CVE-2017-0837

CVE-2017-0837 is an elevation of privilege vulnerability in Android’s media framework (libaudiopolicymanager). Affected: Android 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Root cause is an elevation of privilege in the Media framework as noted by the Android Security Bulletin (Media framework sec...

CVE-2017-11016

CVE-2017-11016 affects Android on MSM/CAF/Linux kernel variants, specifically when memory allocation fails during create_cal_block in calibration handling, leaving stale pointers. Connected Android bulletin detail positions CVE-2017-11016 under Qualcomm components for Pixel/Nexus devices and clas...

CVE-2015-6618

CVE-2015-6618 is a Bluetooth remote-code-execution vulnerability in Android 4.4 and 5.x (before 5.1.1 LMY48Z). The issue permits user‑assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment; exploitation details require the attacker to be paired ...

CVE-2015-6628

CVE-2015-6628 affects Android’s Media Framework. Versions before 5.1.1 LMY48Z and 6.0 before 2015-12-01 expose a vulnerability in mediaserver that could disclose sensitive information and bypass a protection mechanism, via unknown vectors demonstrated by obtaining Signature or SignatureOrSystem a...

CVE-2015-6640

The CVE-2015-6640 issue affects Android kernels prior to 5.1.1 (LMY49F) and 6.0 prior to 2016-01-01. It concerns the prctl_set_vma_anon_name function in kernel/sys.c, which does not ensure that only a single vma is accessed during a specific update action. Consequence: local privilege escalation ...

CVE-2015-8943

CVE-2015-8943 affects Qualcomm/mdss mdss_mdp_util.c in Android on Nexus 5 prior to 2016-08-05. The root cause is that the code does not verify the existence of a mapping before unmapping, enabling privilege escalation via a crafted app. Connected sources (CNVD-2016-06202, Ubuntu/OSV entries, NVD ...

CVE-2015-9026

CVE-2015-9026 affects WideVine DRM in Android CAF when running the Linux kernel. The connected documents describe an untrusted pointer dereference vulnerability in WideVine DRM (Android/CAF) with high impact potential. The Android Security Bulletin for 2017-06-01/06-05 indicates patches exist in ...

CVE-2015-9041

CVE-2015-9041 is a buffer overflow vulnerability in Qualcomm closed‑source components used in Android CAF builds based on the Linux kernel, triggered during WCDMA radio tuning. Public sources (NVD/CNVD) describe a buffer overflow in the Qualcomm component within Android, with potential for arbitr...

CVE-2015-9051

CVE-2015-9051 affects Qualcomm components in Android CAF builds using the Linux kernel (LTE stack). Root cause: an assertion can be reached due to an improper bound on a length in a System Information message. Severity in the provided metrics is critical (CVSSv3 base 9.8). The connected documents...

CVE-2015-9063

CVE-2015-9063 : Technical details are not publicly provided in the supplied documents. Monitor for updates from official advisories; there are currently no concrete details on affected products, impact, or remediation in this source set.

CVE-2016-0837

CVE-2016-0837 affects Android’s mediaserver via libstagefright (MPEG4Extractor.cpp). The issue allows remote code execution or a denial of service through a crafted media file due to an out-of-bounds read and memory corruption. Affected are Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x befo...

CVE-2016-0840

CVE-2016-0840 refers to multiple stack-based buffer underflows in mediaserver’s decoder/ih264d_parse_cavlc.c on Android 6.x prior to 2016-04-01. The flaw allows memory corruption that could enable remote code execution or a denial of service when processing crafted media files. The entry is suppo...

CVE-2016-10230

CVE-2016-10230 is a remote code execution vulnerability in the Qualcomm crypto engine driver affecting the Android kernel. The Android bulletin (April 2017) lists the issue under the Qualcomm components and ties the fix to the 2017-04-05 patch level. Affected Google devices include Nexus 5X, Nexu...

CVE-2016-10341

Technical details about CVE-2016-10341 are not provided in the connected documents. The initial description notes elevated privileges for third-party TEEs on CAF Android/Linux kernel, but no vendor, component, version, impact, or remediation details are disclosed here. Monitor for updates.

CVE-2016-11033

CVE-2016-11033 affects Samsung mobile devices running M(6.0). Affected component is tlc_server, with a heap-based buffer overflow as the root cause. Samsung IDs: SVE-2016-7220 and SVE-2016-7225. Impact and exploitability are described in the linked metrics (CVSS v2/base 7.5 HIGH; CVSS v3.1/base 9...

CVE-2016-2414

CVE-2016-2414 – Minikin DoS in Android . The Minikin library in Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-04-01) fails to properly handle negative size values in font data, enabling a local attacker to trigger memory corruption and a reboot loop via a crafted font, ...

