CVE-2016-3936

CVE-2016-3936 concerns the MediaTek video driver in Android prior to the 2016-10-05 patch level. A crafted application could exploit an elevation-of-privilege flaw in the MediaTek video driver (Android internal bug 30019037; MediaTek ALPS02829568) to gain privileges within the kernel. The issue i...

CVE-2016-5347

CVE-2016-5347 describes an information-disclosure vulnerability in Qualcomm components, specifically in the CAF Android/Linux kernel audio driver. The issue allows leakage of kernel stack data to userspace via the audio driver, affecting Qualcomm-based Android devices using CAF-released kernels. ...

CVE-2016-6677

CVE-2016-6677 is an information-disclosure flaw in the NVIDIA GPU driver on Nexus 9 devices running Android prior to 2016-10-05. A crafted application can cause the driver to leak sensitive data. The connected NVIDIA/Android entries corroborate this as an information-disclosure issue tied to the ...

CVE-2016-6728

CVE-2016-6728 is a privilege-escalation flaw in the kernel ION subsystem of Android that could allow a local malicious app to execute code in kernel context. The issue is triggered via ION memory management and historically affects Android releases prior to the 2016-11-05 patch level, with potent...

CVE-2016-6751

CVE-2016-6751 describes an information-disclosure vulnerability in Qualcomm components used by Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) where a local malicious app could access data outside its permissions. The root cause is information exposure within thes...

CVE-2016-6765

CVE-2016-6765 is a denial-of-service vulnerability in Android’s Mediaserver component libstagefright. The issue allows a specially crafted file to cause a device hang or reboot, via Mediaserver when processing media data. Affected products/versions cited in the documents include Android 4.4.4, 5....

CVE-2016-8448

CVE-2016-8448 describes an elevation-of-privilege vulnerability in MediaTek components (including the thermal and video drivers) on Android. The issue could allow a local malicious application to execute arbitrary code in the kernel context, after compromising a privileged process. The NVD entry ...

CVE-2017-0696

CVE-2017-0696 is described as a denial-of-service vulnerability in the Android media framework affecting Android 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2 (Android ID A-37207120). The connected documents confirm the affected component as the Android media framework, but do not provide a detailed root cau...

CVE-2017-0726

CVE-2017-0726 is a DoS in Android's media framework libstagefright affecting Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. The root cause is a denial of service within libstagefright; exploitation details are not provided in the supplied documents, and there is no explicit in‑the‑wi...

CVE-2017-0728

CVE-2017-0728 is a denial-of-service vulnerability in the Android media framework, specifically the HEVC decoder. Affected products/versions: Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. The issue is classified as DoS in the Media framework with absence of explicit exploit details in the ...

CVE-2017-0735

CVE-2017-0735 represents a denial-of-service vulnerability in Android’s media framework libavc affecting Android 6.0–7.2 (6.0, 6.0.1, 7.0, 7.1.1, 7.1.2). Multiple sources (NVD entry, CNVD-2017-23406) describe a DoS in the libavc component of the Media framework, with no publicly disclosed exploit...

CVE-2017-0736

CVE-2017-0736 affects Android’s media framework libavc and is a DoS vulnerability in the component used for multimedia. Affected products/versions include Android 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The available connected sources describe the issue as a denial of service without detailing the exa...

CVE-2017-0742

CVE-2017-0742 is an Elevation of Privilege vulnerability in the MediaTek Video driver used by Android kernel. The issue affects Android devices with MediaTek video components and could allow a local attacker to execute arbitrary code within a privileged context (EoP). Public detail across connect...

CVE-2017-0753

CVE-2017-0753 is a remote code execution vulnerability reported in the Android libraries (libgdx), affecting Android versions 7.1.1, 7.1.2, and 8.0 (Android ID: A-62218744). The available connected documents indicate the issue is classified as RCE in the Libraries section of the Android Security ...

CVE-2017-0801

CVE-2017-0801 is a local elevation-of-privilege issue in MediaTek libmtkomxvdec (LibMtkOmxVdec) used by Android kernels. It’s classified as EoP (High) and is addressed in the Android/MediaTek stack by vendor patches released to AOSP; remediation is to apply the patched Android build or vendor upd...

CVE-2017-0849

The CVE-2017-0849 entry describes an information disclosure vulnerability in Android’s media framework (libavc) affecting Android 6.0–8.0 (versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0). The available description states an information disclosure but does not specify the exact root cause, affected c...

CVE-2017-0864

CVE-2017-0864 is an elevation-of-privilege vulnerability in MediaTek ioctl (flashlight) exposed on Android kernels. Connected sources confirm the issue affects MediaTek ioctl flashlight within the Android kernel, enabling an attacker to gain elevated privileges. The CNVD entry explicitly describe...

