2015

dhcpd buffer overrun

(json)

CVE numbers: CVE-2014-7912 [dhcpd-fix], CVE-2014-7913 [dhcpd-fix]
Coordinated disclosure?: true
Categories: network
Details: The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. [ZDI-15-093] This remote code execution vulnerability executes code as the dhcp user which limit's its severity [citation-needed]
Discovered by: Jüri Aedla [ZDI-15-093] on: 2014-11-13 [ZDI-15-093]
Reported on: 2015-03-12 [ZDI-15-093]
Fixed on: 2014-11-15 [dhcpd-fix]
Fix released on: Unknown
Affected versions: All versions below 5.1 [dhcpd-circl] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])
Affected devices: all [dhcpd-circl]
Affected manufacturers: all [dhcpd-circl]
Fixed versions: 5.1 [dhcpd-circl]
Submission: by: Laurent Simon, on: 2015-03-14; by: Daniel R. Thomas, on: 2015-03-24

pipe inatomic

(json)

CVE numbers: CVE-2015-1805 [CVE-2015-1805]
Coordinated disclosure?: true
Categories: kernel
Details: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an 'I/O vector array overrun.' [CVE-2015-1805] This is a known issue in the upstream Linux kernel that was fixed in April 2014 but wasn’t called out as a security fix and assigned CVE-2015-1805 until February 2, 2015. On February 19, 2016, C0RE Team notified Google that the issue could be exploited on Android and a patch was developed to be included in an upcoming regularly scheduled monthly update. On March 15, 2016 Google received a report from Zimperium that this vulnerability had been abused on a Nexus 5 device. Google has confirmed the existence of a publicly available rooting application that abuses this vulnerability on Nexus 5 and Nexus 6 to provide the device user with root privileges. [android-advisory-2016-03-18]
Discovered by: Red Hat [redhatbug-1202855] on: 2015-02-02 [android-advisory-2016-03-18], 2015-03-17 [redhatbug-1202855]
Reported on: 2015-06-06 [openwall-2015-06-06-2]
Fixed on: 2015-06-16 [pipe-inatomic-patch3.4]
Fix released on: Unknown
Affected versions: Kernel versions 3.4, 3.10 and 3.14 [android-advisory-2016-03-18] regex:
Affected devices: all [android-advisory-2016-03-18]
Affected manufacturers: all [citation-needed]
Fixed versions: Kernel versions from 3.18 and patched kernels [android-advisory-2016-03-18]
Submission: by: Daniel R. Thomas, on: 2016-03-21

CVE-2014-9028

(json)

CVE numbers: CVE-2014-9028 [Bulletin-CVE-2014-9028]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libFLAC
Details: Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file. [NIST-CVE-2014-9028]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2014-9028]
Fixed on: 2015-02-27 [2]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2014-9028] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2014-9028]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-8434

(json)

CVE numbers: CVE-2016-8434 [Bulletin-CVE-2016-8434]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in Qualcomm GPU driver
Details: An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32125137. References: QC-CR#1081855. [NIST-CVE-2016-8434]
Discovered by: on: Unknown
Reported on: 2017-01-01 [Bulletin-CVE-2016-8434]
Fixed on: 2015-02-27 [QC-CR#1081855]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8434]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

libmsm memory corruption

(json)

CVE numbers: CVE-2014-4321 [libmsm-github]
Coordinated disclosure?: false
Categories: system
Details: A memory read exploit that uses a vulnerability in the camera driver [android-paper]
Discovered by: Hiroyuki Ikezoe [android-paper] on: Unknown
Reported on: 2015-03-08 [libmsm-github]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers:
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-08

CVE-2015-2686

(json)

CVE numbers: CVE-2015-2686 [Bulletin-CVE-2015-2686]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel networking component
Details: net/socket.c in the Linux kernel 3.19 before 3.19.3 does not validate certain range data for (1) sendto and (2) recvfrom system calls, which allows local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface, as demonstrated by the Bluetooth subsystem. [NIST-CVE-2015-2686]
Discovered by: on: Unknown
Reported on: 2016-08-01 [Bulletin-CVE-2015-2686]
Fixed on: 2015-03-20 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-2686]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3832

(json)

CVE numbers: CVE-2015-3832 [Bulletin-CVE-2015-3832]
Coordinated disclosure?: unknown
Categories: Buffer overflows in libstagefright MPEG4Extractor.cpp
Details: Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538. [NIST-CVE-2015-3832]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3832]
Fixed on: 2015-04-01 [ANDROID-19641538]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3832] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3832]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-1538

(json)

CVE numbers: CVE-2015-1538 [Bulletin-CVE-2015-1538]
Coordinated disclosure?: unknown
Categories: Integer overflows during MP4 atom processing
Details: Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496. [NIST-CVE-2015-1538]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-1538]
Fixed on: 2015-04-08 [ANDROID-20139950]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-1538] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-1538]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-1539

(json)

CVE numbers: CVE-2015-1539 [Bulletin-CVE-2015-1539]
Coordinated disclosure?: unknown
Categories: An integer underflow in ESDS processing
Details: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493. [NIST-CVE-2015-1539]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-1539]
Fixed on: 2015-04-08 [ANDROID-20139950]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-1539] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-1539]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Stagefright

