CVE-2016-3940 affects the Android Synaptics touchscreen driver on Nexus 6P and Android One devices, prior to the 2016-10-05 patch level. The issue allows a local attacker to escalate privileges through a crafted application, due to a vulnerability in the Synaptics touchscreen driver (internal bug...

CVE-2016-6703

CVE-2016-6703 describes a remote code execution vulnerability in the Android runtime library (ART). Affected Android releases include 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; and 6.x before 2016-11-01. An attacker could supply a specially crafted payload to execute arbitrary code...

CVE-2016-6715

CVE-2016-6715 is an elevation-of-privilege vulnerability in Android Framework APIs. A local malicious app could record audio without user permission on affected builds: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before 2016-11-01; and 7.0 before 2016-11-01. Root cause i...

CVE-2016-6727

CVE-2016-6727 is a vulnerability described as affecting the Qualcomm GPS subsystem in Android on Android One devices, enabling remote code execution via a network-like vector. The linked records identify the issue as part of Qualcomm component vulnerabilities with a Critical impact (CVE-2016-6727...

CVE-2016-6728

CVE-2016-6728 is a privilege-escalation flaw in the kernel ION subsystem of Android that could allow a local malicious app to execute code in kernel context. The issue is triggered via ION memory management and historically affects Android releases prior to the 2016-11-05 patch level, with potent...

CVE-2016-6736

CVE-2016-6736 is an elevation-of-privilege vulnerability in the NVIDIA GPU driver on Android, allowing a local malicious app to run code in the kernel context. Affected: Android devices with the NVIDIA GPU driver prior to the 2016-11-05 patch; impact is rated Critical (potential local permanent d...

CVE-2016-6743

CVE-2016-6743 affects the Synaptics touchscreen driver on Android prior to 2016-11-05. It is an elevation-of-privilege flaw that could let a local, privileged-execution attacker run arbitrary code in the kernel context. The issue requires compromising a privileged process and is described as High...

CVE-2016-6910

The CVE-2016-6910 entry describes a local notification-listener disclosure affecting Samsung Galaxy S6 Edge devices running Android 5.0.2 initially. The vulnerability arises from a non-existent notification listener that, via a vulnerable system app, can allow a non-existent app (package name com...

CVE-2016-8448

CVE-2016-8448 describes an elevation-of-privilege vulnerability in MediaTek components (including the thermal and video drivers) on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context, after compromising a privileged process. The NVD entry ...

CVE-2017-0425

Technical details about CVE-2017-0425 are not publicly provided in the connected documents. The materials confirm a moderate information-disclosure issue in Android Audioserver but lack specifics on affected builds, exploit vectors, or fixes.

CVE-2017-0636

CVE-2017-0636 is an elevation of privilege in the MediaTek command queue driver on Android, enabling a local attacker to execute arbitrary code in the kernel context. Affected component: MediaTek command queue driver (MediaTek components in the 2017-06 Android bulletin). Root cause: vulnerability...

CVE-2017-0723

CVE-2017-0723 is an Android media framework (libavc) remote code execution vulnerability affecting Android 6.0–7.1.2. Exploitation arises from libavc handling of crafted media content; CVSSv3: HIGH, with local attack vector and user interaction required. References describe Android’s August 2017 ...

CVE-2017-0755

CVE-2017-0755 is an Elevation of Privilege in Android’s libminikin library affecting Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 and 8.0. The CVSSv3 base score is 7.8 (High) with LOCAL attack vector, LOW complexity, no privileges required, user interaction required, and impact to...

CVE-2017-0825

CVE-2017-0825 is an information-disclosure vulnerability in the Broadcom WiFi driver used by Android (Android kernel). Connected sources identify the issue as a Broadcom WiFi driver information leakage vulnerability affecting Android devices, with the vulnerability classified as Moderate (WiFi dr...

CVE-2017-0849

The CVE-2017-0849 entry describes an information disclosure vulnerability in Android’s media framework (libavc) affecting Android 6.0–8.0 (versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0). The available description states an information disclosure but does not specify the exact root cause, affected c...

CVE-2017-11010

CVE-2017-11010 affects Qualcomm closed-source components in Android (devices using Snapdragon IoT and listed SD/mobiles). Description from the CVE: leaving a configuration space unprotected due to faulty access control. Impact as per CVSS: Critical/HIGH on confidentiality, integrity, and availabi...

CVE-2017-11038

CVE-2017-11038 is a Qualcomm memory-subsystem Elevation of Privilege flaw affecting Android on MSM devices (and CAF-based kernels) where, during boot image header processing, range checks can be bypassed by supplying different header versions. This enables possible local privilege escalation. The...

CVE-2017-11054

CVE-2017-11054 affects Android for MSM, Firefox OS for MSM, and QRD Android on CAF Linux kernels. The vulnerability is a buffer over-read triggered when processing a specially crafted cfg80211 vendor command, potentially impacting confidentiality (as per CVSS) and availability. Connected document...