CVE-2014-9957

CVE-2014-9957 is a privilege-escalation issue in Qualcomm closed-source components used by Android kernel. The NVD entry describes an Elevation of Privilege vulnerability affecting Qualcomm closed-source code; CVSSv3 vector indicates a network-exposed scenario with high impact to confidentiality,...

CVE-2015-0576

CVE-2015-0576 describes a buffer overflow in the HSDPA component used by Qualcomm in Android CAF/Linux kernel implementations. Connected sources corroborate a Qualcomm HSDPA buffer overflow affecting CAF-based Android releases, with CNVD noting potential arbitrary-code execution or denial of serv...

CVE-2015-3829

CVE-2015-3829 is an Android Stagefright vulnerability caused by an off-by-one error in MPEG4Extractor::parseChunk (libstagefright) that can allow remote code execution or memory corruption via crafted MPEG-4 covr atoms with size SIZE_MAX. Affected software: Android versions prior to 5.1.1 LMY48I....

CVE-2015-3843

The CVE-2015-3843 entry concerns the Android SIM Toolkit (STK) framework prior to 5.1.1 LMY48I. Affected component: STK within Android, related to com/android/internal/telephony/cat/AppInterface.java (internal bug 21697171). Impact: an unprivileged app can intercept or emulate unspecified Telepho...

CVE-2015-3854

CVE-2015-3854 affects Android 5.x; the vulnerability exists in PowerNotificationWarnings.java within the Android SystemUI power package. A broadcast intent using the PNW.stopSaver action can bypass the DEVICE_POWER permission requirement, enabling local access to perform restricted actions. The i...

CVE-2015-7889

CVE-2015-7889 affects the Samsung SecEmailComposer/EmailComposer on Galaxy S6 Edge prior to the October 2015 maintenance release. The vulnerability arises from weak permissions on the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service, allowing an unprivileged app with knowled...

CVE-2015-8073

CVE-2015-8073 concerns the Android mediaserver. The connected sources confirm a memory-corruption vulnerability in mediaserver that affects Android 4.4 and 5.1 prior to 5.1.1 LMY48X, with remote code execution or denial of service possible via a crafted media file. The root cause is described as ...

CVE-2015-8951

Technical details are not publicly available in the provided connected documents. The CVE entry mentions use-after-free in the Qualcomm sound driver affecting Nexus devices, but no concrete vendor/version/fix details are supplied here. Monitor for updates.

CVE-2015-9006

Technical details for CVE-2015-9006 are not publicly available in the provided documents. Monitor for updates.

CVE-2015-9023

The CVE-2015-9023 entry describes a buffer overflow in the PlayReady API, present in all Android releases from CAF using the Linux kernel. The vulnerability can enable a remote attacker to execute arbitrary code or cause a denial of service by exploiting the PlayReady API in affected Android comp...

CVE-2015-9030

CVE-2015-9030 describes an authentication bypass in Android CAF builds that use the Linux kernel, via misused Hypervisor API. Affected: Android devices with CAF/Linux Kerenel stack; vulnerable component: Hypervisor API. Root cause: improper handling of Hypervisor API calls enabling bypass of auth...

CVE-2015-9037

Summary: CVE-2015-9037 refers to a buffer over-read/overflow in Qualcomm closed-source components used in Qualcomm-based Android devices with CAF/Linux kernel, specifically in the downlink 3G NAS message processing. The vulnerability could allow a remote attacker to execute arbitrary code or caus...

CVE-2015-9042

Technical details about CVE-2015-9042 are not publicly available in the connected documents. The description notes a buffer overflow in Qualcomm CAF Android/Linux QMI processing, but no specific fixes or affected versions are provided here; monitor for updates.

CVE-2015-9044

In CVE-2015-9044, Qualcomm products with CAF Android releases using the Linux kernel have a vulnerability in LTE where an assertion can be reached due to an improper bound on the size of a frequency list. The NVD metrics indicate a CRITICAL impact (Network, No privileges, No user interaction) wit...

CVE-2016-0830

CVE-2016-0830 affects Android 6.x Bluetooth; btif_config.c handling of configuration entries can cause memory corruption and a persistent daemon crash when many entries are triggered, leading to remote DoS. The issue is tied to internal bug 26071376. Remediation is upgrading to patch level March ...

CVE-2016-10333

CVE-2016-10333 affects Android builds from CAF using the Linux kernel. The available details state that a sensitive system call was allowed to be called by HLOS, indicating a potential misuse of privileged interfaces. The documents do not provide explicit impact, affected versions, or remediation...

CVE-2016-10383

CVE-2016-10383 describes a TOCTOU race in Secure UI affecting Qualcomm CAF Android builds that use the Linux kernel. Affected: Qualcomm components in CAF Android/Linux kernel environments. Root cause: TOCTOU race condition in Secure UI. Impact: CVSS v3 base score 8.1 (HIGH) with high confidential...