(json)

CVE numbers: CVE-2015-1538 [nakedsecurity-stagefright], CVE-2015-1539 [nakedsecurity-stagefright], CVE-2015-3824 [nakedsecurity-stagefright], CVE-2015-3826 [nakedsecurity-stagefright], CVE-2015-3827 [nakedsecurity-stagefright], CVE-2015-3828 [nakedsecurity-stagefright], CVE-2015-3829 [nakedsecurity-stagefright]
Coordinated disclosure?: true
Categories: system, network
Details: Drake said that the vulnerabilities can be exploited by sending a single multimedia text message to an unpatched Android smartphone. While the exploit is deadly, in some cases, where phones parse the attack code prior to the message being opened, the exploits are silent and the user would have little chance of defending their data. [techworm-stagefright] Stagefright is the media playback service for Android, introduced in Android 2.2 (Froyo). Stagefright in versions of Android prior to 5.1.1_r9 may contain multiple vulnerabilities, including several integer overflows, which may allow a remote attacker to execute code on the device. [cert-kb-stagefright]
Discovered by: Joshua J. Drake [zimperium-stagefright] on: 2015-04-09 [techworm-stagefright]
Reported on: 2015-07-21 [zimperium-stagefright]
Fixed on: 2015-04-08 [stagefright-fix-2]
Fix released on: 2015-08-03 [androidpolice-sprint-update]
Affected versions: 2.2-5.1.0 [cert-kb-stagefright] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])|(5.1.[0-1])
Affected devices: all [cert-kb-stagefright]
Affected manufacturers: all [cert-kb-stagefright]
Fixed versions: 5.1.1_r9 [cert-kb-stagefright]
Submission: by: Laurent Simon, on: 2015-07-27

CVE-2015-3877

(json)

CVE numbers: CVE-2015-3877 [Bulletin-CVE-2015-3877]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Skia
Details: Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696. [NIST-CVE-2015-3877]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3877]
Fixed on: 2015-04-16 [ANDROID-20723696]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3877] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3877]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2017-0604

(json)

CVE numbers: CVE-2017-0604 [Bulletin-CVE-2017-0604]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in Qualcomm power driver
Details: An elevation of privilege vulnerability in the kernel Qualcomm power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-35392981. References: QC-CR#826589. [NIST-CVE-2017-0604]
Discovered by: on: Unknown
Reported on: 2017-05-01 [Bulletin-CVE-2017-0604]
Fixed on: 2015-04-20 [QC-CR#826589]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-0604]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

Mtkfb

(json)

CVE numbers:
Coordinated disclosure?: true
Categories: system
Details: Memory write vulnerabilities allow a local user to gain privileges [mtkfb-ele7enxxh-blog]
Discovered by: KeenTeam [mtkfb-ele7enxxh-blog] on: 2015-04-30 [citation-needed]
Reported on: 2015-04-30 [citation-needed]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers:
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-08

CVE-2015-3636

(json)

CVE numbers: CVE-2015-3636 [Bulletin-CVE-2015-3636]
Coordinated disclosure?: unknown
Categories: Elevation Privilege Vulnerability in Kernel
Details: The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. [NIST-CVE-2015-3636]
Discovered by: on: Unknown
Reported on: 2015-09-01 [Bulletin-CVE-2015-3636]
Fixed on: 2015-05-02 [ANDROID-20770158]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3636] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3636]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3824

(json)

CVE numbers: CVE-2015-3824 [Bulletin-CVE-2015-3824]
Coordinated disclosure?: unknown
Categories: Integer overflow in libstagefright when parsing the MPEG4 tx3g atom
Details: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261. [NIST-CVE-2015-3824]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3824]
Fixed on: 2015-05-04 [ANDROID-20923261]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3824] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3824]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3827

(json)

CVE numbers: CVE-2015-3827 [Bulletin-CVE-2015-3827]
Coordinated disclosure?: unknown
Categories: Integer underflow in libstagefright when processing MPEG4 covr atoms
Details: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261. [NIST-CVE-2015-3827]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3827]
Fixed on: 2015-05-04 [ANDROID-20923261]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3827] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3827]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3828

(json)

CVE numbers: CVE-2015-3828 [Bulletin-CVE-2015-3828]
Coordinated disclosure?: unknown
Categories: Integer underflow in libstagefright if size is below 6 while processing 3GPP metadata
Details: The MPEG4Extractor::parse3GPPMetaData function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not enforce a minimum size for UTF-16 strings containing a Byte Order Mark (BOM), which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted 3GPP metadata, aka internal bug 20923261, a related issue to CVE-2015-3826. [NIST-CVE-2015-3828]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3828]
Fixed on: 2015-05-04 [ANDROID-20923261]
Fix released on: Unknown
Affected versions: 5.0 and above [Bulletin-CVE-2015-3828] regex: 5.[0-1].[0-9]
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3828]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3829

(json)

CVE numbers: CVE-2015-3829 [Bulletin-CVE-2015-3829]
Coordinated disclosure?: unknown
Categories: Integer overflow in libstagefright processing MPEG4 covr atoms when chunk_data_size is SIZE_MAX
Details: Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261. [NIST-CVE-2015-3829]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3829]
Fixed on: 2015-05-04 [ANDROID-20923261]
Fix released on: Unknown
Affected versions: 5.0 and above [Bulletin-CVE-2015-3829] regex: 5.[0-1].[0-9]
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3829]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3867

