CVE-2017-8237

CVE-2017-8237 is a buffer overflow in CAF Android builds using the Linux kernel when loading a firmware image. Connected data indicates the issue affects Qualcomm networking driver components (QC-CR#1110522) with an Elevation of Privilege (EoP) impact rated as Moderate. No explicit exploit detail...

CVE-2023-21297

CVE-2023-21297 affects SEPolicy in Android, enabling a permissions bypass to access the factory MAC address. This can cause local information disclosure with System execution privileges required and does not require user interaction. The connected Red Hat, CNVD, and other sources reiterate the sa...

CVE-2023-21346

CVE-2023-21346 is listed in Android 14 security release notes under Framework with Type ID and Moderate severity. The initial description indicates a local information-disclosure via Device Idle Controller side-channel (no user interaction required). Connected notes confirm framework-level classi...

CVE-2023-21370

CVE-2023-21370 is an elevation-of-privilege flaw in the Android Security Element API. The root cause is an integer overflow that enables an out-of-bounds write, leading to local privilege escalation with System privileges. Exploitation requires no user interaction. The affected component is the S...

CVE-2023-21383

Technical details (affected product/version/root cause/fix) for CVE-2023-21383 are not publicly available in the provided connected documents. Monitor for updates.

CVE-2014-9411

CVE-2014-9411 concerns a Qualcomm/CAF Android stack issue: in CAF Android releases using the Linux kernel, an out-of-range pointer offset in rollback protection could be triggered. The vulnerability affects Qualcomm components within Android devices and is described as an out-of-range pointer off...

CVE-2014-9966

CVE-2014-9966 describes a TOCTOU race condition in Android CAF Secure Display implemented in the Linux kernel used by Android. The vulnerability affects Android releases using CAF’s Linux kernel and Secure Display, with impact on confidentiality, integrity, and availability as reflected in CVSS (...

CVE-2014-9971

CVE-2014-9971 affects Qualcomm components in Android CAF builds using the Linux kernel. The vulnerability arises when asserts are disabled, causing an instruction inside an assert to be skipped and enabling incorrect control flow. NVD lists a CVSSv3 base score of 9.8 (CRITICAL) with NETWORK attac...

CVE-2014-9973

CVE-2014-9973 describes a buffer-length validation flaw in the PlayReady DRM routine within Qualcomm closed‑source components used in Qualcomm/CAF Android builds on the Linux kernel. The underlying issue is missing validation of buffer length in the DRM pathway, which could enable a remote attack...

CVE-2014-9975

CVE-2014-9975 describes a rollback vulnerability in the Full Disk Encryption (FDE) component affecting Qualcomm closed‑source code used in Android CAF/Linux kernel builds. The issue is documented across multiple sources (NVD/CVE pages) as related to Qualcomm FDE, with a high‑severity impact profi...

CVE-2015-8594

CVE-2015-8594 is a buffer over-read vulnerability reported for Qualcomm CAF Android builds using the Linux kernel, affecting Qualcomm components in the RFA-1x area. The NVD entry lists a highly severe impact (CVSSv3 base score 9.8, CRITICAL) with network attack vector and no user interaction, ind...

CVE-2015-8996

CVE-2015-8996 describes a time-of-check time-of-use race condition in a TrustZone QFPROM routine affecting Android builds from CAF using the Linux kernel. The issue centers on the TrustZone protected QFPROM path; the root cause is a TOCTOU race in the QFPROM routine, potentially enabling incorrec...

CVE-2015-9071

CVE-2015-9071 describes a buffer over-read in a TrustZone syscall present in all Qualcomm products with Android CAF builds using the Linux kernel. The vulnerability affects Qualcomm components integrated in Android and is triggered via a TrustZone interface, enabling a high-impact condition consi...

CVE-2016-5859

CVE-2016-5859 involves a vulnerability in the Qualcomm sound driver across Android for MSM, Firefox OS for MSM, and QRD Android. The issue arises when a function is called with a very large length, triggering an integer overflow that is followed by a buffer overflow. The description identifies me...

CVE-2016-5860

CVE-2016-5860 affects the Qualcomm sound/ audio driver stack on Android-based devices (Qualcomm MSM Android builds, Firefox OS for MSM, QRD Android). The issue occurs when a function is called with an excessively large length, triggering an integer overflow that leads to a heap buffer overflow. T...

CVE-2016-5864

CVE-2016-5864 affects Qualcomm sound driver components used in Android for MSM, Firefox OS for MSM, and QRD Android. The issue stems from user-supplied parameters that can trigger integer overflow, potentially followed by a buffer overflow, and a separate lower-bound check omission that may cause...

