CVE-2017-14496

CVE-2017-14496: dnsmasq contains an integer underflow in the EDNS0 add_pseudoheader handling when --add-mac, --add-cpe-id, or --add-subnet is used, allowing a denial of service via crafted DNS requests. Public advisories (CentOS/RH, Arch Linux, AWS ALAS) and Arista note fixes, with upgrades to dn...

CVE-2017-0781

CVE-2017-0781 is a remote code execution vulnerability in the Android Bluetooth stack (BNEP) that allows crafting packets to overflow a heap buffer and execute code. Connected PoC/Exploit references (BlueBorne) describe Android RCE via the BNEP service and related Bluetooth flaws across Android v...

CVE-2017-0785

CVE-2017-0785 is an Android Bluetooth SDP information-disclosure vulnerability in the Bluetooth stack. The SDP server can leak memory/allow an out-of-bounds read by manipulating the SDP continuation state in requests, enabling information disclosure. Affected Android versions include 4.4.4–8.0 (a...

CVE-2017-13156

CVE-2017-13156 is an Android UART-style APK signature bypass (Janus) that allows an attacker to inject or modify an APK without breaking its V1 signature, enabling installation updates with attacker-controlled code. The vulnerability affects Android 5.1.1 through 8.0 (ART), enabling elevation of ...

CVE-2017-0782

CVE-2017-0782 is a remote code execution vulnerability in Android Bluetooth PAN (Personal Area Networking) via the BNEP high-level configuration, causing memory corruption and allowing full device compromise without user interaction. It affects Android versions 4.4.4 through 8.0 (per the CVE desc...

CVE-2016-10229

The CVE-2016-10229 issue affects the Linux kernel’s UDP handling: udp.c in versions before 4.5 contains an unsafe second checksum calculation when a recv call uses MSG_PEEK, enabling remote code execution. Reports and advisories (e.g., ALAS-2017-832, Alpine, Debian, Broadcom/Big-IP advisories) co...

CVE-2017-0852

CVE-2017-0852 is a DoS in Android’s media framework libhevc affecting Android 5.0.2, 5.1.1 and 6.0. The connected sources confirm the flaw in the Media framework (libhevc) and list the affected versions. The Pixel/Nexus bulletin notes that patches addressing this and other issues are included in ...

CVE-2017-0589

CVE-2017-0589 is a remote code execution vulnerability in libhevc used by the Android Mediaserver . A specially crafted media file could cause memory corruption during processing, enabling code execution within Mediaserver. Affected Android versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. T...

CVE-2017-0861

CVE-2017-0861 is a use-after-free in the Linux kernel’s ALSA subsystem (snd_pcm_info). The fault is in the PCM core and can lead to privilege escalation via local access, as described in multiple advisories (e.g., CentOS/RH patches) and Debian security updates. If exploited, a local attacker may ...

CVE-2017-0540

CVE-2017-0540 describes a remote code execution in the Android Mediaserver’s libhevc component. The underlying issue is a memory corruption vulnerability triggered by specially crafted media files during processing, enabling code execution within the Mediaserver process. Affected Android versions...

CVE-2017-13166

CVE-2017-13166 describes an elevation of privilege in the kernel v4l2 video driver, affecting the Android kernel. The underlying issue enables a local attacker with minimal privileges to escalate to higher privileges by exploiting the v4l2 component, as reflected in vulnerabilities tracked across...

CVE-2017-0720

The CVE-2017-0720 entry concerns Android's media framework libhevc, where a remote code execution vulnerability affects Android versions 5.0.2, 5.1.1, 6.0/6.0.1, and 7.0/7.1.1/7.1.2. The issue is triggered by processing a specially crafted file, with impact described as remote execution of arbitr...

CVE-2017-0783

CVE-2017-0783 is described in connected documents as the Bluetooth Pineapple vulnerability affecting the Android Bluetooth stack. The flaw allows an attacker to create a malicious network interface on a victim device, reconfigure IP routing, and force all communications to pass through the attack...

CVE-2017-0811

CVE-2017-0811 is a remote code execution vulnerability in the Android media framework (libhevc). Affected products/versions include Android 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, and 8.0. The vulnerability originates in the media framework and could allow an attacker with local access to ru...

CVE-2017-3544

CVE-2017-3544 is a content spoofing vulnerability in the Networking component of Oracle/OpenJDK’s Java SE/Java SE Embedded/JRockit, specifically an SMTP newline-injection issue in the SMTP client. The connected documents establish that a remote attacker could exploit this via SMTP to manipulate S...

CVE-2014-9940

CVE-2014-9940 affects the Linux kernel regulator_ena_gpio_free function in drivers/regulator/core.c, with exploitation possible through local access to gain privileges or cause a denial of service via a use-after-free. Affected condition is kernel versions before 3.19. Impact per sources is high ...

CVE-2016-10200

CVE-2016-10200 describes a race condition in the Linux kernel’s L2TPv3 IP Encapsulation feature that can allow a local user to escalate privileges or cause a denial of service via repeated bind() calls without correctly checking SOCK_ZAPPED status. The issue affects Linux kernels prior to 4.8.14,...