(json)

CVE numbers: CVE-2015-3867 [Bulletin-CVE-2015-3867]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430. [NIST-CVE-2015-3867]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3867]
Fixed on: 2015-05-08 [ANDROID-23213430]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3867] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3867]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-5706

(json)

CVE numbers: CVE-2015-5706 [Bulletin-CVE-2015-5706]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel file system
Details: Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. [NIST-CVE-2015-5706]
Discovered by: on: Unknown
Reported on: 2017-01-01 [Bulletin-CVE-2015-5706]
Fixed on: 2015-05-08 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-5706]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

PingPongRoot

(json)

CVE numbers: CVE-2015-3636 [avs-test-pingpong][archived]
Coordinated disclosure?: false
Categories:
Details: Wen Xu and wushi of KeenTeam discovered that users allowed to create ping sockets can use them to crash the system and, on 32-bit architectures, for privilege escalation. However, by default, no users on a Debian system have access to ping sockets. [dsa-3290]
Discovered by: Wen Xu and wushi of KeenTeam [dsa-3290] on: Unknown
Reported on: 2015-05-08 [xda-developers-pingpongroot]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: Samsung Galaxy S6 Edge [xda-developers-pingpongroot], HTC One (M9) [xda-developers-pingpongroot], Samsung Galaxy S6 [xda-developers-pingpongroot]
Affected manufacturers: Samsung [xda-developers-pingpongroot], HTC [xda-developers-pingpongroot]
Fixed versions: 5.0.2,5.1.1 [xda-developers-pingpongroot]
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

CVE-2015-3836

(json)

CVE numbers: CVE-2015-3836 [Bulletin-CVE-2015-3836]
Coordinated disclosure?: unknown
Categories: Buffer overflow in Sonivox Parse_wave
Details: The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860. [NIST-CVE-2015-3836]
Discovered by: on: Unknown
Reported on: 2015-08-01 [Bulletin-CVE-2015-3836]
Fixed on: 2015-05-14 [ANDROID-21132860]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3836] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3836]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Mate7 TrustZone Exploit

(json)

CVE numbers: CVE-2015-4421 [mate7-advisory][archived], CVE-2015-4422 [mate7-advisory][archived]
Coordinated disclosure?: unknown
Categories: system
Details: The tzdriver and TEEOS modules of the Huawei Mate 7 have vulnerabilities which may allow malicious apps to perform denial of service attacks, or gain privileges, by gaining access to the TEE [mate7-advisory][archived]
Discovered by: Di Shen (returnsme) [mate7-advisory][archived] on: Unknown
Reported on: 2015-05-20 [mate7-advisory][archived]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices: Huawei Mate 7 [mate7-advisory][archived]
Affected manufacturers: Huawei [mate7-advisory][archived]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-08

One class to rule them all

(json)

CVE numbers: CVE-2015-3837 [CVE-2015-3837], CVE-2015-3825 [woot15-paper-peles], ANDROID-21437603 [woot15-paper-peles], ANDROID-21583849 [woot15-paper-peles]
Coordinated disclosure?: true
Categories: system
Details: This vulnerability allows for arbitrary code execution in the context of many apps and services and results in elevation of privileges. There is a Proof-of-Concept exploit against the Google Nexus 5 device, that achieves code execution inside the highly privileged system_server process, and then either replaces an existing arbitrary application on the device with our own malware app or changes the device’s SELinux policy. For some other devices, it is also possible to gain kernel code execution by loading an arbitrary kernel modules. This vulnerability was responsibly disclosed to the Android Security Team which tagged it as CVE-2015-3825 internally as ANDROID-21437603/ANDROID-21583849 and patched Android 4.4 / 5.x / M and Google Play Services. [woot15-paper-peles] CVE-2015-3825 is the wrong CVE number (duplicate), CVE-2015-3837 should be used instead [CVE-2015-3825] The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603. [CVE-2015-3837]
Discovered by: Or Peles and Roee Hay {orpeles,roeeh}@il.ibm.com [woot15-paper-peles] on: 2015-05-22 [woot15-paper-peles]
Reported on: 2015-06-01 [NexusSecurityBulletinAugust2015][archived]
Fixed on: 2015-05-28 [OneClassPatch]
Fix released on: 2015-08-05 [droid-life-5-1-1-lmy48i][archived]
Affected versions: 4.3-5.1, M (Preview 1) [woot15-paper-peles] regex: (4.[0-3].[0-9])|(4.4.[0-4])|(5.0.[0-9])|(5.1.[0-1])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions: 4.4, 5.x, M [woot15-paper-peles]
Submission: by: Laurent Simon, on: 2015-08-10; by: Roee Hay, on: 2015-10-14

CVE-2015-6601

(json)

CVE numbers: CVE-2015-6601 [Bulletin-CVE-2015-6601]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234. [NIST-CVE-2015-6601]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6601]
Fixed on: 2015-06-04 [ANDROID-22935234]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6601] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6601]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Use-After-Free camera driver exploit

