CVE-2014-9928

Technical details are not publicly available in the provided documents. Monitor for updates and new disclosures regarding CVE-2014-9928.

CVE-2015-3854

CVE-2015-3854 affects Android 5.x; the vulnerability exists in PowerNotificationWarnings.java within the Android SystemUI power package. A broadcast intent using the PNW.stopSaver action can bypass the DEVICE_POWER permission requirement, enabling local access to perform restricted actions. The i...

CVE-2015-6625

CVE-2015-6625 describes an information-disclosure/privilege-escalation vulnerability in Android 6.0 System Server, where a crafted application can access sensitive data and potentially gain higher privileges. The connected sources corroborate that this issue affects Android 6.0 prior to the Decem...

CVE-2015-7889

CVE-2015-7889 affects the Samsung SecEmailComposer/EmailComposer on Galaxy S6 Edge prior to the October 2015 maintenance release. The vulnerability arises from weak permissions on the com.samsung.android.email.intent.action.QUICK_REPLY_BACKGROUND service, allowing an unprivileged app with knowled...

CVE-2015-8891

CVE-2015-8891 affects Android on Nexus 5 and Nexus 7 (2013) via integer overflows in Qualcomm’s app/aboot/aboot.c, allowing a crafted image to bypass access restrictions. Root cause: multiple integer overflow conditions in the aboot bootloader code within Qualcomm components. Impact: local bypass...

CVE-2015-8939

CVE-2015-8939 concerns a privilege-escalation flaw in the Qualcomm video driver used by Android on Nexus 7 (2013) . The issue stems from the driver file drivers/video/msm/mdp4_util.c , where data for the red/green/blue stages is not validated, enabling a local attacker with a crafted app to gain ...

CVE-2015-9012

CVE-2015-9012 describes an elevation of privilege in Qualcomm closed‑source components within Android, affecting the Android kernel. The linked records consistently identify the issue as a privilege escalation vulnerability in Qualcomm components used by Android devices, with no public exploit de...

CVE-2015-9023

The CVE-2015-9023 entry describes a buffer overflow in the PlayReady API, present in all Android releases from CAF using the Linux kernel. The vulnerability can enable a remote attacker to execute arbitrary code or cause a denial of service by exploiting the PlayReady API in affected Android comp...

CVE-2015-9048

CVE-2015-9048 affects Qualcomm closed‑source components in Android CAF builds using the Linux kernel, where the vulnerability is in the processing of lost RTP packets due to input validation issues. The CNVD entry describes an unauthorized operation possibility as the impact. The provided documen...

CVE-2015-9053

CVE-2015-9053 describes a buffer overflow in Qualcomm-provided components used in Android CAF builds on devices with the Linux kernel, specifically in the processing of USIM responses. The vulnerability is located in Qualcomm closed-source components integrated in Android, and the issue could all...

CVE-2015-9061

The connected CNVD entry (CNVD-2017-26846) describes CVE-2015-9061 as a vulnerability in Android’s Qualcomm closed‑source components, where the PlayReady DRM fails to detect length, enabling unauthorized access to secure memory. Affected software is the Qualcomm closed‑source component used withi...

CVE-2015-9067

CVE-2015-9067 concerns Qualcomm products with Android CAF builds using the Linux kernel. The description indicates a potential compiler optimization of memset() that is addressed in these releases. The connected documents do not provide concrete technical details such as affected versions, exact ...

CVE-2016-0822

CVE-2016-0822 affects the MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01. The flaw allows a local attacker to gain privileges via a crafted application that leverages conn_launcher access (internal bug 25873324). Impact is privilege escalation within the kernel context. Th...

CVE-2016-0833

Technical details about CVE-2016-0833 are not publicly available in the supplied documents. Monitor for updates from official advisories.

CVE-2016-10298

CVE-2016-10298 is an elevation-of-privilege vulnerability affecting Android kernel via Qualcomm closed-source components. Affected product: Android (kernel level). Root cause: flaw in Qualcomm closed-source components integrated with Android leading to unauthorized privilege escalation. Impact: c...

CVE-2016-10343

CVE-2016-10343 describes a memory leak in Qualcomm components across Android CAF builds when an SSL handshake failure with ClientHello rejection occurs. Affected are Qualcomm-provided, closed-source components used in Qualcomm-based Android devices; root cause is memory being leaked during the TL...

CVE-2016-10382

CVE-2016-10382 affects Qualcomm products running CAF Android builds on the Linux kernel. The issue is insufficient access control for the I2C bus, enabling potential improper access. Public details consistently describe it as a high-severity vulnerability with a CVSSv3 base score of 9.8 (CRITICAL...

CVE-2016-11025

CVE-2016-11025 affects Samsung mobile devices with Exynos AP chipsets (software through 2016-09-13). The issue is a heap-based memcpy overflow in the OTP service, pegged as high-severity with CVSS v3.1: CRITICAL (9.8) and network attack vector. The problem is linked to the OTP service boundary ch...

