Back to all years

2017

CVE-2014-9914

(json)

• CVE numbers: CVE-2014-9914 [Bulletin-CVE-2014-9914]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel networking subsystem
• Details: Race condition in the ip4_datagram_release_cb function in net/ipv4/datagram.c in the Linux kernel before 3.15.2 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging incorrect expectations about locking during multithreaded access to internal data structures for IPv4 UDP sockets. [NIST-CVE-2014-9914]
• Discovered by: on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2014-9914]
• Fixed on: 2014-06-10 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2014-9914]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8434

(json)

• CVE numbers: CVE-2016-8434 [Bulletin-CVE-2016-8434]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm GPU driver
• Details: An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32125137. References: QC-CR#1081855. [NIST-CVE-2016-8434]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8434]
• Fixed on: 2015-02-27 [QC-CR#1081855]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8434]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0604

(json)

• CVE numbers: CVE-2017-0604 [Bulletin-CVE-2017-0604]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm power driver
• Details: An elevation of privilege vulnerability in the kernel Qualcomm power driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-35392981. References: QC-CR#826589. [NIST-CVE-2017-0604]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0604]
• Fixed on: 2015-04-20 [QC-CR#826589]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-0604]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-5706

(json)

• CVE numbers: CVE-2015-5706 [Bulletin-CVE-2015-5706]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel file system
• Details: Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation. [NIST-CVE-2015-5706]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2015-5706]
• Fixed on: 2015-05-08 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-5706]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-3288

(json)

• CVE numbers: CVE-2015-3288 [Bulletin-CVE-2015-3288]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel memory subsystem
• Details: mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero. [NIST-CVE-2015-3288]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2015-3288]
• Fixed on: 2015-07-06 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3288]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0470

(json)

• CVE numbers: CVE-2017-0470 [Bulletin-CVE-2017-0470]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33818500. [NIST-CVE-2017-0470]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0470] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0470]
• Fixed on: 2015-12-18 [A-33818500]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0470]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0470]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10229

(json)

• CVE numbers: CVE-2016-10229 [Bulletin-CVE-2016-10229]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in kernel networking subsystem
• Details: udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checksum calculation during execution of a recv system call with the MSG_PEEK flag. [NIST-CVE-2016-10229]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2016-10229]
• Fixed on: 2015-12-30 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-10229]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8422

(json)

• CVE numbers: CVE-2016-8422 [Bulletin-CVE-2016-8422]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm bootloader
• Details: An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-31471220. References: QC-CR#979426. [NIST-CVE-2016-8422]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8422]
• Fixed on: 2016-03-18 [QC-CR#979426]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8422]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8423

(json)

• CVE numbers: CVE-2016-8423 [Bulletin-CVE-2016-8423]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm bootloader
• Details: An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-31399736. References: QC-CR#1000546. [NIST-CVE-2016-8423]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8423]
• Fixed on: 2016-05-04 [QC-CR#1000546]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8423]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8436

(json)

• CVE numbers: CVE-2016-8436 [Bulletin-CVE-2016-8436]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm video driver
• Details: An elevation of privilege vulnerability in the Qualcomm video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-32450261. References: QC-CR#1007860. [NIST-CVE-2016-8436]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8436]
• Fixed on: 2016-05-12 [QC-CR#1007860]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8436]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-9806

(json)

• CVE numbers: CVE-2016-9806 [Bulletin-CVE-2016-9806]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel networking subsystem
• Details: Race condition in the netlink_dump function in net/netlink/af_netlink.c in the Linux kernel before 4.6.3 allows local users to cause a denial of service (double free) or possibly have unspecified other impact via a crafted application that makes sendmsg system calls, leading to a free operation associated with a new dump that started earlier than anticipated. [NIST-CVE-2016-9806]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-9806]
• Fixed on: 2016-05-16 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-9806]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0587

(json)

• CVE numbers: CVE-2017-0587 [Bulletin-CVE-2017-0587]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libmpeg2 in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35219737. [NIST-CVE-2017-0587]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0587] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0587]
• Fixed on: 2016-06-01 [A-35219737]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0587] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0587]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0587]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10275

(json)

• CVE numbers: CVE-2016-10275 [Bulletin-CVE-2016-10275]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm bootloader
• Details: An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-34514954. References: QC-CR#1009111. [NIST-CVE-2016-10275]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10275]
• Fixed on: 2016-07-05 [QC-CR#1009111]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10275]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-2182

(json)

• CVE numbers: CVE-2016-2182 [Bulletin-CVE-2016-2182]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in OpenSSL & BoringSSL
• Details: The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. [NIST-CVE-2016-2182]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-2182]
• Fixed on: 2016-08-22 [A-32096880]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2016-2182] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2182]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2016-2182]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-3706

(json)

• CVE numbers: CVE-2016-3706 [Bulletin-CVE-2016-3706]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: Stack-based buffer overflow in the getaddrinfo function in sysdeps/posix/getaddrinfo.c in the GNU C Library (aka glibc or libc6) allows remote attackers to cause a denial of service (crash) via vectors involving hostent conversion. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-4458. [NIST-CVE-2016-3706]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2016-3706]
• Fixed on: 2016-09-09 [QC-CR#1058691]
• Fix released on: 2017-12-05 [Bulletin-CVE-2016-3706]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-3706]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-4429

(json)

• CVE numbers: CVE-2016-4429 [Bulletin-CVE-2016-4429]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: Stack-based buffer overflow in the clntudp_call function in sunrpc/clnt_udp.c in the GNU C Library (aka glibc or libc6) allows remote servers to cause a denial of service (crash) or possibly unspecified other impact via a flood of crafted ICMP and UDP packets. [NIST-CVE-2016-4429]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2016-4429]
• Fixed on: 2016-09-09 [QC-CR#1058691]
• Fix released on: 2017-12-05 [Bulletin-CVE-2016-4429]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-4429]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8418

(json)

• CVE numbers: CVE-2016-8418 [Bulletin-CVE-2016-8418]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Qualcomm crypto driver
• Details: A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of remote code execution in the context of the kernel. Product: Android. Versions: N/A. Android ID: A-32652894. References: QC-CR#1077457. [NIST-CVE-2016-8418]
• Discovered by: Seven Shen (@lingtongshen) of Trend Micro Mobile Threat Research Team [Discovery-CVE-2016-8418] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2016-8418]
• Fixed on: 2016-10-24 [QC-CR#1077457]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8418]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0592

(json)

• CVE numbers: CVE-2017-0592 [Bulletin-CVE-2017-0592]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34970788. [NIST-CVE-2017-0592]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0592]
• Fixed on: 2016-10-24 [A-34970788]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0592]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10200

(json)