(json)

CVE numbers: CVE-2015-0568 [camera-driver-coreteam][archived]
Coordinated disclosure?: true
Categories: system
Details: A use-after-free vulnerability in the camera driver of Qualcomm MSM 7x30 SoCs [camera-driver-coreteam][archived]
Discovered by: Chiachih Wu and Yanfeng Wang [camera-driver-coreteam][archived] on: Unknown
Reported on: 2015-06-05 [camera-driver-coreteam][archived]
Fixed on: 2015-08-13 [camera-driver-coreteam][archived]
Fix released on: 2015-08-21 [camera-driver-coreteam][archived]
Affected versions: Linux kernel 3.x [nvd-camera-driver] regex:
Affected devices: All devices using Qualcomm MSM 7x30 SoCs [camera-driver-coreteam][archived]
Affected manufacturers: Qualcomm [camera-driver-coreteam][archived]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-09

CVE-2015-3870

(json)

CVE numbers: CVE-2015-3870 [Bulletin-CVE-2015-3870]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132. [NIST-CVE-2015-3870]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3870]
Fixed on: 2015-06-25 [ANDROID-22771132]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3870] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3870]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3288

(json)

CVE numbers: CVE-2015-3288 [Bulletin-CVE-2015-3288]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel memory subsystem
Details: mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero. [NIST-CVE-2015-3288]
Discovered by: on: Unknown
Reported on: 2017-01-01 [Bulletin-CVE-2015-3288]
Fixed on: 2015-07-06 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3288]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-3823

(json)

CVE numbers: CVE-2015-3823 [Bulletin-CVE-2015-3823]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999. [NIST-CVE-2015-3823]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3823]
Fixed on: 2015-07-16 [ANDROID-21335999]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3823] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3823]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Samsung WifiHs20UtilityService

(json)

CVE numbers: CVE-2015-7888 [projectzero-489]
Coordinated disclosure?: true
Categories: system
Details: A path traversal vulnerability was found in the WifiHs20UtilityService. This service is running on a Samsung S6 Edge device, and may be present on other Samsung device models. WifiHs20UtilityService reads any files placed in /sdcard/Download/cred.zip, and unzips this file into /data/bundle. Directory traversal in the path of the zipped contents allows an attacker to write a controlled file to an arbitrary path as the system user. [citation-needed]
Discovered by: Mark Brand [projectzeroblog-huntinggalaxy] on: 2015-07-29 [citation-needed]
Reported on: 2015-07-29 [citation-needed]
Fixed on: 2015-10-22 [projectzero-489]
Fix released on: Unknown
Affected versions: regex:
Affected devices: Samsung S6 Edge and may be present in other Samsung device models [projectzero-489]
Affected manufacturers: Samsung [projectzero-489]
Fixed versions:
Submission: by: Daniel R. Thomas, on: 2016-03-18; by: Stephan Kollmann, on: 2015-10-14

CVE-2015-3871

(json)

CVE numbers: CVE-2015-3871 [Bulletin-CVE-2015-3871]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033. [NIST-CVE-2015-3871]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3871]
Fixed on: 2015-08-03 [ANDROID-23031033]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3871] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3871]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6600

(json)

CVE numbers: CVE-2015-6600 [Bulletin-CVE-2015-6600]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938. [NIST-CVE-2015-6600]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6600]
Fixed on: 2015-08-04 [ANDROID-22882938]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6600] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6600]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3869

(json)

CVE numbers: CVE-2015-3869 [Bulletin-CVE-2015-3869]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083. [NIST-CVE-2015-3869]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3869]
Fixed on: 2015-08-06 [ANDROID-23036083]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3869] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3869]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6617

(json)

CVE numbers: CVE-2015-6617 [Bulletin-CVE-2015-6617]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Skia
Details: Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740. [NIST-CVE-2015-6617]
Discovered by: on: Unknown
Reported on: 2015-12-01 [Bulletin-CVE-2015-6617]
Fixed on: 2015-08-06 [ANDROID-23648740]
Fix released on: Unknown
Affected versions: 6.0 and below [Bulletin-CVE-2015-6617] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6617]
Fixed versions: 6.0 and below [Bulletin-CVE-2015-6617]
Submission: by: Daniel Carter, on: 2019-07-29

certifi-gate

(json)

CVE numbers:
Coordinated disclosure?: false
Categories: app
Details: Certifi-gate is a set of vulnerabilities in the authorization methods between mobile Remote Support Tool (mRST) apps and system-level plugs on a device. mRSTs allow remote personnel to offer customers personalized technical support for their devices by replicating a device’s screen and by simulating screen clicks at a remote console. If exploited, Certifi-gate allows malicious applications to gain unrestricted access to a device silently, elevating their privileges to allow access to the user data and perform a variety of actions usually only available to the device owner. [checkpoint-certifigate-blog][archived]
Discovered by: Check Point Software Technologies Ltd. [checkpoint-certificate-report] on: Unknown
Reported on: 2015-08-06 [checkpoint-certifigate-blog][archived]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers:
Fixed versions:
Submission: by: Laurent Simon, on: 2015-08-07; by: Daniel R. Thomas, on: 2016-06-01