CVE-2017-0869

CAVEAT: CVE-2017-0869 is tied to the NVIDIA driver. The vulnerability is described as an integer overflow in the driver that can lead to a use-after-free and a potential elevation of privilege enabling code execution as a privileged process. Affected component: NVIDIA driver (Android context). Im...

CVE-2017-11010

CVE-2017-11010 affects Qualcomm closed-source components in Android (devices using Snapdragon IoT and listed SD/mobiles). Description from the CVE: leaving a configuration space unprotected due to faulty access control. Impact as per CVSS: Critical/HIGH on confidentiality, integrity, and availabi...

CVE-2017-11078

CVE-2017-11078 describes an out-of-bounds read in the boot image header processing for CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android with the Linux kernel). The issue is a local memory/read fault in the boot component, with CVSS scores indicating moderate to high impact acr...

CVE-2017-13173

CVE-2017-13173 is an elevation of privilege vulnerability affecting the MediaTek system server on Android. The issue targets the system server component (within MediaTek integration) and is described as an Android kernel topic, with local access requirements and high impact on confidentiality, in...

CVE-2017-13185

CVE-2017-13185 is an information-disclosure vulnerability in Android’s media framework libhevc. Affected products/versions per sources: Android 7.0, 7.1.1, 7.1.2, and 8.0. The root cause is information exposure via the libhevc decoder in the Media framework (details are consistent across NVD/CNVD...

CVE-2017-13199

CVE-2017-13199 affects Android 8.0 and 8.1. The issue arises in the Bitmap handling path (Bitmap.nativeCreate) where a failure during Bitmap creation does not throw an OOM, causing a downstream java.io.IOException and enabling a remote denial of service of a critical system process without user i...

CVE-2017-13202

CVE-2017-13202 is an information-disclosure vulnerability in Android’s media framework component libeffects . Affects Android releases listed in the entry: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. The connected documents consistently describe the issue as a libeffects information-disclosur...

CVE-2017-13296

CVE-2017-13296 is an information-disclosure vulnerability in the Android media framework (libavc). Affected Product/Component: Android media framework (libavc) across Android versions 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Root cause: information disclosure within libavc leads to partial confid...

CVE-2017-14879

CVE-2017-14879 affects the Qualcomm IPA driver (Android on Google Pixel/Nexus) via an IPA ioctl path that uses ipa_idr_find(), which can return a wrong structure pointer, causing slab out-of-bounds access in the IPA driver. This is listed as Elevation of Privilege (EoP) with a Moderate severity i...

CVE-2017-14898

CVE-2017-14898 affects Qualcomm WLAN in Android builds (Android for MSM, CAF/Linux kernel). The issue is a buffer overrun in QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE handling when QCA_WLAN_VENDOR_ATTR_TXPOWER_SCALE is less than 1 byte. Impact per sources includes high confidentiality, integrit...

CVE-2017-14902

CVE-2017-14902 describes a race condition in the GLink kernel driver across Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability is a Use-After-Free in the GLink driver that can potentially allow a local attacker to compromise the device (as indic...

CVE-2017-18060

CVE-2017-18060 affects Qualcomm WLAN within Android on MSM devices (e.g., Android for MSM, CAF-based/Linux kernel stacks). The root cause is improper input validation for resp_event->vdev_id inside wma_unified_bcntx_status_event_handler(), as received from firmware, leading to potential out-of...

CVE-2017-18061

CVE-2017-18061 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. The vulnerability stems from a potential buffer overflow when processing an AOA (Android Open Accessory) measurement event from WIGIG firmware in wil_aoa_evt_meas(), with Wil6210 as the rela...

CVE-2017-18666

CVE-2017-18666 affects Samsung mobile devices running Android versions from KK (4.4) through N (7.x). The issue allows applications to send arbitrary premium SMS messages due to a vulnerability in the device software (Samsung ID SVE-2017-8701). Impact is that apps could incur charges by sending p...

CVE-2017-18676

CVE-2017-18676 affects Samsung mobile devices running Android N (7.0) on Qualcomm chipsets and is described as an RKP kernel protection bypass caused by a lack of MSR trapping, enabling potential unwanted memory mappings. The issue is tied to Samsung ID SVE-2016-7901 (April 2017). Connected docum...

CVE-2017-18689

The CVE-2017-18689 issue affects Samsung mobile devices running M(6.0) and N(7.0) on Exynos5433/7420/7870 chipsets. A attacker can bypass the Kernel Module (ko) signature by modifying the count of kernel modules, enabling loading unsigned modules. This is described across Red Hat/Samsung CNVD and...

CVE-2017-6292

Summary: CVE-2017-6292 is an integer overflow in NVIDIA TLZ TrustZone’s TA-to-TA communication handler that can cause an out-of-bounds write, potentially enabling local code execution or denial of service within TrustZone. Affected: NVIDIA TLZ TrustZone OS components on Android devices (notably S...