• CVE numbers: CVE-2016-10200 [Bulletin-CVE-2016-10200]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel networking subsystem
• Details: Race condition in the L2TPv3 IP Encapsulation feature in the Linux kernel before 4.8.14 allows local users to gain privileges or cause a denial of service (use-after-free) by making multiple bind system calls without properly ascertaining whether a socket has the SOCK_ZAPPED status, related to net/l2tp/l2tp_ip.c and net/l2tp/l2tp_ip6.c. [NIST-CVE-2016-10200]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-10200]
• Fixed on: 2016-11-18 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-10200]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0406

(json)

• CVE numbers: CVE-2017-0406 [Bulletin-CVE-2017-0406]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32915871. [NIST-CVE-2017-0406]
• Discovered by: Zhixin Li of NSFocus [Discovery-CVE-2017-0406] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0406]
• Fixed on: 2016-11-18 [2]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0406] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0406]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0406]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0407

(json)

• CVE numbers: CVE-2017-0407 [Bulletin-CVE-2017-0407]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. This affects the libhevc library. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-32873375. [NIST-CVE-2017-0407]
• Discovered by: Weichao Sun (@sunblate) of Alibaba Inc. [Discovery-CVE-2017-0407] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0407]
• Fixed on: 2016-11-25 [A-32873375]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0407] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0407]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0407]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10230

(json)

• CVE numbers: CVE-2016-10230 [Bulletin-CVE-2016-10230]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Qualcomm crypto engine driver
• Details: A remote code execution vulnerability in the Qualcomm crypto driver. Product: Android. Versions: Android kernel. Android ID: A-34389927. References: QC-CR#1091408. [NIST-CVE-2016-10230]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2016-10230]
• Fixed on: 2016-11-28 [QC-CR#1091408]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10230]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0474

(json)

• CVE numbers: CVE-2017-0474 [Bulletin-CVE-2017-0474]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-32589224. [NIST-CVE-2017-0474]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0474]
• Fixed on: 2016-11-29 [A-32589224]
• Fix released on: Unknown
• Affected versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0474] regex: (7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0474]
• Fixed versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0474]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10276

(json)

• CVE numbers: CVE-2016-10276 [Bulletin-CVE-2016-10276]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm bootloader
• Details: An elevation of privilege vulnerability in the Qualcomm bootloader could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32952839. References: QC-CR#1094105. [NIST-CVE-2016-10276]
• Discovered by: Yang Cheng of Xiaomi Inc. [Discovery-CVE-2016-10276] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10276]
• Fixed on: 2016-12-02 [QC-CR#1094105]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10276]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0405

(json)

• CVE numbers: CVE-2017-0405 [Bulletin-CVE-2017-0405]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Surfaceflinger
• Details: A remote code execution vulnerability in Surfaceflinger could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Surfaceflinger process. Product: Android. Versions: 7.0, 7.1.1. Android ID: A-31960359. [NIST-CVE-2017-0405]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2017-0405] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0405]
• Fixed on: 2016-12-05 [A-31960359]
• Fix released on: Unknown
• Affected versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0405] regex: (7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0405]
• Fixed versions: 7.0, 7.1.1 [Bulletin-CVE-2017-0405]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-9794

(json)

• CVE numbers: CVE-2016-9794 [Bulletin-CVE-2016-9794]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel sound subsystem
• Details: Race condition in the snd_pcm_period_elapsed function in sound/core/pcm_lib.c in the ALSA subsystem in the Linux kernel before 4.7 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted SNDRV_PCM_TRIGGER_START command. [NIST-CVE-2016-9794]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-9794]
• Fixed on: 2016-12-12 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-9794]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0543

(json)

• CVE numbers: CVE-2017-0543 [Bulletin-CVE-2017-0543]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34097866. [NIST-CVE-2017-0543]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0543]
• Fixed on: 2016-12-15 [A-34097866]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0543] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0543]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0543]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0591

(json)

• CVE numbers: CVE-2017-0591 [Bulletin-CVE-2017-0591]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34097672. [NIST-CVE-2017-0591]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0591]
• Fixed on: 2016-12-15 [A-34097672]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0591] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0591]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0591]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0475

(json)

• CVE numbers: CVE-2017-0475 [Bulletin-CVE-2017-0475]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in recovery verifier
• Details: An elevation of privilege vulnerability in the recovery verifier could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31914369. [NIST-CVE-2017-0475]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0475] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0475]
• Fixed on: 2016-12-16 [A-31914369]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0475] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0475]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0475]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0466

(json)

• CVE numbers: CVE-2017-0466 [Bulletin-CVE-2017-0466]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33139050. [NIST-CVE-2017-0466]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0466] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0466]
• Fixed on: 2016-12-20 [A-33139050]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0466] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0466]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0466]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0467

(json)

• CVE numbers: CVE-2017-0467 [Bulletin-CVE-2017-0467]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33250932. [NIST-CVE-2017-0467]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0467] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0467]
• Fixed on: 2016-12-20 [A-33250932]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0467] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0467]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0467]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0468

(json)

• CVE numbers: CVE-2017-0468 [Bulletin-CVE-2017-0468]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33351708. [NIST-CVE-2017-0468]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0468] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0468]
• Fixed on: 2016-12-20 [A-33351708]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0468] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0468]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0468]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0542

(json)

• CVE numbers: CVE-2017-0542 [Bulletin-CVE-2017-0542]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33934721. [NIST-CVE-2017-0542]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0542]
• Fixed on: 2016-12-23 [A-33934721]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0542] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0542]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0542]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0469

(json)

• CVE numbers: CVE-2017-0469 [Bulletin-CVE-2017-0469]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33450635. [NIST-CVE-2017-0469]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0469] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0469]
• Fixed on: 2016-12-27 [A-33450635]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0469] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0469]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0469]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0673

(json)

• CVE numbers: CVE-2017-0673 [Bulletin-CVE-2017-0673]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-33974623. [NIST-CVE-2017-0673]
• Discovered by: on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0673]
• Fixed on: 2016-12-30 [A-33974623]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0673] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0673]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0673]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8424

(json)

• CVE numbers: CVE-2016-8424 [Bulletin-CVE-2016-8424]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-31606947. References: N-CVE-2016-8424. [NIST-CVE-2016-8424]
• Discovered by: Peter Pi (@heisecode) of Trend Micro [Discovery-CVE-2016-8424] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8424]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8424]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8425

(json)

• CVE numbers: CVE-2016-8425 [Bulletin-CVE-2016-8425]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-31797770. References: N-CVE-2016-8425. [NIST-CVE-2016-8425]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8425] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8425]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8425]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8426

(json)

• CVE numbers: CVE-2016-8426 [Bulletin-CVE-2016-8426]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-31799206. References: N-CVE-2016-8426. [NIST-CVE-2016-8426]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8426] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8426]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8426]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8427

(json)