CVE-2015-3864

(json)

CVE numbers: CVE-2015-3864 [Bulletin-CVE-2015-3864]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824. [NIST-CVE-2015-3864]
Discovered by: on: Unknown
Reported on: 2015-09-01 [Bulletin-CVE-2015-3864]
Fixed on: 2015-08-07 [ANDROID-23034759]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3864] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3864]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6604

(json)

CVE numbers: CVE-2015-6604 [Bulletin-CVE-2015-6604]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23129786. [NIST-CVE-2015-6604]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6604]
Fixed on: 2015-08-12 [ANDROID-23129786]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6604] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6604]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6603

(json)

CVE numbers: CVE-2015-6603 [Bulletin-CVE-2015-6603]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354. [NIST-CVE-2015-6603]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6603]
Fixed on: 2015-08-14 [ANDROID-23227354]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6603] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6603]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3876

(json)

CVE numbers: CVE-2015-3876 [Bulletin-CVE-2015-3876]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file. [NIST-CVE-2015-3876]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3876]
Fixed on: 2015-08-15 [ANDROID-23285192]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3876] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3876]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Stagefright2

(json)

CVE numbers: CVE-2015-6602 [zimperium-stagefright2], CVE-2015-3876 [android-security-october][archived]
Coordinated disclosure?: true
Categories: system, network
Details: Meet Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright). Google assigned CVE-2015-6602 to vulnerability in libutils. [zimperium-stagefright2]
Discovered by: Joshua J. Drake [zimperium-stagefright2] on: 2015-08-15 [zimperium-stagefright2]
Reported on: 2015-10-01 [zimperium-stagefright2]
Fixed on: Unknown
Fix released on: 2015-10-05 [register-stagefright2]
Affected versions: 5.1 and below [android-security-october][archived] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])|(5.1.[0-1])
Affected devices: all [zimperium-stagefright2]
Affected manufacturers: all [zimperium-stagefright2]
Fixed versions: 5.1.1, LMY48T or later, LMY48W [android-security-october][archived]
Submission: by: Daniel R. Thomas, on: 2015-10-06; by: Laurent Simon, on: 2015-10-02; by: Alastair R. Beresford, on: 2015-10-01

CVE-2015-3868

(json)

CVE numbers: CVE-2015-3868 [Bulletin-CVE-2015-3868]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724. [NIST-CVE-2015-3868]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3868]
Fixed on: 2015-08-18 [ANDROID-23270724]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3868] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3868]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3873

(json)

CVE numbers: CVE-2015-3873 [Bulletin-CVE-2015-3873]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716. [NIST-CVE-2015-3873]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3873]
Fixed on: 2015-08-18 [ANDROID-23247055]
Fix released on: Unknown
Affected versions: 5.1 and below, 5.0 and 5.1 [Bulletin-CVE-2015-3873] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3873]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3875

(json)

CVE numbers: CVE-2015-3875 [Bulletin-CVE-2015-3875]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libutils
Details: libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485. [NIST-CVE-2015-3875]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3875]
Fixed on: 2015-08-18 [ANDROID-22952485]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3875] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3875]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6598

(json)

CVE numbers: CVE-2015-6598 [Bulletin-CVE-2015-6598]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638. [NIST-CVE-2015-6598]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6598]
Fixed on: 2015-08-18 [ANDROID-23306638]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6598] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6598]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3872

(json)

CVE numbers: CVE-2015-3872 [Bulletin-CVE-2015-3872]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388. [NIST-CVE-2015-3872]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3872]
Fixed on: 2015-08-19 [ANDROID-23346388]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3872] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3872]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6602

(json)

CVE numbers: CVE-2015-6602 [Bulletin-CVE-2015-6602]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libutils
Details: libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x. [NIST-CVE-2015-6602]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6602]
Fixed on: 2015-08-20 [ANDROID-23290056]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6602] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6602]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3874

(json)

CVE numbers: CVE-2015-3874 [Bulletin-CVE-2015-3874]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in Sonivox
Details: The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323. [NIST-CVE-2015-3874]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-3874]
Fixed on: 2015-08-21 [2]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-3874] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-3874]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6599

(json)

CVE numbers: CVE-2015-6599 [Bulletin-CVE-2015-6599]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in libstagefright
Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608. [NIST-CVE-2015-6599]
Discovered by: on: Unknown
Reported on: 2015-10-01 [Bulletin-CVE-2015-6599]
Fixed on: 2015-08-21 [ANDROID-23416608]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6599] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6599]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6609

(json)

CVE numbers: CVE-2015-6609 [Bulletin-CVE-2015-6609]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in libutils
Details: libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624. [NIST-CVE-2015-6609]
Discovered by: on: Unknown
Reported on: 2015-11-01 [Bulletin-CVE-2015-6609]
Fixed on: 2015-09-02 [ANDROID-22953624]
Fix released on: Unknown
Affected versions: 6.0 and below [Bulletin-CVE-2015-6609] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6609]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6608

(json)

