CVE-2015-9051

CVE-2015-9051 affects Qualcomm components in Android CAF builds using the Linux kernel (LTE stack). Root cause: an assertion can be reached due to an improper bound on a length in a System Information message. Severity in the provided metrics is critical (CVSSv3 base 9.8). The connected documents...

CVE-2016-5854

CVE-2016-5854 involves a kernel information disclosure in Qualcomm SPCom driver components across Android for MSM, Firefox OS for MSM, and QRD Android. The underlying issue is that kernel heap memory can be exposed to userspace, enabling local information disclosure. Public documents list the aff...

CVE-2016-5867

CVE-2016-5867 affects the Qualcomm sound driver in Android MSM (kernel sound subsystem). The root cause is that some variables originate from userspace and can be chosen to trigger a stack overflow, potentially enabling local impact. The initial description notes a stack overflow risk; CVSS3/2 me...

CVE-2017-0843

CVE-2017-0843 is a local elevation-of-privilege vulnerability in MediaTek’s CCCI component within the Android kernel. The NVD entry characterizes it as EoP with high impact (confidentiality, integrity, and availability all affected) and local attack vector with no user interaction. The vulnerabil...

CVE-2017-7364

CVE-2017-7364 affects Qualcomm devices using CAF Android with the Linux kernel. The issue resides in __mdss_fb_copy_destscaler_data(), where ds_data[i].scale may point to a user-provided address, which can be freed on an error, causing a use-after-free condition. CVSS3 vector indicates a network-...

CVE-2017-8261

CVE-2017-8261 is a Qualcomm component issue affecting the Camera driver in CAF Android builds using the Linux kernel. The root cause is a potential kernel overwrite in a camera driver ioctl, enabling Elevation of Privilege rather than remote code execution. The vulnerability is classified as EoP ...

CVE-2017-9682

CVE-2017-9682 affects the Qualcomm KGSL GPU driver in Android CAF builds on Linux kernel. Description: a race condition between two KGSL driver functions can cause a Use After Free. Exploitation details are not provided in the connected documents. Mitigation: Android security bulletin patches (Au...

CVE-2023-21388

CVE-2023-21388 affects Google Android, specifically the Settings component, where a missing permission check can enable a local escalation of privilege without extra execution privileges or user interaction. The vulnerability is categorized as EoP with a high impact on confidentiality, integrity,...

CVE-2013-6792

Google Android prior to 4.4 contains an APK Signature Security Bypass vulnerability. The issue is cited across multiple sources (NVD entry CVE-2013-6792, Red Hat advisory, CVE listings) and is associated with a signature bypass in APK handling. The CIRCL feed notes an exploit entry, indicating ex...

CVE-2015-9033

CVE-2015-9033 is an Android CAF/Linux kernel issue where a QTEE system call fails to validate a pointer. Reported as a local vulnerability with high impact (confidentiality, integrity, availability) and requiring user interaction. Public references describe the root cause as pointer validation fa...

CVE-2017-7366

CVE-2017-7366 affects Android devices using CAF Linux kernel with KGSL kernel graphics guest library: a KGSL ioctl fails to validate all parameters, enabling an elevation of privilege within the GPU driver. The vulnerability is listed under Qualcomm components in the 2017-06-05 Android bulletin; ...

CVE-2017-8241

Technical details about CVE-2017-8241 are not publicly provided in the connected documents. The materials here only reiterate a buffer overflow in a WLAN function due to an incorrect message length. Monitor for official updates and patches.

CVE-2017-9678

CVE-2017-9678 affects Qualcomm’s video driver in Android CAF builds on Linux kernel. The issue is memory corruption due to lack of bounds checking in memcpy(), enabling local exploitation with user interaction. CVSS v3.0 base score 7.8 (HIGH) with LOCAL exploit and HIGH impact on confidentiality,...

CVE-2023-21296

CVE-2023-21296 corresponds to an information-disclosure flaw in Android’s permission side-channel that can reveal whether an app is installed, enabling local escalation of privilege with no extra execution privileges required. Exploitation requires user interaction. Android 14 patch release notes...

CVE-2023-21298

CVE-2023-21298 is a disclosed vulnerability affecting Slice, described as a side-channel information disclosure that can lead to local privilege escalation without extra execution privileges or user interaction. Connected sources corroborate an installed-apps disclosure with local elevation of pr...

CVE-2023-21305

Technical details for CVE-2023-21305 are not publicly provided in the supplied documents. No specifics on affected products, versions, or fixes are present. Please monitor for updates.