CVE-2017-0393

CVE-2017-0393: DoS in libvpx Mediaserver. A remote attacker can trigger device hang/reboot with a specially crafted file. Documented impact on Android versions (4.4.4–7.1); root cause is a flaw in libvpx’s Mediaserver. Connected documents confirm the vulnerability exists in libvpx and describe th...

CVE-2017-0637

Android Mediaserver exposes a remote code execution in the libhevc component when processing specially crafted media files, leading to memory corruption. Affected Android versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 (Android ID A-34064500). CVSSv3 base score 7.8 (HIGH); attack vector LOC...

CVE-2017-0553

CVE-2017-0553 is a libnl/libnl3 integer overflow in nlmsg_reserve() = 3.3.0 (or the specific patched package version as provided by distributions; examples include Arch Linux ASA-201706-35 recommending 3.3.0-1 and Red Hat/CentOS advisories updating libnl3). Several advisories reference this CVE (...

CVE-2016-10044

CVE-2016-10044 is supported by connected advisories: the Linux kernel up to version 4.7.7 contains a vulnerability in the aio_mount path. Specifically, the aio_mount function in fs/aio.c did not properly restrict execute access, enabling local users to bypass SELinux W^X policy and gain privilege...

CVE-2017-13168

CVE-2017-13168 is an elevation of privilege vulnerability in the Linux kernel SCSI driver affecting the Android kernel (Android ID A-65023233). The connected Nessus/OpenVAS advisories corroborate a kernel SCSI driver flaw that can enable local privilege escalation. The root cause is an issue in t...

CVE-2017-0539

CVE-2017-0539: A remote code execution in libhevc/Mediaserver on Android. A crafted media file can trigger memory corruption within Mediaserver. Affected Android versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Impact: potential remote code execution within Mediaserver. Remediation: patches releas...

CVE-2017-0663

CVE-2017-0663: libxml2 remote code execution via a crafted file. The Android-impacting flaw is a libxml2 out-of-bounds write that can crash or enable code execution in an unprivileged process. Exploitation and impact are stated in the CVE entry, with high severity (CVSSv3 7.8). No public fix vers...

CVE-2017-9725

CVE-2017-9725 affects Qualcomm CAF Android builds using the Linux kernel. Root cause: during DMA allocation, a wrong data type of size truncates the allocation size, causing it to succeed when it should fail. This yields a high-severity issue (local access, low attack complexity) as reflected in ...

CVE-2017-13151

CVE-2017-13151 is a remote code execution in Android’s Media framework (libmpeg2) affecting Android 6.0–8.0. The Android Security Bulletin (Dec 2017) classifies the Media framework vulnerability as critical (RCE) and links to patches in the 2017-12-01/2017-12-05 update levels. Affected codecs inc...

CVE-2017-13167

CVE-2017-13167 is described as an elevation of privilege vulnerability in the kernel sound timer affecting the Android kernel. The provided connected document notes the product as Android and versions as the Android kernel, with Android ID A-37240993. The Unity Linux/UTSA advisories reference thi...

CVE-2017-0675

CVE-2017-0675 is a remote code execution vulnerability in the Android media framework affecting Android 6.0.1, 7.0, 7.1.1, and 7.1.2. The issue is described as RCE in the media framework with impact to confidentiality, integrity, and availability. The Android bulletin indicates that the most seve...

CVE-2014-9922

CVE-2014-9922 affects the Linux kernel’s eCryptfs subsystem, where the combination of eCryptfs and an overlayfs stack can let a local user gain privileges. The issue is triggered by a vulnerability in fs/ecryptfs/main.c and fs/overlayfs/super.c, with impact described as local privilege escalation...

CVE-2017-0381

CVE-2017-0381 is an information-disclosure vulnerability in silk/NLSF_stabilize.c within libopus used by Mediaserver, affecting Android versions 5.0.2–7.1. It could allow a local malicious app to access data outside its permissions. The concrete root: a flaw in Opus handling as described in the C...

CVE-2017-11089

CVE-2017-11089: A buffer overread in nl80211_set_station occurs when a user-space app sends NL80211_ATTR_LOCAL_MESH_POWER_MODE with data smaller than 4 bytes. Affected: Android for MSM, Firefox OS for MSM, and QRD Android builds using CAF Linux kernel. Root cause and exact vendor-specific fixes a...

CVE-2017-0406

CVE-2017-0406 is a remote code execution vulnerability in Android's Mediaserver (libhevc) that can be triggered by processing a specially crafted media file, leading to memory corruption and potential code execution within the Mediaserver process. Reported impact is critical (CVE-2017-0406) with ...

CVE-2017-0752

CVE-2017-0752 is an elevation-of-privilege issue in the Android framework (windowmanager) affecting Android 4.4.4 through 7.1.2. Root cause: privilege escalation via windowmanager overlay/toast-style interaction (no exploit details provided in the sources). Impact is described as high (confidenti...