CVE-2016-2491

Summary (CVE-2016-2491) : The NVIDIA camera kernel driver on Android (Nexus 9) before 2016-06-01 has a memory allocation miscalculation that can under-allocate memory, leading to a buffer overflow and local privilege escalation when a crafted app is run. The issue is documented in CVE-2016-2491 w...

CVE-2016-2505

CVE-2016-2505 affects Mediaserver’s libstagefright (mp eg2ts) in Android 6.x, where mpeg2ts/ATSParser.cpp does not validate a certain section length. This can allow a remote attacker to execute arbitrary code or cause memory corruption via a crafted media file, yielding remote code execution or m...

CVE-2016-3753

Technical details about CVE-2016-3753 are not publicly provided in the supplied documents. Mediaserver information disclosure vulnerability is described, but there is no version-specific or exploit information in the connected sources. Monitor for updates.

CVE-2016-3775

The vulnerability CVE-2016-3775 concerns the Android kernel file system. A local, privilege-escalation flaw exists in the kernel file system on Nexus 5X, Nexus 6P, Nexus 6, Nexus Player, and Pixel C devices running affected Android versions prior to 2016-07-05, allowing a crafted application to g...

CVE-2016-3806

The CVE-2016-3806 issue affects the MediaTek display driver in Android One devices. It enables privilege escalation via a crafted application, tied to Android internal bug 28402341 and MediaTek internal bug ALPS02715341. Public details indicate the vulnerability exists in the MediaTek display dri...

CVE-2016-3810

The CVE-2016-3810 issue affects the MediaTek Wi‑Fi driver on Android One devices. The vulnerability is an information‑disclosure flaw in the MediaTek Wi‑Fi driver exposed when processing a crafted application, linked to Android bug 28175522 and MediaTek ALPS02694389. Impact: a local attacker coul...

CVE-2016-3876

CVE-2016-3876 affects Android 6.x before 2016-09-01 and 7.0 before 2016-09-01. The issue, described in SettingsProvider.java, enables physically proximate attackers to bypass SAFE_BOOT_DISALLOWED and boot to safe mode via the Android Debug Bridge (ADB). Root cause is a local bypass of safe-boot p...

CVE-2016-5861

CVE-2016-5861 affects Qualcomm display/video driver in Android for MSM. The vulnerability arises when a userspace-controlled variable is used to compute offsets/sizes for copy operations, potentially causing a heap overflow. The connected documents classify this as an Elevation of Privilege (EoP)...

CVE-2016-5863

Technical details about CVE-2016-5863 are not provided in the supplied documents. Public references exist (NVD, Ubuntu, SUSE, Tenable, ENISA) but no vendor/product/version/patch info is included here. Monitor for updates.

CVE-2016-6689

CVE-2016-6689 affects the Android kernel Binder path. The description explicitly states that Binder in the kernel on Android devices (notably Nexus) prior to 2016-10-05 can allow a crafted application to obtain sensitive information, i.e., an information-disclosure vulnerability in the Binder sub...

CVE-2016-6707

CVE-2016-6707 affects Android System Server with a local privilege-escalation via ashmem-backed Bitmaps. The issue stems from mismatched memory sizes: ashmem (ASHMEM_SET_SIZE) defines the region size, but memory mappings (mmap) in Parcel::readBlob use a bitmap-derived len, and Bitmap creation sto...

CVE-2016-6717

CVE-2016-6717 corresponds to an elevation-of-privilege in Android’s Mediaserver. A local malicious app could execute code in a privileged process due to memory/parameter handling in Mediaserver when processing media data. Affected Android versions span 4.x up to 7.0 (pre-2016-11-01 and pre-2016-1...

CVE-2016-6734

CVE-2016-6734 concerns the NVIDIA GPU driver on Android. The issue is an elevation of privilege that could allow a local malicious app to execute arbitrary code in the kernel context. Affected environment is Android platforms prior to the 2016-11-05 security patch level. The underlying impact is ...

CVE-2016-6747

CVE-2016-6747 affects Android Mediaserver. A denial-of-service vulnerability allows a specially crafted file to cause a device hang or reboot. The issue is tied to Mediaserver processing media data in Android prior to the 2016-11-05 patch level. Vulnerable component: Mediaserver in Android; root ...

CVE-2016-6763

CVE-2016-6763 describes a denial-of-service vulnerability in Android’s Telephony stack. A local malicious application could cause a device hang or reboot by feeding the system a specially crafted file. Affected versions include Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0. The entry notes the...

CVE-2016-8414

CVE-2016-8414 is an information-disclosure vulnerability in the Qualcomm Secure Execution Environment Communicator affecting Android. It permits a local attacker with a compromised privileged process to access data outside its permissions. Affected components are the Android kernel (Kernel-3.10 a...