CVE-2023-21378

CVE-2023-21378 : In Telecomm, a missing permission check enables silencing the ring for calls of secondary users, causing a local elevation of privilege with no additional execution privileges needed. Exploitation does not require user interaction. CVSSv3.1 base score is 7.8 (High), with local at...

CVE-2014-9976

Summary (MODE C): CVE-2014-9976 describes a buffer overflow in the 1x call processing path of Qualcomm components used in Android CAF builds that rely on the Linux kernel. The vulnerability is documented with a high/critical impact in CVSS metrics (network attack vector, low complexity, no privil...

CVE-2015-8997

CVE-2015-8997 is described in the Connected documents as a time-of-check time-of-use race condition in the listener routine of TrustZone on Android CAF builds using the Linux kernel. The vulnerability is tied to TrustZone’s listener code, with public sources noting a TOCTOU race condition potenti...

CVE-2015-8998

CVE-2015-8998 describes an integer overflow in TrustZone that could potentially affect Android devices using the CAF Linux kernel. Connected sources reiterate TrustZone/CAF exposure and label it as an integer overflow inTrustZone components; no further technical specifics (affected versions, expl...

CVE-2015-9065

CVE-2015-9065 concerns Qualcomm products with CAF Android releases using the Linux kernel, where a UE may respond to a UEInformationRequest before Access Stratum security is established. The provided sources describe the issue but do not specify exact affected models, versions, or a vendor patch/...

CVE-2015-9073

CVE-2015-9073 : Concrete details available across sources show a vulnerability in Qualcomm components within Android CAF builds using the Linux kernel, where an untrusted pointer could be dereferenced in a TrustZone syscall. The issue affects Qualcomm’s closed-source/TrustZone pathway inside Andr...

CVE-2016-10340

CVE-2016-10340 affects CAF Android releases that use the Linux kernel, with an issue described as an integer underflow in a syscall handler that leads to a buffer overflow. The documents provided confirm the vulnerability description but do not give specific product/vendor versions, affected kern...

CVE-2016-10344

CVE-2016-10344 affects Qualcomm components in Android CAF builds using the Linux kernel, where an out-of-range pointer offset in LTE could be exploited. The entry lists a high-severity impact (CVSS v3 base score 9.8, CRITICAL) with attack vector Network and no user interaction, but the provided d...

CVE-2016-10387

CVE-2016-10387 concerns Qualcomm CAF Android devices using the Linux kernel, where an assertion could be reachable during a handover. The CVSS3/3.0 score is 9.8 (CRITICAL) with high impact to confidentiality, integrity, and availability, indicating severe risk if exploitable. The provided Connect...

CVE-2017-9684

CVE-2017-9684 concerns a race condition in the Qualcomm USB driver used by Android CAF Linux kernels, leading to a Use-After-Free condition. The vulnerability is localized and requires user interaction to exploit, with potential high impact on confidentiality, integrity, and availability if succe...

CVE-2023-21310

CVE-2023-21310 affects Android Bluetooth, described as an out-of-bounds write caused by a heap buffer overflow in the Bluetooth component. The vulnerability allows local elevation of privilege with System execution privileges and does not require user interaction. The provided documents confirm t...

CVE-2023-21329

CVE-2023-21329 describes an information disclosure in Android's Activity Manager caused by a missing permission check, enabling local access to whether an app is installed without user interaction. The Android 14 security release notes list this CVE under Framework with a Moderate severity and in...

CVE-2023-21380

CVE-2023-21380 is a Bluetooth heap buffer overflow in Android that can enable local elevation of privilege with SYSTEM execution when exploited without user interaction. The vulnerability is listed in Android 14 security release notes and associated with an out-of-bounds write in Bluetooth. Affec...

CVE-2023-40101

CVE-2023-40101 describes an out-of-bounds read in the collapse path of canonicalize_md.c that can disclose local information without extra privileges or user interaction. Public records in multiple sources (NVD, Red Hat, CNVD, etc.) confirm the same description. The Android 14 release notes list ...

CVE-2014-9935

CVE-2014-9935 describes an integer overflow in TrustZone that could lead to a buffer overflow in a DRM routine across CAF Android releases using the Linux kernel. The root cause is an overflow in TrustZone handling within DRM code, enabling potential memory corruption in affected devices. Public ...

CVE-2014-9969

CVE-2014-9969 concerns Qualcomm GPS client cryptography on Android CAF builds using the Linux kernel, where the GPS client may use an insecure cryptographic algorithm. Connected documents corroborate this description (Android/Qualcomm stack). The provided sources do not include concrete patch ver...

CVE-2015-1525

CVE-2015-1525 (Android prior to 5.1) targets the AudioPolicyManagerBase.cpp. The vulnerability arises when the system processes a crafted application that provides a NULL device address, allowing a denial of service (audio_policy outage). Root cause is indicated as a NULL-pointer/invalid device a...