CVE-2017-0865

CVE-2017-0865 is an elevation of privilege in the MediaTek SoC driver within Android kernel. The issue is categorized as EoP in the MediaTek SoC driver component; details across connected records confirm the affected element is the MediaTek SoC driver on Android devices (Pixel/Nexus context cited...

CVE-2017-7373

CVE-2017-7373 affects Android CAF builds using the Linux kernel display/video driver, describing a double‑free flaw. The Android bulletin attributes EoP potential to this issue and notes patches in the 2017-06-05 security update; apply the corresponding updates to mitigate.

CVE-2017-8265

CVE-2017-8265: A race condition in the Qualcomm video driver (CAF Android builds on Linux kernel) can cause a double free. This is a local issue affecting the video subsystem with potential impact to confidentiality, integrity, and availability as per CVSS metrics, but exploitation status and exa...

CVE-2023-21320

CVE-2023-21320 concerns information disclosure via the Device Policy on Android. The issue enables an attacker to verify whether a specific admin app is registered on a device through side-channel information disclosure, resulting in local information disclosure with no additional execution privi...

CVE-2023-21368

CVE-2023-21368 affects Android’s Audio component, with a possible out-of-bounds read caused by a missing bounds check. The consequence is local information disclosure without requiring privileges; exploitation does not require user interaction. Multiple connected sources corroborate the issue, in...

CVE-2014-9967

CVE-2014-9967 describes an untrusted pointer dereference in the WideVine DRM component used by Android CAF builds that run on the Linux kernel. The vulnerability is located in WideVine DRM (a media/content protection feature) and is triggered by dereferencing an untrusted pointer, leading to pote...

CVE-2015-9024

CVE-2015-9024 concerns Android CAF builds: in all CAF Android releases that use the Linux kernel, certain interfaces were improperly exposed to QTEE applications. The connected documents do not provide a specific affected product/version beyond this CAF/Linux-kernel context, nor do they describe ...

CVE-2015-9031

CVE-2015-9031 arises in all Android CAF builds that use the Linux kernel, where a TZ memory address is exposed to the high-level OS (HLOS) by the HDCP component. The root cause is a leakage of a TZ memory address, enabling information disclosure within the system. The available documents do not s...

CVE-2015-9054

Technical details for CVE-2015-9054 are not provided in the connected documents; no explicit affected products, versions, root cause, or fixes are disclosed here. Monitor for updates.

CVE-2016-10392

CVE-2016-10392 describes a memory-leak vulnerability in Qualcomm components used in Android CAF builds that run on the Linux kernel. The flaw is attributed to a driver that can potentially leak kernel memory in all Qualcomm products with Android CAF using the Linux kernel. Connected documents con...

CVE-2017-7365

CVE-2017-7365 is a Qualcomm bootloader elevation-of-privilege issue disclosed in the Android 2017-06-05 bulletin. It is listed as EoP (High) for the Bootloader component; exploitation would yield higher privileges within the kernel/boot context. Patches are provided via Qualcomm AMSS bulletins an...

CVE-2017-8239

CVE-2017-8239 is an information-disclosure issue in the Camera driver on Android devices (Qualcomm components) listed under the 2017 Pixel/Nexus bulletin. The vulnerability is categorized as ID with moderate severity in the camera driver, with no exploitation details provided in the available doc...

CVE-2014-9968

CVE-2014-9968 is a buffer‑overflow in the Qualcomm UIMDIAG interface found in Qualcomm closed‑source components included with Android CAF builds using the Linux kernel. Multiple connected sources describe a vulnerable UIMDIAG path in Qualcomm components and flag the issue as a potential for arbit...

CVE-2015-9022

Technical details about CVE-2015-9022 are not provided in the supplied documents. The description notes TOCTOU race conditions in TZ APIs on CAF Android/Linux kernel; no patch version or affected components specified here. Monitor for updates.

CVE-2015-9027

CVE-2015-9027 concerns an untrusted pointer dereference in WideVine DRM within Android CAF builds that use the Linux kernel. Per the NVD entry, the issue affects WideVine DRM and is rated with a high impact (CVSSv3: 7.8, Local attack vector, user interaction required; CVSSv2: 9.3). The connected ...

CVE-2015-9040

Technical details (affected product/version, root cause, exploitability) for CVE-2015-9040 are not publicly provided in the connected documents; monitor for updates.

CVE-2015-9042

Technical details about CVE-2015-9042 are not publicly available in the connected documents. The description notes a buffer overflow in Qualcomm CAF Android/Linux QMI processing, but no specific fixes or affected versions are provided here; monitor for updates.