CVE-2016-8420

The CVE-2016-8420 entry describes an elevation-of-privilege vulnerability in the Qualcomm Wi‑Fi driver for Android kernels (Kernel-3.10 and Kernel-3.18). A local malicious application could execute arbitrary code in kernel context after compromising a privileged process. The description lists And...

CVE-2016-8436

CVE-2016-8436 matches an elevation-of-privilege flaw in the Qualcomm video driver affecting Android kernels (Kernel-3.18). The vulnerability could let a local malicious app execute arbitrary code in the kernel context, potentially causing a permanent device compromise and requiring reflashing to ...

CVE-2017-0416

CVE-2017-0416 affects Android: an elevation of privilege in the Audioserver could allow a local malicious app to execute arbitrary code in the context of a privileged process. Affected software is Android, with versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, and 7.1.1. The description documents th...

CVE-2017-0468

CVE-2017-0468 affects Android Mediaserver; a remote code execution flaw triggered by specially crafted media/files can cause memory corruption during media processing. Affected: Android 6.0–7.1.1. Impact: remote code execution within Mediaserver. Remediation: apply March 2017 Android security pat...

CVE-2017-0471

CVE-2017-0471 is a remote code execution in Mediaserver affecting Android 6.0–7.1.1. A specially crafted media file could trigger memory corruption during media/file processing, allowing an attacker to execute code within the Mediaserver process. The vulnerability is listed in the 2017-03-01 Andr...

CVE-2017-0494

Technical details (affected component/version or root cause) are not publicly provided in the connected documents for CVE-2017-0494; available descriptions note an information-disclosure issue in AOSP Messaging affecting Android 6.0–7.1.1. Monitor for updates.

CVE-2017-0502

CVE-2017-0502 describes an elevation of privilege in MediaTek components (M4U, sound, touchscreen, GPU, Command Queue drivers) that could allow a local malicious app to execute arbitrary code in the kernel context, potentially leading to permanent device compromise requiring reflashing. The vulne...

CVE-2017-0503

Technical details sufficient to assess affected components, root cause, or fixes are not publicly provided in the supplied documents. Please monitor for updates from official vulnerability feeds for CVE-2017-0503.

CVE-2017-0559

CVE-2017-0559 is an information-disclosure vulnerability in Android's libskia that could let a local malicious app access data outside its permission levels. Affected versions include Android 4.4.4 through 7.1.1. The provided documents do not specify the root cause details or a remediation/patch....

CVE-2017-0676

CVE-2017-0676 is a remote code execution vulnerability in the Android media framework (Android). Affected versions include 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The connected documents corroborate this issue as a media framework RCE affecting Android, but do not provide concrete detail...

CVE-2017-0681

CVE-2017-0681 is a remote code execution in the Android media framework affecting Android versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2.** The CVSS3 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates a local attack with no privileges required but user interaction needed, and the...

CVE-2017-0705

CVE-2017-0705 is described here as an elevation of privilege in the Broadcom Wi-Fi driver within Android kernels. The connected sources identify the affected component as the Broadcom Wi‑Fi driver used in Android, with the impact stated as Elevation of Privilege (local). The root cause specifics ...

CVE-2017-0712

CVE-2017-0712 is an elevation of privilege in the Android framework wi-fi service. Affects Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. The vulnerability is linked to the Framework wi-fi service and could allow a local attacker to gain elevated privileges. The issue is addressed ...

CVE-2017-0771

CVE-2017-0771 is a denial of service vulnerability in Android’s media framework (libskia) affecting Android 7.0, 7.1.1, and 7.1.2. The NVD entry describes DoS in the media framework, with the running impact defined as availability loss. The CVSS v3 vector indicates LOCAL attack vector, low attack...

CVE-2017-0854

CVE-2017-0854 is an information-disclosure vulnerability in the Android media framework affecting Android 7.0, 7.1.1, 7.1.2, and 8.0 (Pixel/Nexus devices). The Android Pixel bulletin classifies it under Media framework with patch level 2017-11-05 or later addressing the issue; updated AOSP versio...

CVE-2017-0876

CVE-2017-0876 is a remote code execution vulnerability in Android’s media framework (libavc) affecting Android 6.0. The Android bulletin groups it under the Media framework RCE family (CVE-2017-0872/0876/0877/0878/13151) and notes that security patches at 2017-12-01 or newer (and 2017-12-05 for s...

CVE-2017-11017

CVE-2017-11017 affects Android builds for MSM (including CAF-derived kernel variants) and related Android forks (Firefox OS for MSM, QRD Android). The issue arises when flashing a specially crafted UBI image, causing memory corruption or access to uninitialized memory in the Linux kernel used by ...

CVE-2017-11032

The CVE-2017-11032 issue affects Android builds using CAF Linux kernels (Android MSM/CAF variants). It describes a double-free in the service_locator_send_msg() path when kmalloc fails to allocate memory for resp/req pointers, potentially enabling local privilege elevation. Affected components ar...