CVE numbers: CVE-2015-6608 [Bulletin-CVE-2015-6608]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in Mediaserver
Details: mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574, 23680780, 23876444, and 23658148, a different vulnerability than CVE-2015-8072 and CVE-2015-8073. [NIST-CVE-2015-6608]
Discovered by: on: Unknown
Reported on: 2015-11-01 [Bulletin-CVE-2015-6608]
Fixed on: 2015-09-08 [ANDROID-23876444]
Fix released on: Unknown
Affected versions: 5.0, 5.1, 6.0, 4.4, 5.0, 5.1, 6.0, 4.4 and 5.1, 5.0, 5.1, 6.0 [Bulletin-CVE-2015-6608] regex: (5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])|(4.4.[0-9])|(5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])|(4.4.[0-9])|(5.1.[0-9])|(5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6608]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-8892

(json)

CVE numbers: CVE-2015-8892 [Bulletin-CVE-2015-8892]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in Qualcomm components
Details: platform/msm_shared/boot_verifier.c in the Qualcomm components in Android before 2016-07-05 on Nexus 5X and 6P devices allows attackers to bypass intended access restrictions via a digest with trailing data, aka Android internal bug 28822807 and Qualcomm internal bug CR902998. [NIST-CVE-2015-8892]
Discovered by: on: Unknown
Reported on: 2016-07-01 [Bulletin-CVE-2015-8892]
Fixed on: 2015-09-08 [QC-CR902998]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8892]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

Metaphor

(json)

CVE numbers: CVE-2015-3864 [metaphor-avast]
Coordinated disclosure?: true
Categories: system
Details: A remote-access exploit that uses a vulnerability in libstagefright [metaphor-report][archived]
Discovered by: Hanan Be’er [metaphor-report][archived] on: Unknown
Reported on: Unknown
Fixed on: Unknown
Fix released on: 2015-09-09 [metaphor-bulletin][archived]
Affected versions: 2.2 to 4.0 and 5.0 to 5.1 [metaphor-report][archived] regex: (2.[2-9].[0-9])|(3.[0-9].[0-9])|(4.0.[0-9])|(5.[0-1].[0-9])
Affected devices: all [citation-needed]
Affected manufacturers: all [citation-needed]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-09

CVE-2015-6619

(json)

CVE numbers: CVE-2015-6619 [Bulletin-CVE-2015-6619]
Coordinated disclosure?: unknown
Categories: Elevation of Privilege in Kernel
Details: The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714. [NIST-CVE-2015-6619]
Discovered by: on: Unknown
Reported on: 2015-12-01 [Bulletin-CVE-2015-6619]
Fixed on: 2015-09-22 [ANDROID-23520714]
Fix released on: Unknown
Affected versions: 6.0 and below [Bulletin-CVE-2015-6619] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6619]
Fixed versions: 6.0 and below [Bulletin-CVE-2015-6619]
Submission: by: Daniel Carter, on: 2019-07-29

QSEE privilege escalation

(json)

CVE numbers: CVE-2015-6639 [qsee-blog][archived]
Coordinated disclosure?: true
Categories: system
Details: A vulnerability in the driver for Qualcomm's Trusted Excecution Environment allows code execution in this environment [qsee-blog][archived]
Discovered by: Gal Beniamini (laginimaineb) [qsee-blog][archived] on: Unknown
Reported on: 2015-09-27 [qsee-blog][archived]
Fixed on: 2015-12-14 [qsee-blog][archived]
Fix released on: 2015-12-14 [qsee-blog][archived]
Affected versions: 5.0-5.1.1 and 6.0 [cvedetails-qsee] regex: (5.0.[0-9])|(5.1.[0-1])|(6.0.[0-9])
Affected devices: Several, including Droid Turbo, Nexus 6 and Moto X 2nd Gen [qsee-blog][archived]
Affected manufacturers: Qualcomm [qsee-blog][archived]
Fixed versions: 5.1.1 LMY94F, 6.0 [cvedetails-qsee]
Submission: by: Daniel Carter, on: 2019-07-09

CVE-2015-6616

(json)

CVE numbers: CVE-2015-6616 [Bulletin-CVE-2015-6616]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in Mediaserver
Details: mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and 23882800, a different vulnerability than CVE-2015-8505, CVE-2015-8506, and CVE-2015-8507. [NIST-CVE-2015-6616]
Discovered by: on: Unknown
Reported on: 2015-12-01 [Bulletin-CVE-2015-6616]
Fixed on: 2015-10-05 [ANDROID-24630158]
Fix released on: Unknown
Affected versions: 6.0 and below, 5.1 and below, 6.0 and below, 6.0 [Bulletin-CVE-2015-6616] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6616]
Fixed versions: 6.0 and below, 5.1 and below, 6.0 and below, 6.0 [Bulletin-CVE-2015-6616]
Submission: by: Daniel Carter, on: 2019-07-29

Qualcomm TrustZone

(json)

CVE numbers: CVE-2016-2431 [trustzone-blog][archived]
Coordinated disclosure?: true
Categories: kernel
Details: An exploit which allows code execution within the TrustZone kernel. This may allow capturing of secret keys, disabling of hardware protection and unlocking locked bootloaders [trustzone-blog][archived]
Discovered by: Gal Beniamini (laginimaineb) [trustzone-blog][archived] on: Unknown
Reported on: 2015-10-13 [trustzone-blog][archived]
Fixed on: 2016-05-02 [trustzone-blog][archived]
Fix released on: 2016-05-02 [trustzone-blog][archived]
Affected versions: 6.0.1 [cvedetails-qualcomm-trustzone] regex:
Affected devices: Many devices using Qualcomm SoCs, including Nexus 5, Nexus 6 and Nexus 7 (2013) [trustzone-bulletin]
Affected manufacturers: Qualcomm [trustzone-bulletin]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-09

