CVE-2019-2148

CVE-2019-2148 affects the libxaac library in Android 10, where an out-of-bounds read due to a missing bounds check can lead to information disclosure. The vulnerability requires user interaction to exploit and is described across multiple sources (NVD, Red Hat). Practical impact is information di...

CVE-2015-3830

Technical details for CVE-2015-3830 are not publicly available in the provided connected documents; monitor for updates.

CVE-2015-9038

CVE-2015-9038 affects Qualcomm closed‑source components in Android CAF builds using the Linux kernel. Description: a NULL pointer may be dereferenced in the front end, caused by NULL pointer usage in the vulnerable path. Root cause: NULL pointer dereference. Impact: potential crash or denial of s...

CVE-2016-11035

CVE-2016-11035 affects Samsung mobile devices with Exynos AP chipsets; a local user can trigger a kernel crash via the fb0(DECON) frame buffer interface. Connected sources reiterate this description, but no further technical details (affected versions, root cause specifics, exploit information, o...

CVE-2016-5868

CVE-2016-5868 affects the Qualcomm networking driver in Android (drivers/net/ethernet/msm/rndis_ipa.c). A crafted application could cause a privileged process to execute arbitrary code, enabling a remote attacker to take control within the affected device. The entry cites this as a vulnerability ...

CVE-2016-6695

CVЕ-2016-6695 : Affects the Qualcomm QDSP6v2 driver (sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c) in Android before 2016-10-05. An attacker could cause a denial of service or other unspecified impact via crafted visualizer data length. This entry is part of Qualcomm component vulnerabilities in th...

CVE-2016-6714

CVE-2016-6714 describes a remote denial-of-service condition in Android’s Mediaserver. The issue affects Mediaserver in Android 6.x (before 2016-11-01) and 7.0 (before 2016-11-01); a attacker could trigger a device hang or reboot by crafting a file processed by Mediaserver. The vulnerability is c...

CVE-2017-11074

CVE-2017-11074 affects Qualcomm WLAN in Android on MSM platforms (CAF-based kernels) via an obsolete set/reset ssid hotlist API in the WLAN stack. Root cause: legacy API left in kernel/UI interfaces enabling privilege escalation. Impact: as per CVSS, high confidentiality, integrity, and availabil...

CVE-2017-15830

CVE-2017-15830 affects the Qualcomm SME driver in Android on MSM (CAF Linux kernel lineage). The root cause is improper initialization of the ch_list array index in function sme_set_plm_request(), which can lead to a buffer overflow. The vulnerability is categorized as EoP (elevation of privilege...

CVE-2017-6425

CVE-2017-6425 is an information-disclosure vulnerability in the Qualcomm video driver embedded in the Android kernel. The issue affects Pixel and Pixel XL devices (and is tied to Qualcomm video components) and could allow a local attacker to access data outside of normal permission boundaries. Th...

CVE-2017-8271

CVE-2017-8271 describes an out-of-bounds memory write in the MDSS Rotator driver used by Qualcomm components on Android CAF builds using the Linux kernel. The issue arises from an unsanitized userspace-controlled parameter, enabling a local attacker to cause memory corruption. The CVSS indicates ...

CVE-2017-9722

CVE-2017-9722 affects Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernels. The vulnerability arises when updating a custom EDID (hdmi_tx_sysfs_wta_edid) and the edid_size (controlled by userspace) is too large, causing a buffer overflow. Connected documents corrobo...

CVE-2018-11869

CVE-2018-11869 affects Android-family releases used on CAF/Linux kernels. The issue is a lack of length validation for a value received from firmware, which can cause a buffer overflow in the WMA handler . The vulnerability is described as local with potential complete impact on confidentiality, ...

CVE-2018-11907

CVE-2018-11907 : Affects CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is improper access control that can allow device nodes and executables to be run from /firmware/. The available documents reiterate the impact as a potential issue but ...

CVE-2018-11914

Technical details for CVE-2018-11914 are not publicly available in the provided documents. Monitor for updates.

CVE-2018-11961

CVE-2018-11961 affects Qualcomm GPS_AP_LINUX (Android CAF/Linux kernel stack). Root cause: an out-of-bounds vector index when updating GNSS configurations. Impact: local access leading to potential elevation of privilege or code execution as indicated by CVSS metrics (CVSSv3: 7.8 HIGH; local vect...

CVE-2018-3563

CVE-2018-3563 affects Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF kernel prior to the 2018-04-05 security patch level. The root cause is an untrusted pointer dereference in the function apr_cb_func , which can lead to arbitrary code execution. The vulnerability ...