• CVE numbers: CVE-2016-8427 [Bulletin-CVE-2016-8427]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-31799885. References: N-CVE-2016-8427. [NIST-CVE-2016-8427]
• Discovered by: Di Shen (@returnsme) of KeenLab (@keen_lab), Tencent [Discovery-CVE-2016-8427] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8427]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8427]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8428

(json)

• CVE numbers: CVE-2016-8428 [Bulletin-CVE-2016-8428]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-31993456. References: N-CVE-2016-8428. [NIST-CVE-2016-8428]
• Discovered by: Peter Pi (@heisecode) of Trend Micro [Discovery-CVE-2016-8428] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8428]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8428]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8429

(json)

• CVE numbers: CVE-2016-8429 [Bulletin-CVE-2016-8429]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32160775. References: N-CVE-2016-8429. [NIST-CVE-2016-8429]
• Discovered by: Peter Pi (@heisecode) of Trend Micro [Discovery-CVE-2016-8429] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8429]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8429]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8430

(json)

• CVE numbers: CVE-2016-8430 [Bulletin-CVE-2016-8430]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32225180. References: N-CVE-2016-8430. [NIST-CVE-2016-8430]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8430] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8430]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8430]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8431

(json)

• CVE numbers: CVE-2016-8431 [Bulletin-CVE-2016-8431]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-32402179. References: N-CVE-2016-8431. [NIST-CVE-2016-8431]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8431] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8431]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8431]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8432

(json)

• CVE numbers: CVE-2016-8432 [Bulletin-CVE-2016-8432]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-32447738. References: N-CVE-2016-8432. [NIST-CVE-2016-8432]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8432] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8432]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8432]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8433

(json)

• CVE numbers: CVE-2016-8433 [Bulletin-CVE-2016-8433]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek driver
• Details: An elevation of privilege vulnerability in the MediaTek driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-31750190. References: MT-ALPS02974192. [NIST-CVE-2016-8433]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8433]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2016-8433]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8435

(json)

• CVE numbers: CVE-2016-8435 [Bulletin-CVE-2016-8435]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-32700935. References: N-CVE-2016-8435. [NIST-CVE-2016-8435]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8435] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8435]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8435]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8438

(json)

• CVE numbers: CVE-2016-8438 [Bulletin-CVE-2016-8438]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: Integer overflow leading to a TOCTOU condition in hypervisor PIL. An integer overflow exposes a race condition that may be used to bypass (Peripheral Image Loader) PIL authentication. Product: Android. Versions: Kernel 3.18. Android ID: A-31624565. References: QC-CR#1023638. [NIST-CVE-2016-8438]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8438]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8438]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-8442

(json)

• CVE numbers: CVE-2016-8442 [Bulletin-CVE-2016-8442]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: Possible unauthorized memory access in the hypervisor. Lack of input validation could allow hypervisor memory to be accessed by the HLOS. Product: Android. Versions: Kernel 3.18. Android ID: A-31625910. QC-CR#1038173. [NIST-CVE-2016-8442]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8442]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8442]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-8443

(json)

• CVE numbers: CVE-2016-8443 [Bulletin-CVE-2016-8443]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: Possible unauthorized memory access in the hypervisor. Incorrect configuration provides access to subsystem page tables. Product: Android. Versions: Kernel 3.18. Android ID: A-32576499. References: QC-CR#964185. [NIST-CVE-2016-8443]
• Discovered by: on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8443]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8443]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-8482

(json)

• CVE numbers: CVE-2016-8482 [Bulletin-CVE-2016-8482]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver. Product: Android. Versions: Android kernel. Android ID: A-31799863. References: N-CVE-2016-8482. [NIST-CVE-2016-8482]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8482] on: Unknown
• Reported on: 2017-01-01 [Bulletin-CVE-2016-8482]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2016-8482]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0538

(json)

• CVE numbers: CVE-2017-0538 [Bulletin-CVE-2017-0538]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libavc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33641588. [NIST-CVE-2017-0538]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0538] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0538]
• Fixed on: 2017-01-05 [A-33641588]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0538] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0538]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0538]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0471

(json)

• CVE numbers: CVE-2017-0471 [Bulletin-CVE-2017-0471]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33816782. [NIST-CVE-2017-0471]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0471] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0471]
• Fixed on: 2017-01-13 [A-33816782]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0471] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0471]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0471]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0472

(json)

• CVE numbers: CVE-2017-0472 [Bulletin-CVE-2017-0472]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33862021. [NIST-CVE-2017-0472]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0472] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0472]
• Fixed on: 2017-01-13 [A-33862021]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0472] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0472]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0472]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0539

(json)

• CVE numbers: CVE-2017-0539 [Bulletin-CVE-2017-0539]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33864300. [NIST-CVE-2017-0539]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0539] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0539]
• Fixed on: 2017-01-13 [A-33864300]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0539] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0539]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0539]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0590

(json)

• CVE numbers: CVE-2017-0590 [Bulletin-CVE-2017-0590]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35039946. [NIST-CVE-2017-0590]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0590] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0590]
• Fixed on: 2017-01-13 [A-35039946]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0590] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0590]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0590]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0473

(json)

• CVE numbers: CVE-2017-0473 [Bulletin-CVE-2017-0473]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33982658. [NIST-CVE-2017-0473]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0473] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0473]
• Fixed on: 2017-01-16 [A-33982658]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0473] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0473]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0473]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-7371

(json)

• CVE numbers: CVE-2017-7371 [Bulletin-CVE-2017-7371]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In all Android releases from CAF using the Linux kernel, a data pointer is potentially used after it has been freed when SLIMbus is turned off by Bluetooth. [NIST-CVE-2017-7371]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2017-7371]
• Fixed on: 2017-01-23 [QC-CR#1101054]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-7371]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0427

(json)

• CVE numbers: CVE-2017-0427 [Bulletin-CVE-2017-0427]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel file system
• Details: An elevation of privilege vulnerability in the kernel file system could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31495866. [NIST-CVE-2017-0427]
• Discovered by: Qidan He (何淇丹) (@flanker_hqd) of KeenLab, Tencent (腾讯科恩实验室) [Discovery-CVE-2017-0427] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0427]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0427]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0428

(json)

• CVE numbers: CVE-2017-0428 [Bulletin-CVE-2017-0428]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32401526. References: N-CVE-2017-0428. [NIST-CVE-2017-0428]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2017-0428] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0428]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0428]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0429

(json)

• CVE numbers: CVE-2017-0429 [Bulletin-CVE-2017-0429]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32636619. References: N-CVE-2017-0429. [NIST-CVE-2017-0429]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2017-0429] on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0429]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0429]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0430

(json)

• CVE numbers: CVE-2017-0430 [Bulletin-CVE-2017-0430]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Broadcom Wi-Fi driver
• Details: An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32838767. References: B-RB#107459. [NIST-CVE-2017-0430]
• Discovered by: on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0430]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-0430]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0431

(json)