CVE-2016-10393

CVE-2016-10393 describes an integer-overflow in Android for MSM, Firefox OS for MSM, and QRD Android builds (CAF Linux kernel) when processing oversized clips. This causes the allocated buffer to be smaller than needed, enabling potential buffer overflow during subsequent operations. The vulnerab...

CVE-2016-11032

CVE-2016-11032 affects Samsung mobile devices running Android 6.0 (Marshmallow); an input-validation error allows an unprotected broadcast intent to disable all Sound functionality. The issue is described across multiple sources (e.g., RH and CNVD) as enabling attackers to silence device audio vi...

CVE-2016-11043

Affected product: Samsung mobile devices running M(6.0) software. Issue: S/MIME in EAS uses DES instead of the intended 3DES, enabling weaker cryptographic protection. Documented as Samsung ID SVE-2016-5871 (June 2016). Impact per sources: design weakness in encryption; CVSS notes indicate higher...

CVE-2016-11046

The CVE-2016-11046 issue affects Samsung mobile devices running JBP (4.3), KK (4.4), and L (5.0/5.1) where a misused whitelist allows access to the Radio Interface Layer (RIL/RILD) enabling calls or SMS. Affected component is the RIL path; root cause is the whitelist mishandling, as described in ...

CVE-2016-2410

CVE-2016-2410 is a local privilege-escalation vulnerability in the Qualcomm video kernel driver used by Android 6.x. The issue allows a crafted app that gains control over a service capable of invoking the driver to elevate privileges due to an internal bug (26291677). The Android security bullet...

CVE-2016-2415

Technical details for CVE-2016-2415 are not publicly provided in the supplied documents. The available records summarize an information-disclosure vulnerability in Exchange ActiveSync/Autodiscover without specifics on affected products, versions, root cause, or fixes. Monitor for updates.

CVE-2016-2423

CVE-2016-2423 concerns the Telephony component in Android, specifically server/telecom/CallsManager.java, where provisioning status is not properly checked. This allows physically proximate attackers to bypass Factory Reset Protection (FRP) and delete data via unspecified vectors. Affected versio...

CVE-2016-2481

CVE-2016-2481 affects the mm-video-v4l2 venc component in Android Mediaserver. It arises from how Mediaserver mishandles a buffer count, enabling a local attacker to gain privileges (Signature or SignatureOrSystem) via a crafted app. Affected are Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1....

CVE-2016-2500

CVE-2016-2500 targets Android: Activity Manager in Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-06-01) fails to terminate process groups, enabling a crafted app to disclose sensitive information. Root cause: improper handling within Activity Manager. Impact as describe...

CVE-2016-2508

CVE-2016-2508 affects media/libmediaplayerservice/nuplayer/GenericSource.cpp in Mediaserver on Android 4.x (pre-4.4.4), 5.0.x (pre-5.0.2), 5.1.x (pre-5.1.1), and 6.x (pre‑2016-07-01). A crafted media file can cause memory corruption or arbitrary code execution due to improper validation of certai...

CVE-2016-3750

CVE-2016-3750 affects Android’s Parcels Framework APIs, specifically libs/binder/Parcel.cpp, where the return value of dup() is not validated. This could allow a local attacker to bypass the OS isolation protections via a crafted application, as described for Android 4.x before 4.4.4, 5.0.x befor...

CVE-2016-3773

The CVE-2016-3773 issue affects MediaTek drivers in Android One devices prior to 2016-07-05. The root cause is a privilege-escalation vulnerability that could be exploited by a locally crafted application, associated with Android internal bug 29008363 and MediaTek internal bug ALPS02703102. Publi...

CVE-2016-3805

CVE-2016-3805 describes an elevation-of-privilege vulnerability in the MediaTek power management driver on Android One devices. The flaw allows a locally executed crafted app to gain privileged access due to issues in the MediaTek power management driver, with impact limited to devices running An...

CVE-2016-3834

CVE-2016-3834 affects Android camera APIs where, on Android 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x prior to the August 2016 patch, a crafted app could bypass access restrictions and disclose details about ANW buffer addresses. This is a local information-disclosure issue i...

CVE-2016-3835

Summary (CVE-2016-3835) : A vulnerability in the Mediaserver component (mm-video-v4l2 venc) of Android’s mediaserver on 4.x to 6.x releases allows an attacker via a crafted application to read sensitive information by mishandling heap pointers. Affects Android versions listed in the description (...

CVE-2016-3840

CVE-2016-3840 affects Conscrypt in Android: versions 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5.1.x up to 5.1.1, and 6.x up to 2016-08-05 fail to properly identify session reuse, enabling remote arbitrary code execution via unspecified vectors. The NVD entry mirrors this description with a high/critic...

