CVE-2014-9871

CVE-2014-9871 involves multiple buffer overflows in drivers/media/platform/msm/camera_v2/isp/msm_isp_util.c in Qualcomm components used by Android on Nexus 5 and Nexus 7 (2013). The underlying issue is a buffer overflow in a camera processing component, enabling a local attacker to escalate privi...

CVE-2014-9898

CVE-2014-9898 affects Android on Nexus 5 and Nexus 7 (2013) devices due to a flaw in arch/arm/mach-msm/qdsp6v2/ultrasound/usf.c where input parameters are not properly validated. This enables a crafted application to obtain sensitive information. The issue is associated with Android internal bug ...

CVE-2014-9899

CVE-2014-9899 describes an information-disclosure flaw in the USB/ehci-msm2.c driver within Qualcomm components used by Android on Nexus 5 devices prior to 2016-08-05. The root cause is omission of certain minimum calculations before copying data, enabling a crafted application to obtain sensitiv...

CVE-2014-9908

CVE-2014-9908 corresponds to a Denial of Service vulnerability in Google Android affecting Android 4.4.4, 5.0.2, and 5.1.1. According to the description, a malicious actor could block Bluetooth access on the device (Android Bug ID A-28672558). The connected sources list the affected software vers...

CVE-2014-9945

CVE-2014-9945 describes an Improper Authorization vulnerability in the TrustZone component on Android releases from CAF that use the Linux kernel. The issue affects TrustZone/CAF Android builds and is described as potentially existing within the TrustZone security boundary. From the CVSS data, th...

CVE-2014-9953

CVE-2014-9953 is an elevation-of-privilege vulnerability affecting Qualcomm closed‑source components within Android kernels. The CVE is documented across multiple sources (NVD, CVE List, prion-like aggregations) as a Qualcomm‑related issue with a critical impact. The vulnerability is categorized ...

CVE-2014-9965

Technical details about CVE-2014-9965 are not publicly available in the provided connected documents. The descriptions restate the parsing issue in Android CAF/Linux SCM call handling; monitor for updates from the cited sources.

CVE-2015-3833

CVE-2015-3833 affects Android up to version 5.1.1 (LMY48I). Root cause is in ActivityManagerService.getRunningAppProcesses, allowing a crafted app to bypass getRecentTasks restrictions and reveal the foreground app name. Public descriptions across sources confirm the flaw exists in Android before...

CVE-2015-6601

CVE-2015-6601 affects libstagefright in Android up to version 5.1.1 LMY48T. A crafted media file could cause memory corruption in mediaserver, allowing remote code execution or a denial of service. The issue is addressed by patches in Android 5.1.1 (LMY48T) and later via the October 2015 Nexus/An...

CVE-2015-6625

CVE-2015-6625 describes an information-disclosure/privilege-escalation vulnerability in Android 6.0 System Server, where a crafted application can access sensitive data and potentially gain higher privileges. The connected sources corroborate that this issue affects Android 6.0 prior to the Decem...

CVE-2015-9005

CVE-2015-9005 affects TrustZone on CAF Android builds via the Linux kernel, describing an Integer Overflow that could lead to a Buffer Overflow. The available sources do not provide concrete technical details (no root-cause, patch/version info, or explicit exploit data). The CVSS metrics indicate...

CVE-2015-9012

CVE-2015-9012 describes an elevation of privilege in Qualcomm closed‑source components within Android, affecting the Android kernel. The linked records consistently identify the issue as a privilege escalation vulnerability in Qualcomm components used by Android devices, with no public exploit de...

CVE-2015-9034

Summary: CVE-2015-9034 is a buffer overflow in Qualcomm closed-source components used in Android CAF builds with the Linux kernel, caused by a SIP string not being null-terminated. This vulnerability affects Qualcomm components in Android and has a CVSS v3 base score of 9.8 (CRITICAL) with networ...

CVE-2015-9036

CVE-2015-9036 describes a memory-corruption vulnerability in Qualcomm components used in Android CAF builds (Linux kernel). The root cause is an incorrect length used when clearing a memory buffer, which can corrupt adjacent memory. Affected products are Qualcomm/CAF Android releases that rely on...

CVE-2016-0850

The CVE-2016-0850 issue concerns the PORCHE_PAIRING_CONFLICT in Android’s Bluetooth stack, which allows a remote attacker to bypass pairing restrictions by presenting a crafted device. Affected Android versions include 4.x (before 4.4.4), 5.x (before 5.0.2 for 5.0, before 5.1.1 for 5.1), and 6.x ...

CVE-2016-10237

CVE-2016-10237 concerns Android/CAF Linux kernel handling of shared content protection memory, passed as the secure camera memory buffer to a trusted application (TA). The description indicates the TA would not detect the issue and would treat the shared memory as secure, reflecting a mislabeling...