• CVE numbers: CVE-2017-0431 [Bulletin-CVE-2017-0431]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-32573899. [NIST-CVE-2017-0431]
• Discovered by: on: Unknown
• Reported on: 2017-02-01 [Bulletin-CVE-2017-0431]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-0431]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2017-0541

(json)

• CVE numbers: CVE-2017-0541 [Bulletin-CVE-2017-0541]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018. [NIST-CVE-2017-0541]
• Discovered by: Jianjun Dai (@Jioun_dai) of Qihoo 360 Skyeye Labs [Discovery-CVE-2017-0541] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0541]
• Fixed on: 2017-02-07 [A-34031018]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0541]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0680

(json)

• CVE numbers: CVE-2017-0680 [Bulletin-CVE-2017-0680]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37008096. [NIST-CVE-2017-0680]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0680] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0680]
• Fixed on: 2017-02-10 [A-37008096]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0680] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0680]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0680]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8479

(json)

• CVE numbers: CVE-2016-8479 [Bulletin-CVE-2016-8479]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Qualcomm GPU driver
• Details: An elevation of privilege vulnerability in the Qualcomm GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31824853. References: QC-CR#1093687. [NIST-CVE-2016-8479]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2016-8479] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8479]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8479]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8484

(json)

• CVE numbers: CVE-2016-8484 [Bulletin-CVE-2016-8484]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823575. [NIST-CVE-2016-8484]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8484]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8484]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8485

(json)

• CVE numbers: CVE-2016-8485 [Bulletin-CVE-2016-8485]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823681. [NIST-CVE-2016-8485]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8485]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8485]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8486

(json)

• CVE numbers: CVE-2016-8486 [Bulletin-CVE-2016-8486]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An information disclosure vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823691. [NIST-CVE-2016-8486]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8486]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8486]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8487

(json)

• CVE numbers: CVE-2016-8487 [Bulletin-CVE-2016-8487]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-28823724. [NIST-CVE-2016-8487]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8487]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8487]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-8488

(json)

• CVE numbers: CVE-2016-8488 [Bulletin-CVE-2016-8488]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-31625756. [NIST-CVE-2016-8488]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-8488]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-8488]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0306

(json)

• CVE numbers: CVE-2017-0306 [Bulletin-CVE-2017-0306]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-34132950. References: N-CVE-2017-0306. [NIST-CVE-2017-0306]
• Discovered by: Nathan Crandall (@natecray) of Tesla Motors Product Security Team [Discovery-CVE-2017-0306] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0306]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0306]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0333

(json)

• CVE numbers: CVE-2017-0333 [Bulletin-CVE-2017-0333]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33899363. References: N-CVE-2017-0333. [NIST-CVE-2017-0333]
• Discovered by: Yuan-Tsung Lo of C0RE Team [Discovery-CVE-2017-0333] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0333]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0333]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0335

(json)

• CVE numbers: CVE-2017-0335 [Bulletin-CVE-2017-0335]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33043375. References: N-CVE-2017-0335. [NIST-CVE-2017-0335]
• Discovered by: Billy Lau of Android Security [Discovery-CVE-2017-0335] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0335]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0335]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0337

(json)

• CVE numbers: CVE-2017-0337 [Bulletin-CVE-2017-0337]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-31992762. References: N-CVE-2017-0337. [NIST-CVE-2017-0337]
• Discovered by: Qidan He (何淇丹) (@flanker_hqd) of KeenLab, Tencent (腾讯科恩实验室) [Discovery-CVE-2017-0337] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0337]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0337]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0338

(json)

• CVE numbers: CVE-2017-0338 [Bulletin-CVE-2017-0338]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA GPU driver
• Details: An elevation of privilege vulnerability in the NVIDIA GPU driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33057977. References: N-CVE-2017-0338. [NIST-CVE-2017-0338]
• Discovered by: Billy Lau of Android Security [Discovery-CVE-2017-0338] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0338]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0338]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0500

(json)

• CVE numbers: CVE-2017-0500 [Bulletin-CVE-2017-0500]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28429685. References: M-ALPS02710006. [NIST-CVE-2017-0500]
• Discovered by: pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0500] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0500]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0500]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0501

(json)

• CVE numbers: CVE-2017-0501 [Bulletin-CVE-2017-0501]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28430015. References: M-ALPS02708983. [NIST-CVE-2017-0501]
• Discovered by: pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0501] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0501]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0501]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0502

(json)

• CVE numbers: CVE-2017-0502 [Bulletin-CVE-2017-0502]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28430164. References: M-ALPS02710027. [NIST-CVE-2017-0502]
• Discovered by: pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0502] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0502]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0502]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0503

(json)

• CVE numbers: CVE-2017-0503 [Bulletin-CVE-2017-0503]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-28449045. References: M-ALPS02710075. [NIST-CVE-2017-0503]
• Discovered by: pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0503] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0503]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0503]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0504

(json)

• CVE numbers: CVE-2017-0504 [Bulletin-CVE-2017-0504]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-30074628. References: M-ALPS02829371. [NIST-CVE-2017-0504]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2017-0504] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0504]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0504]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0505

(json)

• CVE numbers: CVE-2017-0505 [Bulletin-CVE-2017-0505]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-31822282. References: M-ALPS02992041. [NIST-CVE-2017-0505]
• Discovered by: salls (@chris_salls) of Shellphish Grill Team, UC Santa Barbara [Discovery-CVE-2017-0505] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0505]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0505]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0506

(json)

• CVE numbers: CVE-2017-0506 [Bulletin-CVE-2017-0506]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek components
• Details: An elevation of privilege vulnerability in MediaTek components, including the M4U driver, sound driver, touchscreen driver, GPU driver, and Command Queue driver, could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32276718. References: M-ALPS03006904. [NIST-CVE-2017-0506]
• Discovered by: Yang Song of Alibaba Mobile Security Group [Discovery-CVE-2017-0506] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0506]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2017-0506]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0507

(json)

• CVE numbers: CVE-2017-0507 [Bulletin-CVE-2017-0507]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel ION subsystem
• Details: An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-31992382. [NIST-CVE-2017-0507]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0507]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0507]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0508

(json)

• CVE numbers: CVE-2017-0508 [Bulletin-CVE-2017-0508]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel ION subsystem
• Details: An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.18. Android ID: A-33940449. [NIST-CVE-2017-0508]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0508]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0508]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0509

(json)

• CVE numbers: CVE-2017-0509 [Bulletin-CVE-2017-0509]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Broadcom Wi-Fi driver
• Details: An elevation of privilege vulnerability in the Broadcom Wi-Fi driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-32124445. References: B-RB#110688. [NIST-CVE-2017-0509]
• Discovered by: pjf of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0509] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0509]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-0509]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0510

(json)