CVE-2015-6634

(json)

CVE numbers: CVE-2015-6634 [Bulletin-CVE-2015-6634]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in Display Driver
Details: The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261. [NIST-CVE-2015-6634]
Discovered by: on: Unknown
Reported on: 2015-12-01 [Bulletin-CVE-2015-6634]
Fixed on: 2015-10-16 [ANDROID-24163261]
Fix released on: Unknown
Affected versions: 5.1 and below [Bulletin-CVE-2015-6634] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6634]
Fixed versions: 5.1 and below [Bulletin-CVE-2015-6634]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-8961

(json)

CVE numbers: CVE-2015-8961 [Bulletin-CVE-2015-8961]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel file system
Details: The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field. [NIST-CVE-2015-8961]
Discovered by: on: Unknown
Reported on: 2016-11-01 [Bulletin-CVE-2015-8961]
Fixed on: 2015-10-17 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-8961]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0804

(json)

CVE numbers: CVE-2016-0804 [Bulletin-CVE-2016-0804]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: The NuPlayer::GenericSource::notifyPreparedAndCleanup function in media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 5.x before 5.1.1 LMY49G and 6.x before 2016-02-01 improperly manages mDrmManagerClient objects, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25070434. [NIST-CVE-2016-0804]
Discovered by: on: Unknown
Reported on: 2016-02-01 [Bulletin-CVE-2016-0804]
Fixed on: 2015-10-19 [ANDROID-25070434]
Fix released on: Unknown
Affected versions: 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0804] regex: (5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0804]
Fixed versions: 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0804]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0807

(json)

CVE numbers: CVE-2016-0807 [Bulletin-CVE-2016-0807]
Coordinated disclosure?: unknown
Categories: Elevation of Privilege Vulnerability in the Debuggerd
Details: The get_build_id function in elf_utils.cpp in Debuggerd in Android 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application that mishandles a Desc Size element in an ELF Note, aka internal bug 25187394. [NIST-CVE-2016-0807]
Discovered by: on: Unknown
Reported on: 2016-02-01 [Bulletin-CVE-2016-0807]
Fixed on: 2015-10-22 [ANDROID-25187394]
Fix released on: Unknown
Affected versions: 6.0 and 6.0.1 [Bulletin-CVE-2016-0807] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0807]
Fixed versions: 6.0 and 6.0.1 [Bulletin-CVE-2016-0807]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6636

(json)

CVE numbers: CVE-2015-6636 [Bulletin-CVE-2015-6636]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: mediaserver in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 25070493 and 24686670. [NIST-CVE-2015-6636]
Discovered by: on: Unknown
Reported on: 2016-01-01 [Bulletin-CVE-2015-6636]
Fixed on: 2015-10-27 [ANDROID-25070493]
Fix released on: Unknown
Affected versions: 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-6636] regex: (5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6636]
Fixed versions: 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-6636]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-8962

(json)

CVE numbers: CVE-2015-8962 [Bulletin-CVE-2015-8962]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel SCSI driver
Details: Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call. [NIST-CVE-2015-8962]
Discovered by: on: Unknown
Reported on: 2016-11-01 [Bulletin-CVE-2015-8962]
Fixed on: 2015-10-30 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-8962]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2013-7446

(json)

CVE numbers: CVE-2013-7446 [Bulletin-CVE-2013-7446]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel networking subsystem
Details: Use-after-free vulnerability in net/unix/af_unix.c in the Linux kernel before 4.3.3 allows local users to bypass intended AF_UNIX socket permissions or cause a denial of service (panic) via crafted epoll_ctl calls. [NIST-CVE-2013-7446]
Discovered by: on: Unknown
Reported on: 2016-09-01 [Bulletin-CVE-2013-7446]
Fixed on: 2015-11-20 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2013-7446]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0803

(json)

CVE numbers: CVE-2016-0803 [Bulletin-CVE-2016-0803]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794. [NIST-CVE-2016-0803]
Discovered by: on: Unknown
Reported on: 2016-02-01 [Bulletin-CVE-2016-0803]
Fixed on: 2015-11-20 [ANDROID-25812794]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0803] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0803]
Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0803]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0836

(json)

CVE numbers: CVE-2016-0836 [Bulletin-CVE-2016-0836]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: Stack-based buffer overflow in decoder/impeg2d_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25812590. [NIST-CVE-2016-0836]
Discovered by: on: Unknown
Reported on: 2016-04-02 [Bulletin-CVE-2016-0836]
Fixed on: 2015-11-24 [ANDROID-25812590]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0836] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0836]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0836]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3841

(json)