CVE-2016-2412

CVE-2016-2412 affects Skia in Android System_server. The issue arises from include/core/SkPostConfig.h (SkPostConfig) being mishandled during certain crashes, allowing privilege escalation via a crafted application and potentially granting Signature or SignatureOrSystem access. Affected versions ...

CVE-2016-2433

The CVE-2016-2433 entry concerns the Broadcom Wi‑Fi driver for Android used in BlackBerry smartphones prior to Build AAE570. The connected sources (NVD, CNVD, CVE listings) consistently describe a vulnerability that allows remote attackers to execute arbitrary code in the kernel context, affectin...

CVE-2016-2444

CVE-2016-2444 : Elevation of privilege in the NVIDIA media driver on Android (Nexus 9) prior to 2016-05-01. A crafted application could allow a local attacker to gain privileges within the kernel context. Affected component: NVIDIA media driver; affected device: Nexus 9 (Android). Root cause: mem...

CVE-2016-2456

CVE-2016-2456 affects the MediaTek Wi‑Fi driver in Android One devices (pre May 1, 2016). The issue is an elevation of privilege via a crafted app, tied to internal bug 27275187. Root cause details are not provided beyond this description. The Android Security Bulletin indicates patch levels of M...

CVE-2016-2495

The CVE-2016-2495 issue affects Android Mediaserver (libstagefright) where SampleTable.cpp can trigger memory corruption during media processing, enabling a crafted file to cause a device hang or reboot. Affected platforms include Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, ...

CVE-2016-2497

The CVE affects Android framework APIs, specifically PackageManagerService.java, and concerns an elevation of privilege where a pre-installed, updated, or updated app can increase its intent-filter priority via a crafted application. Affected versions include Android 4.x up to 4.4.3, Android 5.0....

CVE-2016-3774

The CVE-2016-3774 entry concerns a privilege-escalation flaw in MediaTek drivers on Android One devices. The affected component is the MediaTek driver stack present in Android prior to 2016-07-05, with root-cause attribution to Android internal bug 29008609 and MediaTek internal bug ALPS02703102....

CVE-2016-3824

CVE-2016-3824 covers a Mediaserver elevation of privilege flaw in Android’s mediaserver (libstagefright), where OMXNodeInstance.cpp in OMX buffer port handling is unvalidated. A crafted application could exploit this local issue to gain privileges. Affected are Android 4.x before 4.4.4, 5.0.x bef...

CVE-2016-3831

CVE-2016-3831 affects the Android telephony stack: Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 are vulnerable to a remote-triggered denial of service (device crash) via a NITZ time value of 2038-01-19 or later that is mishandled by the system clock ...

CVE-2016-3858

CVE-2016-3858 is a local-privilege-escalation vulnerability caused by a buffer overflow in drivers/soc/qcom/subsystem_restart.c (Qualcomm subsystem driver) on Android devices. The issue affects Nexus 5X and 6P, where a crafted application sending a long string could escalate privileges. Public de...

CVE-2016-3866

CVE-2016-3866 identifies an elevation-of-privilege vulnerability in the Qualcomm sound driver in Android prior to 2016-09-05 on Nexus 5X, 6 and 6P. A crafted application could gain privileges in the context of the kernel via the affected sound-driver path. The issue is listed among multiple Qualc...

CVE-2016-3867

CVE-2016-3867 describes an elevation-of-privilege flaw in the Qualcomm IPA driver used by Android on Nexus 5X and 6P, prior to 2016-09-05. A crafted application could gain privileges, per CNVD-2016-07559 and the CVE entry. The root cause and exact exploitation details are not provided in the docu...

CVE-2016-3868

CVE-2016-3868 affects the Qualcomm power driver on Nexus 5X and 6P, enabling local privilege escalation via a crafted app. Root cause is in the Qualcomm power driver before 2016-09-05 (Android builds for Nexus devices). The issue is listed as High severity in the 2016-09 Android bulletin; patches...

CVE-2016-3883

CVE-2016-3883 affects Android Telephony’s SMSDispatcher.java in the Telephony stack. The flaw is that premium-SMS warnings are not properly constructed, allowing a crafted app to spoof the premium-payment confirmation dialog. Affected Android versions include 4.x up to 4.4.4, 5.0.x up to 5.0.2, 5...

CVE-2016-3887

CVE-2016-3887 affects Android 7.0 (Nougat) before the 2016-09-01 patch; the issue arises from inadequate enforcement of the DISALLOW_CONFIG_VPN setting in providers/settings/SettingsProvider.java, allowing a crafted app to bypass the intended always-on VPN state. The vulnerability is described as...

CVE-2016-3898

CVE-2016-3898 affects Android Telephony: a crafted application can modify TTY mode by broadcasting an intent, triggering a denial of service that disrupts locked-screen 911 TTY functionality. Affected versions include Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 ...

CVE-2016-3901

CVE-2016-3901 affects the Qualcomm cryptographic engine driver (drivers/crypto/msm/qcedev.c) in Android. It describes multiple integer overflows that enable a local privilege escalation via a crafted application on Nexus 5X, Nexus 6, Nexus 6P, and Android One devices. Root cause is integer overfl...