• CVE numbers: CVE-2017-0510 [Bulletin-CVE-2017-0510]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel FIQ debugger
• Details: An elevation of privilege vulnerability in the kernel FIQ debugger could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32402555. [NIST-CVE-2017-0510]
• Discovered by: Sagi Kedmi of IBM Security X-Force Research [Discovery-CVE-2017-0510] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0510]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0510]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0589

(json)

• CVE numbers: CVE-2017-0589 [Bulletin-CVE-2017-0589]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34897036. [NIST-CVE-2017-0589]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0589] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0589]
• Fixed on: 2017-03-06 [A-34897036]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0589] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0589]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0589]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0588

(json)

• CVE numbers: CVE-2017-0588 [Bulletin-CVE-2017-0588]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607. [NIST-CVE-2017-0588]
• Discovered by: Yong Wang (王勇) (@ThomasKing2014) of Alibaba Inc. [Discovery-CVE-2017-0588] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0588]
• Fixed on: 2017-03-10 [A-34618607]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0588]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0756

(json)

• CVE numbers: CVE-2017-0756 [Bulletin-CVE-2017-0756]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34621073. [NIST-CVE-2017-0756]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0756]
• Fixed on: 2017-03-10 [A-34621073]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0756] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0756]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0756]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-7555

(json)

• CVE numbers: CVE-2015-7555 [Bulletin-CVE-2015-7555]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in GIFLIB
• Details: Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file. [NIST-CVE-2015-7555]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2015-7555]
• Fixed on: 2017-03-13 [A-34697653]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2015-7555] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-7555]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2015-7555]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0677

(json)

• CVE numbers: CVE-2017-0677 [Bulletin-CVE-2017-0677]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36035074. [NIST-CVE-2017-0677]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0677] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0677]
• Fixed on: 2017-03-20 [A-36035074]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0677] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0677]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0677]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0637

(json)

• CVE numbers: CVE-2017-0637 [Bulletin-CVE-2017-0637]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process.Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34064500. [NIST-CVE-2017-0637]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0637] on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2017-0637]
• Fixed on: 2017-03-31 [A-34064500]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0637] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0637]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0637]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9931

(json)

• CVE numbers: CVE-2014-9931 [Bulletin-CVE-2014-9931]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: A buffer overflow vulnerability in all Android releases from CAF using the Linux kernel can potentially occur if an OEM performs an app region size customization due to a hard-coded value. [NIST-CVE-2014-9931]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9931]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9931]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9932

(json)

• CVE numbers: CVE-2014-9932 [Bulletin-CVE-2014-9932]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone, an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation. [NIST-CVE-2014-9932]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9932]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9932]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9933

(json)

• CVE numbers: CVE-2014-9933 [Bulletin-CVE-2014-9933]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: Due to missing input validation in all Android releases from CAF using the Linux kernel, HLOS can write to fuses for which it should not have access. [NIST-CVE-2014-9933]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9933]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9933]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9934

(json)

• CVE numbers: CVE-2014-9934 [Bulletin-CVE-2014-9934]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: A PKCS#1 v1.5 signature verification routine in all Android releases from CAF using the Linux kernel may not check padding. [NIST-CVE-2014-9934]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9934]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9934]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9935

(json)

• CVE numbers: CVE-2014-9935 [Bulletin-CVE-2014-9935]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an integer overflow vulnerability leading to a buffer overflow could potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2014-9935]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9935]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9935]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9936

(json)

• CVE numbers: CVE-2014-9936 [Bulletin-CVE-2014-9936]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a time-of-check time-of-use race condition could potentially exist in an authentication routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2014-9936]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9936]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9936]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9937

(json)

• CVE numbers: CVE-2014-9937 [Bulletin-CVE-2014-9937]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a buffer overflow vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2014-9937]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2014-9937]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9937]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-8995

(json)

• CVE numbers: CVE-2015-8995 [Bulletin-CVE-2015-8995]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-8995]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-8995]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8995]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-8996

(json)

• CVE numbers: CVE-2015-8996 [Bulletin-CVE-2015-8996]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-8996]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-8996]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8996]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-8997

(json)

• CVE numbers: CVE-2015-8997 [Bulletin-CVE-2015-8997]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-8997]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-8997]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8997]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-8998

(json)

• CVE numbers: CVE-2015-8998 [Bulletin-CVE-2015-8998]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-8998]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-8998]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8998]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-8999

(json)

• CVE numbers: CVE-2015-8999 [Bulletin-CVE-2015-8999]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file. [NIST-CVE-2015-8999]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-8999]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-8999]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9000

(json)

• CVE numbers: CVE-2015-9000 [Bulletin-CVE-2015-9000]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-9000]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-9000]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9000]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9001

(json)

• CVE numbers: CVE-2015-9001 [Bulletin-CVE-2015-9001]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-9001]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-9001]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9001]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9002

(json)

• CVE numbers: CVE-2015-9002 [Bulletin-CVE-2015-9002]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-9002]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-9002]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9002]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9003

(json)

• CVE numbers: CVE-2015-9003 [Bulletin-CVE-2015-9003]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel. [NIST-CVE-2015-9003]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2015-9003]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9003]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10237

(json)

• CVE numbers: CVE-2016-10237 [Bulletin-CVE-2016-10237]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: If shared content protection memory were passed as the secure camera memory buffer by the HLOS to a trusted application (TA) in all Android releases from CAF using the Linux kernel, the TA would not detect an issue and it would be treated as secure memory. [NIST-CVE-2016-10237]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2016-10237]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10237]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10238

(json)

• CVE numbers: CVE-2016-10238 [Bulletin-CVE-2016-10238]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In QSEE in all Android releases from CAF using the Linux kernel access control may potentially be bypassed due to a page alignment issue. [NIST-CVE-2016-10238]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2016-10238]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10238]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10242

(json)

• CVE numbers: CVE-2016-10242 [Bulletin-CVE-2016-10242]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: A time-of-check time-of-use race condition could potentially exist in the secure file system in all Android releases from CAF using the Linux kernel. [NIST-CVE-2016-10242]
• Discovered by: on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2016-10242]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10242]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0561

(json)

• CVE numbers: CVE-2017-0561 [Bulletin-CVE-2017-0561]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Broadcom Wi-Fi firmware
• Details: A remote code execution vulnerability in the Broadcom Wi-Fi firmware could enable a remote attacker to execute arbitrary code within the context of the Wi-Fi SoC. This issue is rated as Critical due to the possibility of remote code execution in the context of the Wi-Fi SoC. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34199105. References: B-RB#110814. [NIST-CVE-2017-0561]
• Discovered by: Gal Beniamini of Project Zero [Discovery-CVE-2017-0561] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0561]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-0561]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0563

(json)

• CVE numbers: CVE-2017-0563 [Bulletin-CVE-2017-0563]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in HTC touchscreen driver
• Details: An elevation of privilege vulnerability in the HTC touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10. Android ID: A-32089409. [NIST-CVE-2017-0563]
• Discovered by: Roee Hay (@roeehay) of Aleph Research, HCL Technologies [Discovery-CVE-2017-0563] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0563]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: HTC [Bulletin-CVE-2017-0563]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0564