CVE numbers: CVE-2016-3841 [Bulletin-CVE-2016-3841]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel networking component
Details: The IPv6 stack in the Linux kernel before 4.3.3 mishandles options data, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) via a crafted sendmsg system call. [NIST-CVE-2016-3841]
Discovered by: on: Unknown
Reported on: 2016-08-01 [Bulletin-CVE-2016-3841]
Fixed on: 2015-11-29 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-3841]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0801

(json)

CVE numbers: CVE-2016-0801 [Bulletin-CVE-2016-0801]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Broadcom Wi-Fi Driver
Details: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029. [NIST-CVE-2016-0801]
Discovered by: on: Unknown
Reported on: 2016-02-01 [Bulletin-CVE-2016-0801]
Fixed on: 2015-11-30 [ANDROID-25662029]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0801] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: Broadcom [Bulletin-CVE-2016-0801]
Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0801]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6633

(json)

CVE numbers: CVE-2015-6633 [Bulletin-CVE-2015-6633]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerabilities in Display Driver
Details: The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307. [NIST-CVE-2015-6633]
Discovered by: on: Unknown
Reported on: 2015-12-01 [Bulletin-CVE-2015-6633]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: 6.0 and below [Bulletin-CVE-2015-6633] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-6633]
Fixed versions: 6.0 and below [Bulletin-CVE-2015-6633]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0839

(json)

CVE numbers: CVE-2016-0839 [Bulletin-CVE-2016-0839]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: post_proc/volume_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25753245. [NIST-CVE-2016-0839]
Discovered by: on: Unknown
Reported on: 2016-04-02 [Bulletin-CVE-2016-0839]
Fixed on: 2015-12-03 [ANDROID-25753245]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0839] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0839]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0839]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0842

(json)

CVE numbers: CVE-2016-0842 [Bulletin-CVE-2016-0842]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in libstagefright
Details: The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 25818142. [NIST-CVE-2016-0842]
Discovered by: on: Unknown
Reported on: 2016-04-02 [Bulletin-CVE-2016-0842]
Fixed on: 2015-12-04 [ANDROID-25818142]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0842] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0842]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0842]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0802

(json)

CVE numbers: CVE-2016-0802 [Bulletin-CVE-2016-0802]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Broadcom Wi-Fi Driver
Details: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25306181. [NIST-CVE-2016-0802]
Discovered by: on: Unknown
Reported on: 2016-02-01 [Bulletin-CVE-2016-0802]
Fixed on: 2015-12-09 [ANDROID-25306181]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0802] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: Broadcom [Bulletin-CVE-2016-0802]
Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0802]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2017-0470

(json)

CVE numbers: CVE-2017-0470 [Bulletin-CVE-2017-0470]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in Mediaserver
Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33818500. [NIST-CVE-2017-0470]
Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0470] on: Unknown
Reported on: 2017-03-01 [Bulletin-CVE-2017-0470]
Fixed on: 2015-12-18 [A-33818500]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2017-0470]
Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470]
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-0818

(json)

CVE numbers: CVE-2016-0818 [Bulletin-CVE-2016-0818]
Coordinated disclosure?: unknown
Categories: Elevation of Privilege in Conscrypt
Details: The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830. [NIST-CVE-2016-0818]
Discovered by: on: Unknown
Reported on: 2016-03-01 [Bulletin-CVE-2016-0818]
Fixed on: 2015-12-20 [[2]]
Fix released on: Unknown
Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0818] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0818]
Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0818]
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-8966

(json)

CVE numbers: CVE-2015-8966 [Bulletin-CVE-2015-8966]
Coordinated disclosure?: unknown
Categories: Elevation of privilege vulnerability in kernel
Details: arch/arm/kernel/sys_oabi-compat.c in the Linux kernel before 4.4 allows local users to gain privileges via a crafted (1) F_OFD_GETLK, (2) F_OFD_SETLK, or (3) F_OFD_SETLKW command in an fcntl64 system call. [NIST-CVE-2015-8966]
Discovered by: on: Unknown
Reported on: 2016-12-01 [Bulletin-CVE-2015-8966]
Fixed on: 2015-12-28 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2015-8966]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-10229

(json)

CVE numbers: CVE-2016-10229 [Bulletin-CVE-2016-10229]
Coordinated disclosure?: unknown
Categories: Remote code execution vulnerability in kernel networking subsystem
Details: udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag. [NIST-CVE-2016-10229]
Discovered by: on: Unknown
Reported on: 2017-04-01 [Bulletin-CVE-2016-10229]
Fixed on: 2015-12-30 [Upstream kernel]
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-10229]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-0835

(json)

CVE numbers: CVE-2016-0835 [Bulletin-CVE-2016-0835]
Coordinated disclosure?: unknown
Categories: Remote Code Execution Vulnerability in Mediaserver
Details: decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a certain negative value, aka internal bug 26070014. [NIST-CVE-2016-0835]
Discovered by: on: Unknown
Reported on: 2016-04-02 [Bulletin-CVE-2016-0835]
Fixed on: 2015-12-31 [ANDROID-26070014]
Fix released on: Unknown
Affected versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0835] regex: (6.0.[0-9])|(6.0.1)
Affected devices:
Affected manufacturers: all [Bulletin-CVE-2016-0835]
Fixed versions: 6.0, 6.0.1 [Bulletin-CVE-2016-0835]
Submission: by: Daniel Carter, on: 2019-07-29