CVE-2015-9004

CVE-2015-9004 affects the Linux kernel up to version 3.18 (pre-3.19). The flaw is in kernel/events/core.c where improper handling of counter grouping enables local privilege escalation via crafted apps, involving perf_pmu_register and perf_event_open. The impact is local Privilege Escalation with...

CVE-2017-0737

The CVE-2017-0737 entry describes an elevation of privilege in Android's media framework (libstagefright) affecting Android versions 4.4.4 through 7.1.2. The vulnerability lies in the media framework and could allow a local attacker to execute code with elevated privileges in a privileged process...

CVE-2017-0557

CVE-2017-0557 is an information-disclosure vulnerability in libmpeg2 within Android’s Mediaserver. A local attacker could access data outside of the app’s permission level due to a flaw in Mediaserver’s handling of media processing. Affected Android versions include 6.0, 6.0.1, 7.0, and 7.1.1. Th...

CVE-2017-0786

CVE-2017-0786 is an elevation-of-privilege vulnerability in the Broadcom Wi‑Fi driver affecting the Android kernel. Public records in the initial description identify the affected component as the Broadcom Wi‑Fi driver within the Android kernel and describe the issue as an elevation of privilege;...

CVE-2017-13165

CVE-2017-13165 is an elevation-of-privilege vulnerability in the Android kernel file system, affecting the Android kernel (Android ID A-31269937). It is documented across multiple sources (NVD, OSV/UBUNTU-CVE/CNVD) as an EoP issue. The Pixel/Nexus security bulletin lists CVE-2017-13165 under Kern...

CVE-2017-6274

CVE-2017-6274 affects NVIDIA Tegra kernel: CORE DVFS thermal driver missing bounds checks can cause an out-of-bounds write in the kernel. Documents indicate impact as denial of service or privilege escalation. Affected products are Jetson TX1/TX2 with Linux for Tegra; remediation is to update to ...

CVE-2014-9914

Summary of CVE-2014-9914 (Linux kernel) : A race condition in ip4_datagram_release_cb within net/ipv4/datagram.c (kernel before 3.15.2) can be exploited by a local user to gain privileges or cause a denial of service (use-after-free) due to incorrect locking assumptions during multithreaded IPv4 ...

CVE-2017-0412

CVE-2017-0412 is an elevation-of-privilege vulnerability in Android Framework APIs that could let a local malicious app execute code with a privileged process. Affected: Android 7.0 and 7.1.1. Root cause involves Framework APIs enabling privilege escalation; Android patch levels 2017-02-01 / 2017...

CVE-2016-8467

CVE-2016-8467 describes a local elevation-of-privilege flaw in the Nexus bootloader that lets an attacker change the boot mode via fastboot (e.g., fastboot oem config bootmode bp-tools), thereby gaining access to the device and potentially hidden USB interfaces. The described attack alters the an...

CVE-2017-0750

CVE-2017-0750 is an elevation-of-privilege vulnerability reported for the Android kernel, tied to the upstream Linux file system. Multiple connected advisories describe an issue in the kernel’s Flash-Friendly File System (f2fs) and related kernel components that could allow a local attacker to ga...

CVE-2017-0428

CVE-2017-0428 describes an elevation-of-privilege in the NVIDIA GPU driver that could allow a local malicious application to execute arbitrary code in kernel context on Android devices with Kernel-3.10. The Android entry notes an Android ID (A-32401526) and flags the issue as critical due to pote...

CVE-2017-0714

CVE-2017-0714 is a remote code execution vulnerability in Android’s media framework h263 decoder . Affected products/versions: Android 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Root cause: vulnerability exists in decoding of H.263 files/streams, enabling arbitrary code execution. Docume...

CVE-2016-6762

CVE-2016-6762 describes an elevation-of-privilege flaw in the libziparchive library that could allow a local malicious app to run arbitrary code with the privileges of a protected process. Affected product: Android; versions affected include 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 (Android ID A-31251826). ...

CVE-2017-0599

CVE-2017-0599 is a remote denial-of-service vulnerability in Android’s Mediaserver, specifically the libhevc component. A specially crafted media file could cause a device hang or reboot. Affected products/versions in the provided documents: Android 6.0–7.1.2. The description in the connected sou...

CVE-2017-0509

CVE-2017-0509 is an elevation-of-privilege in the Broadcom Wi‑Fi driver that could let a local malicious app execute arbitrary code in the kernel. Affected product: Android. Root cause: Broadcom Wi‑Fi driver vulnerability enabling local code execution with no privileges required and user interact...

CVE-2017-0620

CVE-2017-0620 is a local elevation-of-privilege in the Qualcomm Secure Channel Manager driver on Android, allowing a malicious local app to run code in the kernel. Affected: Android devices with Kernel-3.10/3.18 (per the CVE entry). Impact per sources is High (CVSSv3: 7.0). Affected devices liste...

CVE-2017-0722

Summary of CVE-2017-0722 : A remote code execution vulnerability in the Android media framework, specifically the h263 decoder. Affected products/versions: Android devices running 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Root cause as stated in the provided documents is the vulnerabili...