(json)

• CVE numbers: CVE-2017-0564 [Bulletin-CVE-2017-0564]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in kernel ION subsystem
• Details: An elevation of privilege vulnerability in the kernel ION subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-34276203. [NIST-CVE-2017-0564]
• Discovered by: Yonggang Guo (@guoygang) of IceSword Lab, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0564] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0564]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0564]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2017-0674

(json)

• CVE numbers: CVE-2017-0674 [Bulletin-CVE-2017-0674]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34231163. [NIST-CVE-2017-0674]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0674] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0674]
• Fixed on: 2017-04-05 [A-34231163]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0674] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0674]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0674]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0675

(json)

• CVE numbers: CVE-2017-0675 [Bulletin-CVE-2017-0675]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34779227. [NIST-CVE-2017-0675]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0675] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0675]
• Fixed on: 2017-04-05 [2]
• Fix released on: Unknown
• Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0675] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0675]
• Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0675]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0676

(json)

• CVE numbers: CVE-2017-0676 [Bulletin-CVE-2017-0676]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34896431. [NIST-CVE-2017-0676]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0676] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0676]
• Fixed on: 2017-04-05 [A-34896431]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0676] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0676]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0676]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13160

(json)

• CVE numbers: CVE-2017-13160 [Bulletin-CVE-2017-13160]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-37160362. [NIST-CVE-2017-13160]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2017-13160] on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-13160]
• Fixed on: 2017-04-06 [A-37160362]
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-13160]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13160] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13160]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13160]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0759

(json)

• CVE numbers: CVE-2017-0759 [Bulletin-CVE-2017-0759]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36715268. [NIST-CVE-2017-0759]
• Discovered by: Weichao Sun (@sunblate) of Alibaba Inc. [Discovery-CVE-2017-0759] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0759]
• Fixed on: 2017-04-13 [A-36715268]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0759] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0759]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0759]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0719

(json)

• CVE numbers: CVE-2017-0719 [Bulletin-CVE-2017-0719]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273673. [NIST-CVE-2017-0719]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0719] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0719]
• Fixed on: 2017-04-20 [A-37273673]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0719] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0719]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0719]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0721

(json)

• CVE numbers: CVE-2017-0721 [Bulletin-CVE-2017-0721]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37561455. [NIST-CVE-2017-0721]
• Discovered by: on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0721]
• Fixed on: 2017-04-21 [A-37561455]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0721] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0721]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0721]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0723

(json)

• CVE numbers: CVE-2017-0723 [Bulletin-CVE-2017-0723]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37968755. [NIST-CVE-2017-0723]
• Discovered by: on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0723]
• Fixed on: 2017-04-21 [A-37968755]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0723] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0723]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0723]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0540

(json)

• CVE numbers: CVE-2017-0540 [Bulletin-CVE-2017-0540]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-33966031. [NIST-CVE-2017-0540]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0540] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0540]
• Fixed on: 2017-04-22 [A-33966031]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0540] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0540]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0540]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9923

(json)

• CVE numbers: CVE-2014-9923 [Bulletin-CVE-2014-9923]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. [NIST-CVE-2014-9923]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9923]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9923]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9924

(json)

• CVE numbers: CVE-2014-9924 [Bulletin-CVE-2014-9924]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur. [NIST-CVE-2014-9924]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9924]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9924]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9925

(json)

• CVE numbers: CVE-2014-9925 [Bulletin-CVE-2014-9925]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. [NIST-CVE-2014-9925]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9925]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9925]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9926

(json)

• CVE numbers: CVE-2014-9926 [Bulletin-CVE-2014-9926]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. [NIST-CVE-2014-9926]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9926]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9926]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9927

(json)

• CVE numbers: CVE-2014-9927 [Bulletin-CVE-2014-9927]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. [NIST-CVE-2014-9927]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9927]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9927]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9928

(json)

• CVE numbers: CVE-2014-9928 [Bulletin-CVE-2014-9928]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially exist. [NIST-CVE-2014-9928]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9928]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9928]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9929

(json)

• CVE numbers: CVE-2014-9929 [Bulletin-CVE-2014-9929]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist. [NIST-CVE-2014-9929]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9929]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9929]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2014-9930

(json)

• CVE numbers: CVE-2014-9930 [Bulletin-CVE-2014-9930]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. [NIST-CVE-2014-9930]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2014-9930]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9930]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2015-9005

(json)

• CVE numbers: CVE-2015-9005 [Bulletin-CVE-2015-9005]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist. [NIST-CVE-2015-9005]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2015-9005]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9005]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2015-9006

(json)

• CVE numbers: CVE-2015-9006 [Bulletin-CVE-2015-9006]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. [NIST-CVE-2015-9006]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2015-9006]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9006]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2015-9007

(json)

• CVE numbers: CVE-2015-9007 [Bulletin-CVE-2015-9007]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. [NIST-CVE-2015-9007]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2015-9007]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9007]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-10240

(json)

• CVE numbers: CVE-2016-10240 [Bulletin-CVE-2016-10240]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details:
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10240]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10240]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-10241

(json)

• CVE numbers: CVE-2016-10241 [Bulletin-CVE-2016-10241]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details:
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10241]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10241]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2016-10274

(json)

• CVE numbers: CVE-2016-10274 [Bulletin-CVE-2016-10274]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in MediaTek touchscreen driver
• Details: An elevation of privilege vulnerability in the MediaTek touchscreen driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: N/A. Android ID: A-30202412. References: M-ALPS02897901. [NIST-CVE-2016-10274]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2016-10274] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10274]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2016-10274]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10277

(json)

• CVE numbers: CVE-2016-10277 [Bulletin-CVE-2016-10277]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in Motorola bootloader
• Details: An elevation of privilege vulnerability in the Motorola bootloader could enable a local malicious application to execute arbitrary code within the context of the bootloader. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-33840490. [NIST-CVE-2016-10277]
• Discovered by: Roee Hay (@roeehay) of Aleph Research, HCL Technologies [Discovery-CVE-2016-10277] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10277]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-10277]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10297

(json)

• CVE numbers: CVE-2016-10297 [Bulletin-CVE-2016-10297]
• Coordinated disclosure?: unknown
• Categories: Vulnerabilities in Qualcomm components
• Details: In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potentially exist. [NIST-CVE-2016-10297]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2016-10297]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10297]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-30

CVE-2017-0331

(json)

• CVE numbers: CVE-2017-0331 [Bulletin-CVE-2017-0331]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in NVIDIA video driver
• Details: An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: Kernel 3.10. Android ID: A-34113000. References: N-CVE-2017-0331. [NIST-CVE-2017-0331]
• Discovered by: Nathan Crandall (@natecray) of Tesla Motors Product Security Team [Discovery-CVE-2017-0331] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0331]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-0331]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0811