CVE-2017-7367

CVE-2017-7367 concerns an integer underflow in the boot image processing path on Android CAF builds using the Linux kernel. The available connected documents identify this as a DoS-type issue (bootloader component) with a high-severity impact profile. The exact affected products, versions, and fi...

CVE-2017-8250

CVE-2017-8250 (Qualcomm GPU driver, Android CAF builds) affects Qualcomm GPU driver in Android CAF using the Linux kernel. The vulnerability arises when user-controlled variables nr_cmds and nr_bos are passed between functions without checks, allowing an integer overflow that can overflow a small...

CVE-2017-9676

CVE-2017-9676 affects the Qualcomm File System in Qualcomm devices running CAF Android builds on the Linux kernel. The underlying issue is use-after-free scenarios and race conditions when accessing global static variables without proper locking. Public references in the connected documents ident...

CVE-2017-9677

CVE-2017-9677 affects Qualcomm components, specifically the Audio driver, in CAF Android builds using the Linux kernel. The issue arises in msm_compr_ioctl_shared where ddp->params_length can be accessed/modified by multiple threads without proper locking, enabling race conditions. If ddp->...

CVE-2017-9679

CVE-2017-9679 affects Qualcomm products with Android CAF/Linux kernel. The issue arises when a userspace string is not NULL-terminated, allowing kernel memory contents to leak to system logs. This constitutes an information disclosure risk (partial confidentiality impact) as described in the vuln...

CVE-2017-9685

The CVE-2017-9685 entry concerns Qualcomm WLAN driver race conditions in Android CAF builds using the Linux kernel, producing a Use-After-Free condition. Affected software is Qualcomm products with CAF Android releases, where the WLAN driver’s race condition can impact confidentiality, integrity,...

CVE-2017-9687

CVE-2017-9687 involves a race between two concurrent threads/processes in Android for MSM (and related CAF/Linux kernel builds) where they can write the value "0" to a debugfs file that controls ipa ipc log. This can lead to a double-free in ipc_log_context_destroy() and a Use-After-Free when the...

CVE-2017-9706

Technical details about CVE-2017-9706 are not provided in the supplied documents. The initial description only notes a potential array out-of-bounds in a display driver; no vendor/product/version specifics or fixes are included. Monitor for updates.

CVE-2018-11297

CVE-2018-11297 affects Qualcomm WLAN Host in Android (CAF/Linux kernel-based builds such as Android for MSM) where the WMA NDP event handler can over-read due to missing validation of input value event_info received from firmware. This is described as a buffer over-read/overflow in the WLAN Host ...

CVE-2018-11852

CVE-2018-11852 affects Qualcomm WLAN host components used in Android (CAF Qualcomm WLAN stack). The vulnerability stems from an improper check in the WMA API for inputs received from firmware, which can cause an out-of-bounds write to the host structure. According to the Pixel security bulletin, ...

CVE-2018-21043

Summary: CVE-2018-21043 affects Samsung mobile devices with O(8.x) and P(9.0) (Exynos 9810) where a information disclosure vulnerability exists in the kernel pointer handling within the g2d_drv driver caused by logging. Affected software/hardware (documented): Samsung mobile devices running O(8.x...

CVE-2018-21049

CVE-2018-21049 affects Samsung mobile devices with N7.x/O8.x (Exynos). The issue is an arbitrary memory write in a Trustlet caused by a secure driver exposing access to sensitive APIs (Samsung ID SVE-2018-12881). CVSS v3.1 base score 9.8 (CRITICAL): Network attack, no user interaction, high impac...

CVE-2018-21058

CVE-2018-21058 affects Samsung mobile devices running Android 7.0/8.0 on Exynos 7420/8890/8996. The issue enables cache attacks against the Keymaster AES-GCM implementation because T-Tables are used and the Cryptography Extension (CE) is not utilized. Samsung ID: SVE-2018-12761. No exploitation o...

CVE-2018-21063

Technical details about CVE-2018-21063 are not publicly available in the provided documents. Monitor for updates from vendors (e.g., Red Hat, CVE databases) and check for any new advisories or patches.

CVE-2018-21069

CVE-2018-21069 affects Samsung mobile devices running N(7.x) with MediaTek chipsets. The issue is an information disclosure of kernel stack memory in a MediaTek driver. Samsung reference ID SVE-2018-11852 (July 2018). Connected sources corroborate the vulnerability but do not provide exploit deta...

CVE-2018-21074

CVE-2018-21074 affects Samsung mobile devices running M(6.x) software on Exynos or Qualcomm chipsets. The issue is information disclosure from a Trustlet via the debug log. The available documents do not specify affected device models, versions, or the exact root cause details beyond the trustlet...