CVE-2016-0804

CVE-2016-0804 affects Android mediaserver’s NuPlayer::GenericSource.cpp in Android 5.x up to 5.1.1 and 6.x up to 2016-02-01. The root cause is improper management of the mDrmManagerClient object, enabling a remote attacker to execute arbitrary code or cause memory corruption via a crafted media f...

CVE-2016-0811

CVE-2016-0811 covers an integer overflow in BnCrypto::onTransact within media/libmedia/ICrypto.cpp of libmediaplayerservice on Android 6.x prior to 2016-02-01. The vulnerability can allow attackers to obtain sensitive information and bypass an unspecified protection mechanism through a improper s...

CVE-2016-0837

CVE-2016-0837 affects Android’s mediaserver via libstagefright (MPEG4Extractor.cpp). The issue allows remote code execution or a denial of service through a crafted media file due to an out-of-bounds read and memory corruption. Affected are Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x befo...

CVE-2016-0840

CVE-2016-0840 refers to multiple stack-based buffer underflows in mediaserver’s decoder/ih264d_parse_cavlc.c on Android 6.x prior to 2016-04-01. The flaw allows memory corruption that could enable remote code execution or a denial of service when processing crafted media files. The entry is suppo...

CVE-2016-0843

The CVE-2016-0843 issue affects the Qualcomm ARM processor performance-event manager used by Android. The vulnerability allows a locally executed, crafted application to elevate privileges to the kernel, described as an internal bug 25801197. Affected Android versions include 4.x prior to 4.4.4, ...

CVE-2016-10230

CVE-2016-10230 is a remote code execution vulnerability in the Qualcomm crypto engine driver affecting the Android kernel. The Android bulletin (April 2017) lists the issue under the Qualcomm components and ties the fix to the 2017-04-05 patch level. Affected Google devices include Nexus 5X, Nexu...

CVE-2016-10299

CVE-2016-10299 is an elevation of privilege vulnerability in Qualcomm closed‑source components used by Android, affecting the Android kernel. Reported impact is high/critical (CVSS v3 base score 9.8) with network attack vector, no user interaction required, and likely requires no privileges. The ...

CVE-2016-2414

CVE-2016-2414 – Minikin DoS in Android . The Minikin library in Android 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-04-01) fails to properly handle negative size values in font data, enabling a local attacker to trigger memory corruption and a reboot loop via a crafted font, ...

CVE-2016-2421

The CVE-2016-2421 entry documents a vulnerability in Android’s Setup Wizard that allows physically proximate attackers to bypass Factory Reset Protection and delete data. Affected: Android 5.1.x before 5.1.1 and 6.x before 2016-04-01. Root cause is an exploit in the Setup Wizard flow that enables...

CVE-2016-2425

CVE-2016-2425 describes an information-disclosure vulnerability in AOSP Mail’s ComposeActivity.java where Android versions 4.x (before 4.4.4), 5.0.x (before 5.0.2), 5.1.x (before 5.1.1), and 6.x (before 2016-04-01) allow file:///data attachments, enabling a local attacker to obtain sensitive info...

CVE-2016-2449

CVE-2016-2449 affects Android mediaserver: Camera3Device.cpp in mediaserver allows privilege escalation due to not validating template IDs, enabling a crafted app to gain Signature or SignatureOrSystem access. Affected: Android 4.x before 4.4.4; 5.0.x before 5.0.2; 5.1.x before 5.1.1; 6.x before ...

CVE-2016-2452

CVE-2016-2452 affects Android mediaserver (libstagefright) — specifically codecs/amrnb/dec/SoftAMR.cpp — where buffer sizes are not properly validated. The issue resides in the AMR-NB decoding path and can allow a local attacker to escalate privileges to Signature or SignatureOrSystem by deliveri...

CVE-2016-2491

Summary (CVE-2016-2491) : The NVIDIA camera kernel driver on Android (Nexus 9) before 2016-06-01 has a memory allocation miscalculation that can under-allocate memory, leading to a buffer overflow and local privilege escalation when a crafted app is run. The issue is documented in CVE-2016-2491 w...

CVE-2016-2505

CVE-2016-2505 affects Mediaserver’s libstagefright (mp eg2ts) in Android 6.x, where mpeg2ts/ATSParser.cpp does not validate a certain section length. This can allow a remote attacker to execute arbitrary code or cause memory corruption via a crafted media file, yielding remote code execution or m...

CVE-2016-2506

CVE-2016-2506 affects Android Mediaserver (libstagefright DRMExtractor.cpp). The vulnerability arises from missing validation of a certain offset value in media processing, enabling a remote attacker to execute arbitrary code or cause memory corruption via a crafted media file. Affected Android v...

CVE-2016-3793

CVE-2016-3793 affects the NVIDIA camera driver (NVIDIA Tegra/Kernel driver) on Android, where a race condition use-after-free in the camera kernel path could allow a local attacker to gain privileges via a crafted app on affected Nexus devices (e.g., Nexus 9). The issue is described as a race con...