(json)

• CVE numbers: CVE-2017-0811 [Bulletin-CVE-2017-0811]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37930177. [NIST-CVE-2017-0811]
• Discovered by: on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-0811]
• Fixed on: 2017-05-03 [A-37930177]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0811] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0811]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0811]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0679

(json)

• CVE numbers: CVE-2017-0679 [Bulletin-CVE-2017-0679]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36996978. [NIST-CVE-2017-0679]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0679] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0679]
• Fixed on: 2017-05-08 [A-36996978]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0679] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0679]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0679]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0715

(json)

• CVE numbers: CVE-2017-0715 [Bulletin-CVE-2017-0715]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36998372. [NIST-CVE-2017-0715]
• Discovered by: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro [Discovery-CVE-2017-0715] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0715]
• Fixed on: 2017-05-08 [A-36998372]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0715] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0715]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0715]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-8890

(json)

• CVE numbers: CVE-2017-8890 [Bulletin-CVE-2017-8890]
• Coordinated disclosure?: unknown
• Categories: Kernel components
• Details: The inet_csk_clone_lock function in net/ipv4/inet_connection_sock.c in the Linux kernel through 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging use of the accept system call. [NIST-CVE-2017-8890]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-8890]
• Fixed on: 2017-05-09 [Upstream kernel]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-8890]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0681

(json)

• CVE numbers: CVE-2017-0681 [Bulletin-CVE-2017-0681]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37208566. [NIST-CVE-2017-0681]
• Discovered by: Xuxian Jiang of C0RE Team [Discovery-CVE-2017-0681] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0681]
• Fixed on: 2017-05-11 [A-37208566]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0681]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0716

(json)

• CVE numbers: CVE-2017-0716 [Bulletin-CVE-2017-0716]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37203196. [NIST-CVE-2017-0716]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0716] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0716]
• Fixed on: 2017-05-12 [A-37203196]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0716] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0716]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0716]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0678

(json)

• CVE numbers: CVE-2017-0678 [Bulletin-CVE-2017-0678]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36576151. [NIST-CVE-2017-0678]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0678] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0678]
• Fixed on: 2017-05-15 [A-36576151]
• Fix released on: Unknown
• Affected versions: 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0678] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0678]
• Fixed versions: 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0678]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-9714

(json)

• CVE numbers: CVE-2017-9714 [Bulletin-CVE-2017-9714]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an out of bound memory access may happen in limCheckRxRSNIeMatch in case incorrect RSNIE is received from the client in assoc request. [NIST-CVE-2017-9714]
• Discovered by: on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-9714]
• Fixed on: 2017-05-16 [QC-CR#2046578]
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-9714]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0762

(json)

• CVE numbers: CVE-2017-0762 [Bulletin-CVE-2017-0762]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-62214264. [NIST-CVE-2017-0762]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0762]
• Fixed on: 2017-05-17 [A-62214264]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0762] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0762]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0762]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0745

(json)

• CVE numbers: CVE-2017-0745 [Bulletin-CVE-2017-0745]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (avc decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37079296. [NIST-CVE-2017-0745]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0745] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0745]
• Fixed on: 2017-05-18 [A-37079296]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0745]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0714

(json)

• CVE numbers: CVE-2017-0714 [Bulletin-CVE-2017-0714]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492637. [NIST-CVE-2017-0714]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0714] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0714]
• Fixed on: 2017-05-19 [A-36492637]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0714]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0722

(json)

• CVE numbers: CVE-2017-0722 [Bulletin-CVE-2017-0722]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37660827. [NIST-CVE-2017-0722]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0722] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0722]
• Fixed on: 2017-05-19 [A-37660827]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0722]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0720

(json)

• CVE numbers: CVE-2017-0720 [Bulletin-CVE-2017-0720]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37430213. [NIST-CVE-2017-0720]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0720] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0720]
• Fixed on: 2017-05-23 [A-37430213]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0720] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0720]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0720]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0718

(json)

• CVE numbers: CVE-2017-0718 [Bulletin-CVE-2017-0718]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37273547. [NIST-CVE-2017-0718]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0718] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0718]
• Fixed on: 2017-05-30 [A-37273547]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0718] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0718]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0718]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0760

(json)

• CVE numbers: CVE-2017-0760 [Bulletin-CVE-2017-0760]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37237396. [NIST-CVE-2017-0760]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0760] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0760]
• Fixed on: 2017-05-30 [A-37237396]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0760] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0760]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0760]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9953

(json)

• CVE numbers: CVE-2014-9953 [Bulletin-CVE-2014-9953]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714770. [NIST-CVE-2014-9953]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2014-9953]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9953]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9960

(json)

• CVE numbers: CVE-2014-9960 [Bulletin-CVE-2014-9960]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API. [NIST-CVE-2014-9960]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2014-9960]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9960]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9961

(json)

• CVE numbers: CVE-2014-9961 [Bulletin-CVE-2014-9961]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection. [NIST-CVE-2014-9961]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2014-9961]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9961]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9967

(json)

• CVE numbers: CVE-2014-9967 [Bulletin-CVE-2014-9967]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2014-9967]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2014-9967]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9967]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9008

(json)

• CVE numbers: CVE-2015-9008 [Bulletin-CVE-2015-9008]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689. [NIST-CVE-2015-9008]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9008]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9008]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9009

(json)

• CVE numbers: CVE-2015-9009 [Bulletin-CVE-2015-9009]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393600. [NIST-CVE-2015-9009]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9009]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9009]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9010

(json)

• CVE numbers: CVE-2015-9010 [Bulletin-CVE-2015-9010]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101. [NIST-CVE-2015-9010]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9010]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9010]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9011

(json)

• CVE numbers: CVE-2015-9011 [Bulletin-CVE-2015-9011]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882. [NIST-CVE-2015-9011]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9011]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9011]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9012

(json)

• CVE numbers: CVE-2015-9012 [Bulletin-CVE-2015-9012]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691. [NIST-CVE-2015-9012]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9012]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9012]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9013

(json)

• CVE numbers: CVE-2015-9013 [Bulletin-CVE-2015-9013]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251. [NIST-CVE-2015-9013]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9013]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9013]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9014

(json)

• CVE numbers: CVE-2015-9014 [Bulletin-CVE-2015-9014]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750. [NIST-CVE-2015-9014]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9014]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9014]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9015

(json)

• CVE numbers: CVE-2015-9015 [Bulletin-CVE-2015-9015]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120. [NIST-CVE-2015-9015]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9015]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9015]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9024

(json)

• CVE numbers: CVE-2015-9024 [Bulletin-CVE-2015-9024]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. [NIST-CVE-2015-9024]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9024]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9024]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9026