CVE-2016-11032

CVE-2016-11032 affects Samsung mobile devices running Android 6.0 (Marshmallow); an input-validation error allows an unprotected broadcast intent to disable all Sound functionality. The issue is described across multiple sources (e.g., RH and CNVD) as enabling attackers to silence device audio vi...

CVE-2016-11040

Technical details for CVE-2016-11040 are not publicly provided in the supplied documents. Monitor for updates and future disclosures.

CVE-2016-2411

CVE-2016-2411 describes an elevation of privilege in the Qualcomm Power Management kernel driver on Android 6.x prior to 2016-04-01. The root cause is a vulnerability in the power management kernel component that could allow a local malicious application with root access to execute code in the ke...

CVE-2016-2420

CVE-2016-2420 affects Android 4.x up to before 4.4.4, where the Debuggerd component fails to ensure the /data/tombstones directory exists via rootdir/init.rc. This can allow a crafted local app to gain privileges and potentially execute arbitrary code, enabling elevation of privilege from system ...

CVE-2016-2436

The CVE-2016-2436 issue affects the NVIDIA video driver on Android devices prior to 2016-05-01 (Nexus 9). It enables a local attacker to gain privileges via a crafted application (internal bug 27299111). The vulnerability is documented in multiple sources (NVD, OSV, Ubuntu, etc.) with the Android...

CVE-2016-2492

The CVE-2016-2492 entry describes an elevation-of-privilege in the MediaTek power-management driver on Android devices prior to 2016-06-01, specifically affecting Android One. A local attacker could exploit a crafted application to gain kernel-level privileges. The Android 2016-06-01 security bul...

CVE-2016-3750

CVE-2016-3750 affects Android’s Parcels Framework APIs, specifically libs/binder/Parcel.cpp, where the return value of dup() is not validated. This could allow a local attacker to bypass the OS isolation protections via a crafted application, as described for Android 4.x before 4.4.4, 5.0.x befor...

CVE-2016-3767

CVE-2016-3767 is an elevation-of-privilege flaw in the MediaTek Wi‑Fi driver affecting Android One devices prior to the 2016-07-05 patch level. A locally executed, crafted application could gain kernel privileges due to MediaTek internal bug ALPS02689526 (Android internal bug 28169363). The issue...

CVE-2016-3805

CVE-2016-3805 describes an elevation-of-privilege vulnerability in the MediaTek power management driver on Android One devices. The flaw allows a locally executed crafted app to gain privileged access due to issues in the MediaTek power management driver, with impact limited to devices running An...

CVE-2016-3846

The vulnerability CVE-2016-3846 affects the Serial Peripheral Interface (SPI) driver in Android on Nexus 5X and Nexus 6P (before 2016-08-05). Root cause: an internal bug (28817378) enables a local attacker’s crafted app to escalate privileges within the kernel. Impact: privilege escalation could ...

CVE-2016-3865

CVE-2016-3865 affects the Synaptics touchscreen driver in Android on Nexus 5X and Nexus 9, before 2016-09-05. The flaw enables local privilege escalation via a crafted app, caused by elevated-privilege execution within the kernel context. Publicly available patch information is limited; some sour...

CVE-2016-3866

CVE-2016-3866 identifies an elevation-of-privilege vulnerability in the Qualcomm sound driver in Android prior to 2016-09-05 on Nexus 5X, 6 and 6P. A crafted application could gain privileges in the context of the kernel via the affected sound-driver path. The issue is listed among multiple Qualc...

CVE-2016-3867

CVE-2016-3867 describes an elevation-of-privilege flaw in the Qualcomm IPA driver used by Android on Nexus 5X and 6P, prior to 2016-09-05. A crafted application could gain privileges, per CNVD-2016-07559 and the CVE entry. The root cause and exact exploitation details are not provided in the docu...

CVE-2016-3886

CVE-2016-3886 affects Android 7.0 System UI Tuner (systemui/statusbar/phone/QuickStatusBarHeader.java). The issue: the System UI Tuner on the lockscreen does not prevent tuner changes, enabling a physically proximate attacker to modify a setting and gain privileges. Root cause: ability to modify ...

CVE-2016-3888

CVE-2016-3888 affects Android 4.x (4.4.4+), 5.0.x (5.0.2+), 5.1.x (5.1.1+), 6.x (before 2016-09-01) and 7.0 (before 2016-09-01). The issue, in internal/telephony/SMSDispatcher.java, lets physically proximate attackers bypass Factory Reset Protection and trigger premium SMS sending during Setup Wi...

CVE-2016-3929

CVE-2016-3929 is a Qualcomm component elevation/privilege issue in Android on Nexus 5X and 6P, caused by internal bug 28823675. Affected: Qualcomm components in Android prior to the 2016-10-05 patch. Severity: High (NVD CVSS v2/v3 show 9.8–10.0). Remediation: Android 2016-10-01/10-05 patch levels...