CVE-2016-3926

CVE-2016-3926 is a Qualcomm component elevation-of-privilege issue affecting Nexus 5/5X/6/6P on Android, listed under the 2016-10-05 patch level. The vulnerability is described as part of Qualcomm AMSS/driver vulnerabilities with internal bug 28823953 and is marked as a critical issue in the Qual...

CVE-2016-5349

Technical details for CVE-2016-5349 are not provided in the connected documents. Public disclosures contain general descriptions only; no concrete product/vendor/version/root-cause or fix information is available here. Monitor for updates from official advisories.

CVE-2016-5854

CVE-2016-5854 involves a kernel information disclosure in Qualcomm SPCom driver components across Android for MSM, Firefox OS for MSM, and QRD Android. The underlying issue is that kernel heap memory can be exposed to userspace, enabling local information disclosure. Public documents list the aff...

CVE-2016-5857

The CVE-2016-5857 issue affects the Qualcomm SPCom driver in Android, where Android kernels prior to 7.0 allow local users to execute arbitrary code in kernel context via a crafted application. The vulnerability originates from the SPCom driver and enables a local escalation of privilege with com...

CVE-2016-5867

CVE-2016-5867 affects the Qualcomm sound driver in Android MSM (kernel sound subsystem). The root cause is that some variables originate from userspace and can be chosen to trigger a stack overflow, potentially enabling local impact. The initial description notes a stack overflow risk; CVSS3/2 me...

CVE-2016-6707

CVE-2016-6707 affects Android System Server with a local privilege-escalation via ashmem-backed Bitmaps. The issue stems from mismatched memory sizes: ashmem (ASHMEM_SET_SIZE) defines the region size, but memory mappings (mmap) in Parcel::readBlob use a bitmap-derived len, and Bitmap creation sto...

CVE-2016-6734

CVE-2016-6734 concerns the NVIDIA GPU driver on Android. The issue is an elevation of privilege that could allow a local malicious app to execute arbitrary code in the kernel context. Affected environment is Android platforms prior to the 2016-11-05 security patch level. The underlying impact is ...

CVE-2016-6763

CVE-2016-6763 describes a denial-of-service vulnerability in Android’s Telephony stack. A local malicious application could cause a device hang or reboot by feeding the system a specially crafted file. Affected versions include Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, and 7.0. The entry notes the...

CVE-2016-6767

CVE-2016-6767 describes a denial-of-service vulnerability in Mediaserver on Android 4.4.4 that could be triggered by a specially crafted file to cause a device hang or reboot. The primary affected component is Mediaserver (Android). The public material confirms the impact as DoS and notes remote ...

CVE-2016-6771

CVE-2016-6771 = Elevation of privilege in Android Telephony. A local malicious application could bypass restrictions in a constrained Telephony process and gain access to system functions beyond its granted level. Affected products/versions identified in the entry: Android 6.0, 6.0.1, and 7.0 (An...

CVE-2016-8445

CVE-2016-8445 describes an elevation of privilege in MediaTek components used by Android, specifically the thermal and video drivers. A local malicious application could execute arbitrary code in the kernel context, requiring a compromised privileged process first. The vulnerability is associated...

CVE-2017-0383

Technical details about CVE-2017-0383 are not publicly available in the provided connected documents. No vendor, version, impact, or remediation details are present here. Monitor for updates from official sources.

CVE-2017-0501

CVE-2017-0501 : Elevation of privilege in MediaTek components (including M4U, sound, touchscreen, GPU, and Command Queue drivers) could allow a local malicious app to execute arbitrary code in the kernel context on Android. The vulnerability is rated Critical due to potential permanent device com...

CVE-2017-0543

CVE-2017-0543: A remote code execution vulnerability in libavc within Mediaserver could allow memory corruption via a specially crafted media/file, leading to code execution in the Mediaserver process. Affected product: Android devices; versions include 6.0, 6.0.1, 7.0, and 7.1.1. Root cause desc...

CVE-2017-0676

CVE-2017-0676 is a remote code execution vulnerability in the Android media framework (Android). Affected versions include 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The connected documents corroborate this issue as a media framework RCE affecting Android, but do not provide concrete detail...

CVE-2017-0697

CVE-2017-0697 is a DoS vulnerability in the Android media framework. The connected documents confirm impact on Android devices with versions 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The Android media framework is the affected component; the issue arises within that framework, leadi...

CVE-2017-0730

CVE-2017-0730 is described as a denial-of-service in the Android media framework h264 decoder affecting Android 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2. The connected CNVD entry reiterates a DoS in the Media framework h264 decoder, but the provided documents do not specify the root cause, affected file...

CVE-2017-0739

CVE-2017-0739 is an information-disclosure vulnerability in the Android media framework component libhevc. The issue affects Android versions 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, and 7.1.2, and is related to information disclosure via media decoding. The connected documents confirm the affected ...