CVE-2018-3564

CVE-2018-3564 affects the FastRPC driver in CAF Android builds using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The issue is a Use-After-Free when mapping on the remote processor fails, potentially impacting components such as DSP_Services. The description notes that thi...

CVE-2018-5822

CVE-2018-5822 describes a buffer overwrite in WLAN firmware affecting Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android on CAF builds prior to the 2018-04-05 patch level. The issue arises from compromised WLAN FW and is mitigated by updating to the 2018-04-05 security patch level (or ...

CVE-2018-5835

CVE-2018-5835 describes a potential buffer overflow in the Android WLAN stack: when seq_len exceeds CSR_MAX_RSC_LEN, copying keyRSC in __wlan_hdd_cfg80211_add_key() may overflow. This affects Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android). The ...

CVE-2018-5844

CVE-2018-5844 describes a use-after-free in the Qualcomm video driver’s set_output_buffers() where binfo can be accessed after it is freed in a failure path across CAF Android for MSM, Firefox OS for MSM, and QRD Android (Linux kernel). The vulnerability affects the video driver component and has...

CVE-2018-5861

CVE-2018-5861 is documented as a heap-overflow risk in CAF Android bootloader code using the Linux kernel, affecting Android for MSM/QRD Android builds with Qualcomm bootloaders. The vulnerability arises from incomplete partition-size checks during loading of secure applications, with CVSS v3.0 i...

CVE-2018-5889

CVE-2018-5889 affects Qualcomm bootloader components. The connected records classify it as a Local Elevation of Privilege (EoP) vulnerability in the bootloader, with a moderate severity. The issue is described as a buffer overflow occurring in Android releases from CAF when processing a compresse...

CVE-2018-6246

The CVE-2018-6246 issue affects NVIDIA Widevine Trustlet inside Widevine TA on Android prior to the 2018-05-05 patch level, where the software may read data past the end or before the beginning of the intended buffer, enabling Information Disclosure. The NVIDIA SHIELD TV bulletin lists this CVE u...

CVE-2018-9569

CVE-2018-9569 affects Android 9, involving an out-of-bounds write in impd_init_drc_decode_post_config within impd_drc_gain_decoder.c. The issue originates from an incorrect bounds check, enabling potential remote code execution with no extra privileges required, with user interaction needed for e...

CVE-2018-9574

CVE-2018-9574 affects Android 9 via an out-of-bounds write in impd_parse_split_drc_characteristic (impd_drc_static_payload.c), caused by missing bounds checks. This could lead to remote code execution with user interaction required; no exploitation details are provided in the connected documents ...

CVE-2018-9578

CVE-2018-9578 describes an out-of-bounds write in ixheaacd_adts_crc_start_reg (ixheaacd_adts_crc_check.c) on Android 9, caused by a missing bounds check. This could enable remote escalation of privilege without user interaction. Connected CNVD notes specify Android 9 exposure and indicate the iss...

CVE-2019-20565

Technical details about CVE-2019-20565 are not publicly available in the provided connected documents. Monitor for updates from vendors and security trackers.

CVE-2019-20583

CVE-2019-20583 affects Samsung mobile devices running O(8.x) and P(9.0) with TEEGRIS. The issue is a type confusion in the EXT_FR Trustlet that can lead to arbitrary code execution. Exploitation details are not provided in the documents. The vulnerability is documented across multiple sources con...

CVE-2019-20588

CVE-2019-20588 affects Samsung mobile devices running O(8.x) and P(9.0) with TEEGRIS. The SEM Trustlet has a type confusion flaw that can lead to arbitrary code execution. Samsung ID SVE-2019-14891 is associated with this issue. The CVSS-3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) yields a b...

CVE-2019-2083

CVE-2019-2083 refers to an out-of-bounds write in the Android libxaac library, caused by a missing bounds check. The vulnerability could enable remote code execution on Android 10, with execution requiring user interaction for exploitation. The connected Red Hat and CNVD entries corroborate the s...

CVE-2019-2143

CVE-2019-2143 affects Android 10, in the libxaac library. The issue is an out-of-bounds read caused by a missing bounds check, leading to potential information disclosure. Exploitation requires user interaction, and the description does not indicate remote execution or other privileges. Connected...

CVE-2019-2154

CVE-2019-2154 affects the Android 10 libxaac library, where an out-of-bounds read due to a missing bounds check could disclose information. The vulnerability allows information disclosure without executing code, with user interaction required for exploitation. The connected Red Hat advisory reite...

CVE-2019-2157

CVE-2019-2157 describes an out-of-bounds read in libxaac leading to information disclosure on Android 10 due to a missing bounds check. The issue requires user interaction to exploit and could be triggered over the network according to CVSS guidance in the public records. Connected sources confir...