CVE-2016-3937

CVE-2016-3937 is an elevation-of-privilege vulnerability in the MediaTek video driver for Android, exploitable by a crafted app to gain privileges. The issue affects MediaTek video driver in Android prior to the 2016-10-05 patch level; patch status varies and public fix availability is not consis...

CVE-2016-6687

CVE-2016-6687 is an information-disclosure vulnerability in the NVIDIA profiler on Android devices (Nexus 9) prior to the 2016-10-05 patch level. A crafted application could allow a local attacker to access sensitive information via the profiler. The connected NVIDIA bulletin notes that the patch...

CVE-2016-6721

The CVE-2016-6721 entry concerns an information-disclosure vulnerability in Mediaserver on Android 6.x (before 2016-11-01) and 7.0 (before 2016-11-01). A local malicious application could access data outside its permission granularity due to Mediaserver processing of media files. The issue is lis...

CVE-2016-6728

CVE-2016-6728 is a privilege-escalation flaw in the kernel ION subsystem of Android that could allow a local malicious app to execute code in kernel context. The issue is triggered via ION memory management and historically affects Android releases prior to the 2016-11-05 patch level, with potent...

CVE-2016-6752

CVE-2016-6752: An information-disclosure vulnerability in Qualcomm components (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) in Android prior to 2016-11-05 can allow a local malicious app to access data outside its permissions after compromising a privileged process. Aff...

CVE-2017-0546

Concrete details found in connected documents: CVE-2017-0546 is described as an elevation of privilege vulnerability in Android's SurfaceFlinger. Affected product is Android, with versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 identified in the CNVD entry. The CNVD/CVE records indicate a lo...

CVE-2017-11048

CVE-2017-11048 affects Qualcomm Video driver in Android on MSM CAF platforms using the Linux kernel. The vulnerability stems from a Use-After-Free in a display driver function, leading to Elevation of Privilege (EoP) on affected devices. Connected sources corroborate the issue as a Qualcomm video...

CVE-2017-11080

CVE-2017-11080 is a local buffer overflow vulnerability described for Android on MSM/CAF platforms (Linux kernel path) when processing a user-supplied sparse image and the sparse header block size equals 4294967296. The issue affects Qualcomm bootloader components as mapped in the CVE references,...

CVE-2017-11082

CVE-2017-11082 affects Qualcomm WLAN in Android on MSM (and related CAF/Linux kernel builds) where a race condition in the firmware loading routine could lead to a buffer overflow if multiple user-space threads update the WLAN firmware file via sysfs. The root cause is a race in the firmware load...

CVE-2017-13172

CVE-2017-13172 is a local, Elevation of Privilege vulnerability in the MediaTek Bluetooth driver used by Android kernels. The issue affects the Bluetooth subsystem of MediaTek components and enables privilege escalation without requiring user interaction; CVSSv3 base score 7.8 (HIGH). The NVD ent...

CVE-2017-13192

CVE-2017-13192 affects Android Media Framework (HEVC decoder) via ihevcd_parse_slice_header.c. The issue arises when a slice address is zero after the first slice, causing an infinite loop in slice header parsing and enabling remote denial of service without user interaction. Affected Android ver...

CVE-2017-13213

CVE-2017-13213 is a Broadcom bcmdhd driver Elevation of Privilege flaw affecting Android devices (Broadcom WiFi driver in the Android kernel). The public records describe a local-elevation vulnerability in the bcmdhd component, enabling an attacker with local access to escalate privileges on affe...

CVE-2017-13226

CVE-2017-13226 is a MediaTek MTK elevation-of-privilege vulnerability affecting the Android kernel. The connected records identify MTK as the component and describe an EoP issue with MediaTek MTK in Android devices (notably Pixel/Nexus in related bulletins). The documents do not disclose the exac...

CVE-2017-13239

CVE-2017-13239 is an information-disclosure vulnerability in Android 8.0’s UI framework (framework UI). Affected product: Android 8.0 on Pixel/Nexus devices; vulnerability in the UI framework could allow an attacker to obtain sensitive information. According to the Pixel security bulletin, the is...

CVE-2017-13246

CVE-2017-13246 affects the Android kernel network driver (Upstream kernel). It is described as an information‑disclosure vulnerability in the Network driver, with the Pixel/Nexus Android bulletin listing it under Kernel components as a Moderate‑severity issue. No concrete patch version or remedia...

CVE-2017-13265

CVE-2017-13265 is an Elevation of Privilege issue in the Android system related to OTA updates affecting Android 7.0–8.1. The Android Security Bulletin places this as a System component EoP vulnerability and indicates a remediation via the 2018-03-05 patch level for Pixel/Nexus devices; the NVD e...