CVE-2017-0741

CVE-2017-0741 is a MediaTek GPU driver elevation-of-privilege vulnerability affecting Android kernel space. Affected component: MediaTek GPU driver within Android. Impact: local privilege escalation as described in the CVE; no explicit exploit details provided in the documents. Remediation: Andro...

CVE-2017-0747

CVE-2017-0747 is an elevation-of-privilege vulnerability in the Qualcomm Proprietary Component used by Google Android. The issue affects the Android kernel via the Qualcomm-provided component; an attacker could exploit it to escalate privileges within the device. Public descriptions in CNVD/NVD i...

CVE-2017-0826

CVE-2017-0826 is an Elevation of Privilege in the HTC bootloader affecting Android kernel on HTC devices. The vulnerability is described as an EoP in the bootloader, enabling privilege escalation within the Android stack. The primary documented impact is local privilege elevation, with CVSS indic...

CVE-2017-0854

CVE-2017-0854 is an information-disclosure vulnerability in the Android media framework affecting Android 7.0, 7.1.1, 7.1.2, and 8.0 (Pixel/Nexus devices). The Android Pixel bulletin classifies it under Media framework with patch level 2017-11-05 or later addressing the issue; updated AOSP versio...

CVE-2017-0857

CVE-2017-0857 is listed in the Android Pixel/Nexus Security Bulletin (Media framework) with type NSI, affecting Android 7.0, 7.1.1, 7.1.2, and 8.0. The bulletin groups it under Media framework alongside other CVEs and indicates updated AOSP versions (patch level addressing the issue). The provide...

CVE-2017-10997

CVE-2017-10997 affects Qualcomm PCIe (PCI driver) in CAF Android builds. The root cause is a write to a PCIe register via a debugfs node that can corrupt kernel memory, as described for all Qualcomm products with CAF Linux kernels. The vulnerability detail specifies the component as the PCI drive...

CVE-2017-11007

CVE-2017-11007 is an Elevation of Privilege in Qualcomm Fastboot (EoP, High) with local access. The available connected records indicate a root cause of buffer overflow in the Partition name during conversion of ascii to unicode in HandleMetaImgFlash, leading to stack corruption. There are no exp...

CVE-2017-11049

CVE-2017-11049 describes a race condition in a video driver on Android devices (MSM/Qualcomm display stack) that can potentially lead to a buffer overflow. The affected scope includes Android builds for MSM, Firefox OS for MSM, and QRD Android, with CAF Linux kernel-based releases. The issue is c...

CVE-2017-11072

Summary: CVE-2017-11072 corresponds to an elevation-of-privilege vulnerability in Android's Partition table updater, affecting Google Pixel/Nexus devices. Affected component: Partition table updater in Android on CAF/Kernel stack with GPT header processing. Root cause: Buffer overflow when calcul...

CVE-2017-13150

CVE-2017-13150 is an information-disclosure vulnerability in Android’s Media framework affecting Pixel/Nexus devices running Android 7.0, 7.1.1, 7.1.2 and 8.0. The Android Pixel security bulletin attributes a Moderate severity to this issue and ties it to updates that address it. The connected bu...

CVE-2017-13204

CVE-2017-13204 is an information-disclosure vulnerability in Android's media framework (libavc) affecting Android 7.0, 7.1.1, 7.1.2, 8.0, and 8.1. The flaw is tied to the libavc component within the Media framework, with Android IDs A-64380237. Public sources classify the related issue in the Pix...

CVE-2017-13240

CVE-2017-13240 is an information disclosure vulnerability in the Android framework’s crypto framework affecting Android 8.0 and 8.1. The NVD entry confirms an information disclosure with impact to confidentiality and a base score of 7.5 (CVSS3) and 5.0 (CVSS2). The Android Pixel/Nexus security bu...

CVE-2017-13249

CVE-2017-13249 affects Android (versions 6.0 through 8.1). The issue is in impeg2d_api_set_display_frame within impeg2d_api_main.c, where an out-of-bounds write occurs due to a missing bounds check. This can enable remote code execution with no additional privileges required, with user interactio...

CVE-2017-13256

CVE-2017-13256 affects Android where the SDP server component (sdp_server.cc) contains an out-of-bounds write in process_service_search_attr_req due to a missing bounds check. This can enable remote code execution with no privileges and no user interaction. Affected Android versions include 5.1.1...

CVE-2017-13273

CVE-2017-13273 is a kernel‑level race condition in xt_qtaguid.c of the Android kernel caused by insufficient locking, enabling local elevation of privilege with no required user interaction. The issue affects Android kernel components and has been tracked in Android bulletins; the 2018 patch leve...

CVE-2017-13275

CVE-2017-13275: In Android Framework (getVSCoverage in CmapCoverage.cpp) an out-of-bounds read caused by an incorrect bounds check could lead to local information disclosure with no privileges required. Affected products/versions: Android 8.0 and 8.1 (Android bug ID A-70808908). Exploitation requ...