CVE-2015-9066

CVE-2015-9066 describes a buffer overflow in the Inter-RAT procedure affecting Qualcomm components in Android CAF builds using the Linux kernel. Public sources flag it as a high-severity issue with potential remote code execution (CVSS ~9.8/10), but the provided documents do not specify affected ...

CVE-2015-9069

CVE-2015-9069 corresponds to a memory corruption vulnerability in Qualcomm closed‑source components used in Android CAF builds, which can lead to corruption of the Secure File System. Connected CNVD entries describe it as a Qualcomm component memory corruption vulnerability affecting Android, wit...

CVE-2016-10334

CVE-2016-10334 affects Android CAF builds using the Linux kernel; a dynamically-protected DDR region could potentially be overwritten. The available documents identify the issue and reference Android security bulletins, but do not provide specific root-cause details, affected product versions, or...

CVE-2016-5347

CVE-2016-5347 describes an information-disclosure vulnerability in Qualcomm components, specifically in the CAF Android/Linux kernel audio driver. The issue allows leakage of kernel stack data to userspace via the audio driver, affecting Qualcomm-based Android devices using CAF-released kernels. ...

CVE-2016-5853

CVE-2016-5853 affects the Qualcomm Sound/Audio driver in Android CAF builds using the Linux kernel. The root cause is a sanity check: if a length value is out of the valid range, the code prints an error but continues as if the value were correct, potentially enabling unintended behavior. The CVE...

CVE-2017-0864

CVE-2017-0864 is an elevation-of-privilege vulnerability in MediaTek ioctl (flashlight) exposed on Android kernels. Connected sources confirm the issue affects MediaTek ioctl flashlight within the Android kernel, enabling an attacker to gain elevated privileges. The CNVD entry explicitly describe...

CVE-2017-7367

CVE-2017-7367 concerns an integer underflow in the boot image processing path on Android CAF builds using the Linux kernel. The available connected documents identify this as a DoS-type issue (bootloader component) with a high-severity impact profile. The exact affected products, versions, and fi...

CVE-2017-8257

CVE-2017-8257 affects Qualcomm CAF Android devices using the Linux kernel, specifically the sde_rotator debug interface. The issue arises when multiple processes read registers and one process frees the debug buffer while another still uses it, creating a use-after-free-like condition. The NVD re...

CVE-2017-9679

CVE-2017-9679 affects Qualcomm products with Android CAF/Linux kernel. The issue arises when a userspace string is not NULL-terminated, allowing kernel memory contents to leak to system logs. This constitutes an information disclosure risk (partial confidentiality impact) as described in the vuln...

CVE-2017-9685

The CVE-2017-9685 entry concerns Qualcomm WLAN driver race conditions in Android CAF builds using the Linux kernel, producing a Use-After-Free condition. Affected software is Qualcomm products with CAF Android releases, where the WLAN driver’s race condition can impact confidentiality, integrity,...

CVE-2023-21317

CVE-2023-21317 : In Android’s ContentService, a side-channel disclosure can reveal whether an app is installed on the device without any query permissions, enabling local information disclosure with no user interaction. Affected component: ContentService/Android framework; root cause: side-channe...

CVE-2023-21344

CVE-2023-21344 affects Android’s Job Scheduler. The issue enables a local attacker to determine whether an app is installed via a side-channel information disclosure, without query permissions and with no user interaction. Impact is local information disclosure; exploitation requires local access...

CVE-2023-21371

CVE-2023-21371 affects Android’s Secure Element. The issue is an out-of-bounds write caused by an integer overflow in Secure Element code, enabling local escalation of privilege to System execution privileges without user interaction. Exploitation details are not provided in the connected documen...

CVE-2023-21372

CVE-2023-21372 concerns a vulnerability in libdexfile where a missing bounds check allows an out-of-bounds read, enabling local elevation of privilege without user interaction. The issue affects Android’s libdexfile component and is classified as a local EoP (MITRE ambiguous, but Android bulletin...

CVE-2014-9962

Technical details about CVE-2014-9962 are not publicly available in the provided connected documents. The initial description notes a DRM provisioning command parsing issue in CAF Android with the Linux kernel, but no specifics on affected versions, impact, or fixes are provided. Monitor for upda...

CVE-2015-8592

CVE-2015-8592 describes a vulnerability in Qualcomm closed‑source components used in Android CAF Linux builds where a reverse‑referenced pointer is not validated before dereference, potentially causing Guest‑OS memory corruption. Affected: Qualcomm components integrated into Android CAF/Linux ker...

CVE-2015-9064

CVE-2015-9064 affects Qualcomm components used in Android CAF builds on the Linux kernel. The issue enables a UE to send its IMEI or IMEISV to the network in response to a network request before NAS security is activated. This vulnerability is described consistently across multiple sources (NVD/N...