CVE-2019-2189

CVE-2019-2189 affects the Image driver in the Android kernel (Easel driver). The vulnerability stems from race conditions that can cause memory corruption, enabling local elevation of privilege to SYSTEM with no user interaction required. Impact is described as local EoP with high confidentiality...

CVE-2019-9286

CVE-2019-9286 affects Android 10 components via Bluetooth, describing an out-of-bounds read caused by a missing bounds check that could enable remote information disclosure without user interaction. The NVD notes CVSSv3.1 base score 7.5 (HIGH) with network attack vector, no privileges, UI: NONE, ...

CVE-2019-9318

CVE-2019-9318: A missing variable initialization in libhevc on Android-10 (Android 10) can cause information disclosure. Exploitation requires user interaction; no remote code execution is stated. Affected component: libhevc in Android 10, with CVE details echoed across NVD/Red Hat/CVEs. Mitigati...

CVE-2019-9379

CVE-2019-9379 affects the Android 10 libstagefright component. The issue is a resource-exhaustion DoS caused by a missing bounds check in a multimedia processing path. The impact is remote denial of service with no privileges required, and exploitation requires user interaction. There is no docum...

CVE-2019-9395

CVE-2019-9395 affects Android 10 Bluetooth. A missing bounds check can cause controlled termination, leading to remote DoS without privileges and without user interaction. Impact: availability loss; threat vector: network. Root cause: out-of-bounds condition in Bluetooth handling. Mitigation: app...

CVE-2019-9435

CVE-2019-9435 affects Android 10 Bluetooth stack, with an out-of-bounds read due to a missing bounds check in the Bluetooth component. This enables local information disclosure without execution privileges and without user interaction. The Android 10 security release notes indicate these issues a...

CVE-2020-0059

CVE-2020-0059 : An out-of-bounds read in the Android Bluetooth stack (btm_ble_batchscan_filter_track_adv_vse_cback in btm_ble_batchscan.cc) due to a missing bounds check could disclose information locally without privileges. Affected: Android 10 devices; impact described as information disclosure...

CVE-2020-0061

CVE-2020-0061 pertains to Pixel Recorder on Android, where a permissions bypass can allow arbitrary apps to record audio, leading to local information disclosure without extra execution privileges. The vulnerability affects the Android System component as listed in the Pixel Update Bulletin (Syst...

CVE-2020-0169

CVE-2020-0169 affects Android 10: In RTTTL_Event of eas_rtttl.c, there is a missing bounds check that can cause resource exhaustion, leading to remote Denial of Service. Exploitation requires user interaction. The issue is documented across multiple feeds (NVD entry for CVE-2020-0169, RH Red Hat ...

CVE-2020-0173

CVE-2020-0173 affects Android 10 in the Media Framework/eas_mdls.c path (Parse_lins). The vulnerability enables resource exhaustion/Denial of Service due to improper input validation. Exploitation requires user interaction; CVSSv3 indicates Network access with low complexity and UI-REQUIRED, with...

CVE-2020-0177

CVE-2020-0177 affects Android 10; the issue is described as a permissions bypass in PanService.java (connect()) that could allow local elevation of privilege to change network connection settings without extra privileges or user interaction. The connected Red Hat/Redacted entries and NVD details ...

CVE-2020-0326

CVE-2020-0326 affects Android 11 via an NFC-related out-of-bounds write caused by uninitialized data, enabling local privilege escalation with System-level privileges and no user interaction required. Multiple connected sources confirm the issue in Android 11’s NFC handling; remediation is addres...

CVE-2020-0340

CVE-2020-0340 affects Android 11 via the libcodec2_soft_mp3dec component, where uninitialized data can cause information disclosure. The issue allows remote information disclosure with no execution privileges and requires user interaction to exploit. The provided connected documents confirm the v...

CVE-2020-0352

CVE-2020-0352 affects Android 11 MediaProvider. The vulnerability is a SQL injection in MediaProvider that can bypass permissions, enabling local information disclosure without extra privileges or user interaction. Impact is limited to partial confidentiality loss on affected devices. Remediation...

CVE-2020-0481

This CVE (CVE-2020-0481) concerns Android where in AndroidManifest.xml a permissions bypass enables local elevation of privilege. The impact is that a non-system app could broadcast without having required permissions, with no user interaction. Affected info from the sources specifies Android 11 ...

CVE-2020-10847

CVE-2020-10847 affects Samsung mobile devices running P(9.0) on Galaxy S8 and Note8, where the facial recognition system can be spoofed. The core issue is a vulnerability in biometric authentication allowing an attacker to bypass security controls. The connected Red Hat and NVD entries confirm th...