CVE-2016-3863

CVE-2016-3863 affects Android's MediaMuxer/LibStagefright AVCC reassembly code (Utils.cpp). Multiple stack-based buffer overflows in the AVCC reassembly path can be triggered by a crafted media file, enabling arbitrary code execution. Affected Android versions include 4.x prior to 4.4.4; 5.0.x pr...

CVE-2016-3879

CVE-2016-3879 concerns a denial-of-service vulnerability in Android’s Mediaserver. The issue resides in arm-wt-22k/lib_src/eas_mdls.c within Mediaserver and is triggered by processing a crafted media file, leading to a NULL pointer dereference and potentially device hang or reboot. Affected produ...

CVE-2016-3886

CVE-2016-3886 affects Android 7.0 System UI Tuner (systemui/statusbar/phone/QuickStatusBarHeader.java). The issue: the System UI Tuner on the lockscreen does not prevent tuner changes, enabling a physically proximate attacker to modify a setting and gain privileges. Root cause: ability to modify ...

CVE-2016-3890

The CVE-2016-3890 issue concerns the Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp across Android 4.x (before 4.4.4), 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-09-01). The root cause is mishandling of socket close operations, which can allow attackers to...

CVE-2016-3902

CVE-2016-3902 affects Android’s Qualcomm IPA driver, specifically the ipa_qmi_service.c component, on Nexus 5X and 6P. The vulnerability, described as an information disclosure, could allow a crafted application to obtain sensitive information due to issues in the Qualcomm IPA driver prior to the...

CVE-2016-3904

CVE-2016-3904 is an elevation of privilege vulnerability in the Qualcomm bus driver affecting Android devices (Nexus 5X, Nexus 6P, Pixel, Pixel XL). The issue could allow a local malicious app to execute arbitrary code in the kernel context after compromising a privileged process. The vulnerabili...

CVE-2016-3930

CVE-2016-3930 concerns the NVIDIA MMC test driver on Android (Nexus 9) where a crafted app can exploit a NULL pointer dereference in the MMC test driver to gain privileges locally. Affected component: NVIDIA Tegra kernel/NVIDIA MMC test driver; vulnerability type: elevation of privilege. CVSS see...

CVE-2016-3934

CVE-2016-3934 affects the Qualcomm camera driver in Android prior to 2016-10-05 on Nexus 5, Nexus 5X, Nexus 6, Nexus 6P, and Android One devices. The vulnerability resides in drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c which relies on variable-length arrays, enabling a cra...

CVE-2016-3937

CVE-2016-3937 is an elevation-of-privilege vulnerability in the MediaTek video driver for Android, exploitable by a crafted app to gain privileges. The issue affects MediaTek video driver in Android prior to the 2016-10-05 patch level; patch status varies and public fix availability is not consis...

CVE-2016-5341

CVE-2016-5341 : Denial-of-service in the Android GPS component caused by spoofed xtra.bin/xtra2.bin files. The issue affects Android GPS logic prior to 2016-12-05, allowing a remote attacker (via a spoofed Qualcomm hosting domain) to trigger GPS signal-acquisition delays, potentially causing devi...

CVE-2016-5871

CVE-2016-5871 is a buffer overflow due to an integer overflow in Qualcomm CAF Android builds using the Linux kernel when loading an image file. The NVD entry assigns a CVSSv3 base score of 9.8 (CRITICAL, Network attack, no user interaction) with impact to confidentiality, integrity, and availabil...

CVE-2016-6720

CVE-2016-6720 is an information-disclosure vulnerability in libstagefright within Mediaserver on Android. A local malicious application could access data outside its permissions by exploiting Mediaserver’s handling of media processing. Affected Android versions include 4.x before 4.4.4, 5.0.x bef...

CVE-2016-6722

CVE-2016-6722 describes an information-disclosure vulnerability in libstagefright within Mediaserver. A local attacker could exploit Mediaserver while processing media to access data outside the application’s permitted scope. Affected Android versions include 4.x before 4.4.4, 5.0.x before 5.0.2,...

CVE-2016-6745

Summary (CVE-2016-6745) : Elevation of privilege in the Synaptics touchscreen driver on Android (pre-2016-11-05) could allow a local, malicious app to execute arbitrary code in the kernel context. This requires a privileged process to be compromised first, making it a local-privilege-elevation is...

CVE-2016-6751

CVE-2016-6751 describes an information-disclosure vulnerability in Qualcomm components used by Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) where a local malicious app could access data outside its permissions. The root cause is information exposure within thes...

CVE-2016-6753

CVE-2016-6753 describes an information-disclosure vulnerability in Android kernel components, specifically the process-grouping and networking subsystems. The issue affects Android devices prior to 2016-11-05 and is rated Moderate because exploitation requires first compromising a privileged proc...

CVE-2016-6770

CVE-2016-6770 describes an elevation of privilege vulnerability in the Android Framework API that could allow a local malicious application to bypass restrictions and access system functions beyond its granted level. Affected products/versions include Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, and ...