CVE-2015-8596

CVE-2015-8596 concerns a buffer length validation flaw in Qualcomm closed‑source malware protection components used in Android CAF builds running the Linux kernel. The root cause is missing validation of buffer lengths, described across multiple sources as a buffer overflow/length-check omission....

CVE-2015-9001

Technical details, affected components, and remediation for CVE-2015-9001 are not publicly provided in the connected documents. Monitor updates from NVD/Android sources.

CVE-2015-9032

CVE-2015-9032: In CAF Android releases using the Linux kernel, a DRM key was exposed to QTEE applications, enabling information disclosure of DRM secrets. The description does not provide remediation details or explicit root-cause fixes in the supplied documents.

CVE-2016-10332

CVE-2016-10332 : Affects Android builds from CAF using the Linux kernel where stack protection was not enabled for secure applications. The available description specifies the missing stack-protection bit but provides no details on affected products/versions beyond “Android releases from CAF usin...

CVE-2016-10335

CVE-2016-10335 involves Android CAF builds; connected documents indicate that the Linux kernel usage within CAF Android releases involves an update to libtomcrypt. The available sources do not provide explicit vulnerability details, affected vendor/product version ranges, root cause analysis, exp...

CVE-2016-5859

CVE-2016-5859 involves a vulnerability in the Qualcomm sound driver across Android for MSM, Firefox OS for MSM, and QRD Android. The issue arises when a function is called with a very large length, triggering an integer overflow that is followed by a buffer overflow. The description identifies me...

CVE-2017-0862

CVE-2017-0862 is an elevation of privilege in the Android upstream kernel (Kernel component). The connected records consistently describe it as a Kernel EoP issue affecting the Android kernel; no specific vulnerable version ranges or fixed versions are provided in the supplied documents. The mate...

CVE-2017-6421

CVE-2017-6421 describes an elevation-of-privilege vulnerability in the Qualcomm MStar touchscreen driver affecting Qualcomm-based Android devices. The issue arises in the touch controller function where a variable is user-controlled, enabling a buffer overflow. Public details indicate the vulnera...

CVE-2017-7371

CVE-2017-7371 affects Android CAF devices using the Linux kernel with SLIMbus when Bluetooth is active. Root cause: a data pointer may be used after being freed when SLIMbus is turned off via Bluetooth, leading to memory corruption and potential local impact. Affected component: Qualcomm/Bluetoot...

CVE-2017-8267

CVE-2017-8267 affects Qualcomm components in Android CAF builds using the Linux kernel. The issue is a race condition in an IOCTL handler that can lead to an integer overflow and an out-of-bounds write. Impact is described as local, with high severity in CVSS, and no explicit exploit details prov...

CVE-2023-21297

CVE-2023-21297 affects SEPolicy in Android, enabling a permissions bypass to access the factory MAC address. This can cause local information disclosure with System execution privileges required and does not require user interaction. The connected Red Hat, CNVD, and other sources reiterate the sa...

CVE-2023-21346

CVE-2023-21346 is listed in Android 14 security release notes under Framework with Type ID and Moderate severity. The initial description indicates a local information-disclosure via Device Idle Controller side-channel (no user interaction required). Connected notes confirm framework-level classi...

CVE-2023-21370

CVE-2023-21370 is an elevation-of-privilege flaw in the Android Security Element API. The root cause is an integer overflow that enables an out-of-bounds write, leading to local privilege escalation with System privileges. Exploitation requires no user interaction. The affected component is the S...

CVE-2023-21383

Technical details (affected product/version/root cause/fix) for CVE-2023-21383 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2014-9937

CVE-2014-9937: Concrete detail from connected sources shows a buffer overflow in TrustZone’s DRM routine in Android, applicable across CAF Linux kernel builds. The vulnerability could allow an attacker to execute arbitrary code or cause a denial of service within TrustZone DRM, via a vulnerabilit...

CVE-2014-9960

CVE-2014-9960 is a documented buffer‑overflow vulnerability in the PlayReady API present in Android releases from CAF using the Linux kernel. The issue affects the PlayReady API component (buffer overflow in PlayReady) and is supported by multiple entries (NVD, CNVD, CVELIST, PRION, etc.). The CV...

CVE-2015-8594

CVE-2015-8594 is a buffer over-read vulnerability reported for Qualcomm CAF Android builds using the Linux kernel, affecting Qualcomm components in the RFA-1x area. The NVD entry lists a highly severe impact (CVSSv3 base score 9.8, CRITICAL) with network attack vector and no user interaction, ind...