CVE-2016-3920

CVE-2016-3920 affects Android Mediaserver (libstagefright) via id3/ID3.cpp. A crafted file could cause a denial of service (device hang or reboot) in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 before 2016-10-01. Connected sources confirm the issue and note that...

CVE-2016-3925

CVE-2016-3925 affects Android 6.x and 7.0, where the Wi‑Fi ANQPFactory (server/wifi/anqp/ANQPFactory.java) can be triggered by a crafted app to cause a denial of service (blocked Wi‑Fi usage). Root cause: a vulnerability in the ANQPFactory path that allows a crafted application to disrupt Wi‑Fi o...

CVE-2016-6698

CV E-2016-6698 describes a local information-disclosure vulnerability in Qualcomm components used in Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) present in Android builds before 2016-11-05. The issue could allow a local malicious application to access data out...

CVE-2016-6718

CVE-2016-6718 is an elevation-of-privilege issue in the Android 7.0 Account Manager Service. A local malicious app could bypass user interaction requirements and retrieve sensitive information without user consent. The root cause is a local bypass of interaction prompts within the Account Manager...

CVE-2016-6721

The CVE-2016-6721 entry concerns an information-disclosure vulnerability in Mediaserver on Android 6.x (before 2016-11-01) and 7.0 (before 2016-11-01). A local malicious application could access data outside its permission granularity due to Mediaserver processing of media files. The issue is lis...

CVE-2016-6748

CVE-2016-6748 describes an information-disclosure vulnerability in Qualcomm components used in Android (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver). The flaw could allow a local malicious app to access data outside its permissions, with impact described as information ...

CVE-2016-6752

CVE-2016-6752: An information-disclosure vulnerability in Qualcomm components (GPU driver, power driver, SMSM Point-to-Point driver, and sound driver) in Android prior to 2016-11-05 can allow a local malicious app to access data outside its permissions after compromising a privileged process. Aff...

CVE-2017-0710

CVE-2017-0710 is an elevation-of-privilege vulnerability in the Android kernel (Upstream Linux tcb/KernelTCB). The CNVD entry describes a privilege-lifting issue in KernelTCB in Android where an attacker could bypass privilege validation and access arbitrary ptrace, enabling local privilege escal...

CVE-2017-0711

CVE-2017-0711 involves an elevation-of-privilege vulnerability in the MediaTek networking driver used by Android. Affected component: MediaTek networking driver within the Android kernel. Impact stated: local elevation of privilege; no exploitation details provided in the supplied documents. Root...

CVE-2017-11005

CVE-2017-11005 describes a Use-After-Free in the Android MSM stack (including CAF/Linux kernel paths) during deinitialization. The issue affects Android/CAF-derived builds and related MSM variants (Firefox OS for MSM, QRD Android) and is listed with high to critical impact in the NVD metrics (CVS...

CVE-2017-11025

CVE-2017-11025 affects Android on MSM (and related CAF/Linux-based Android builds) with a race condition in audio_effects_shared_ioctl() that can lead to memory corruption. The vulnerability is associated with Qualcomm Audio and is categorized in connected sources as an elevation-of-privilege iss...

CVE-2017-11046

CVE-2017-11046 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The issue arises when an audio driver ioctl handler is invoked, potentially triggering a kernel out-of-bounds write. Publicly available details in the connected sources reiterate the same r...

CVE-2017-11054

CVE-2017-11054 affects Android for MSM, Firefox OS for MSM, and QRD Android on CAF Linux kernels. The vulnerability is a buffer over-read triggered when processing a specially crafted cfg80211 vendor command, potentially impacting confidentiality (as per CVSS) and availability. Connected document...

CVE-2017-11078

CVE-2017-11078 describes an out-of-bounds read in the boot image header processing for CAF Android builds (Android for MSM, Firefox OS for MSM, QRD Android with the Linux kernel). The issue is a local memory/read fault in the boot component, with CVSS scores indicating moderate to high impact acr...

CVE-2017-11081

CVE-2017-11081 affects Android for MSM, Firefox OS for MSM and QRD Android on CAF Linux kernel branches. The vulnerability resides in the hdd_parse_setrmcenable_command and hdd_parse_setrmcactionperiod_command APIs, where buffers defined in this API can hold at most 32 bytes, but data longer than...

CVE-2017-13161

CVE-2017-13161 is an Elevation of Privilege affecting the Broadcom wireless driver in Android kernels used by Pixel/Nexus devices. The vulnerability is categorized as EoP with a moderate severity in the Pixel bulletin, and is listed under Broadcom components. The documented impact states that an ...

CVE-2017-13187

CVE-2017-13187 is an information-disclosure vulnerability in the Android media framework (libhevc). Affected products/versions (per sources) include Android 7.0–8.1. The root cause is described as a information disclosure issue in libhevc within the Media framework. Impact is partial confidential...