(json)

• CVE numbers: CVE-2015-9026 [Bulletin-CVE-2015-9026]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2015-9026]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9026]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9026]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9027

(json)

• CVE numbers: CVE-2015-9027 [Bulletin-CVE-2015-9027]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2015-9027]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9027]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9027]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9029

(json)

• CVE numbers: CVE-2015-9029 [Bulletin-CVE-2015-9029]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. [NIST-CVE-2015-9029]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2015-9029]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9029]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10298

(json)

• CVE numbers: CVE-2016-10298 [Bulletin-CVE-2016-10298]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393252. [NIST-CVE-2016-10298]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10298]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10298]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10299

(json)

• CVE numbers: CVE-2016-10299 [Bulletin-CVE-2016-10299]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-32577244. [NIST-CVE-2016-10299]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10299]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10299]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10333

(json)

• CVE numbers: CVE-2016-10333 [Bulletin-CVE-2016-10333]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. [NIST-CVE-2016-10333]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10333]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10333]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10334

(json)

• CVE numbers: CVE-2016-10334 [Bulletin-CVE-2016-10334]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. [NIST-CVE-2016-10334]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10334]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10334]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10335

(json)

• CVE numbers: CVE-2016-10335 [Bulletin-CVE-2016-10335]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. [NIST-CVE-2016-10335]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10335]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10335]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10336

(json)

• CVE numbers: CVE-2016-10336 [Bulletin-CVE-2016-10336]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, some regions of memory were not protected during boot. [NIST-CVE-2016-10336]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10336]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10336]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10338

(json)

• CVE numbers: CVE-2016-10338 [Bulletin-CVE-2016-10338]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, there was an issue related to RPMB processing. [NIST-CVE-2016-10338]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10338]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10338]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10339

(json)

• CVE numbers: CVE-2016-10339 [Bulletin-CVE-2016-10339]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore. [NIST-CVE-2016-10339]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10339]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10339]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10340

(json)

• CVE numbers: CVE-2016-10340 [Bulletin-CVE-2016-10340]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, an integer underflow leading to buffer overflow vulnerability exists in a syscall handler. [NIST-CVE-2016-10340]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10340]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10340]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10341

(json)

• CVE numbers: CVE-2016-10341 [Bulletin-CVE-2016-10341]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended. [NIST-CVE-2016-10341]
• Discovered by: on: Unknown
• Reported on: 2017-06-01 [Bulletin-CVE-2016-10341]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10341]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0757

(json)

• CVE numbers: CVE-2017-0757 [Bulletin-CVE-2017-0757]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36006815. [NIST-CVE-2017-0757]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-0757] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0757]
• Fixed on: 2017-06-01 [A-36006815]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0757] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0757]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0757]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0758

(json)

• CVE numbers: CVE-2017-0758 [Bulletin-CVE-2017-0758]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492741. [NIST-CVE-2017-0758]
• Discovered by: Zhe Jin (金哲) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0758] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0758]
• Fixed on: 2017-06-02 [A-36492741]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0758] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0758]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0758]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0810

(json)

• CVE numbers: CVE-2017-0810 [Bulletin-CVE-2017-0810]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38207066. [NIST-CVE-2017-0810]
• Discovered by: on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-0810]
• Fixed on: 2017-06-09 [A-38207066]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0810] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0810]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0810]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0832

(json)

• CVE numbers: CVE-2017-0832 [Bulletin-CVE-2017-0832]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62887820. [NIST-CVE-2017-0832]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0832]
• Fixed on: 2017-06-09 [A-62887820]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0832]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0832] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0832]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0832]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0835

(json)

• CVE numbers: CVE-2017-0835 [Bulletin-CVE-2017-0835]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63316832. [NIST-CVE-2017-0835]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0835]
• Fixed on: 2017-06-09 [A-63316832]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0835]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0835] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0835]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0835]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0761

(json)

• CVE numbers: CVE-2017-0761 [Bulletin-CVE-2017-0761]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-38448381. [NIST-CVE-2017-0761]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0761] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0761]
• Fixed on: 2017-06-16 [A-38448381]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0761] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0761]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0761]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0763

(json)

• CVE numbers: CVE-2017-0763 [Bulletin-CVE-2017-0763]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62534693. [NIST-CVE-2017-0763]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0763]
• Fixed on: 2017-06-22 [A-62534693]
• Fix released on: Unknown
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0763] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0763]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0763]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0833

(json)

• CVE numbers: CVE-2017-0833 [Bulletin-CVE-2017-0833]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62896384. [NIST-CVE-2017-0833]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0833]
• Fixed on: 2017-06-22 [A-62896384]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0833]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0833] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0833]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0833]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0809

(json)

• CVE numbers: CVE-2017-0809 [Bulletin-CVE-2017-0809]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128. [NIST-CVE-2017-0809]
• Discovered by: on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-0809]
• Fixed on: 2017-06-27 [A-62673128]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0809]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0834

(json)

• CVE numbers: CVE-2017-0834 [Bulletin-CVE-2017-0834]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63125953. [NIST-CVE-2017-0834]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0834]
• Fixed on: 2017-06-27 [A-63125953]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0834]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0834] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0834]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0834]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11013

(json)

• CVE numbers: CVE-2017-11013 [Bulletin-CVE-2017-11013]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, countOffset (in function UnpackCore) is increased for each loop, while there is no boundary check against "pIe->arraybound". [NIST-CVE-2017-11013]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-11013]
• Fixed on: 2017-06-30 [QC-CR#2058261]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-11013]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11013]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-9417

(json)

• CVE numbers: CVE-2017-9417 [Bulletin-CVE-2017-9417]
• Coordinated disclosure?: unknown
• Categories: Broadcom components
• Details: Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue. [NIST-CVE-2017-9417]
• Discovered by: Nitay Artenstein of Exodus Intelligence [Discovery-CVE-2017-9417] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-9417]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-9417]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11014

(json)

• CVE numbers: CVE-2017-11014 [Bulletin-CVE-2017-11014]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing a Measurement Request IE in a Roam Neighbor Action Report, a buffer overflow can occur. [NIST-CVE-2017-11014]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-11014]
• Fixed on: 2017-07-05 [QC-CR#2060959]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-11014]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11014]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11015

(json)

• CVE numbers: CVE-2017-11015 [Bulletin-CVE-2017-11015]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently, the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128 which may result in buffer overflow since the frame parser allows challenge text of length up to 253 bytes, but the driver can not handle challenge text larger than 128 bytes. [NIST-CVE-2017-11015]
• Discovered by: on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-11015]
• Fixed on: 2017-07-05 [QC-CR#2060959]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-11015]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11015]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13230

(json)

• CVE numbers: CVE-2017-13230 [Bulletin-CVE-2017-13230]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65483665. [NIST-CVE-2017-13230]
• Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2017-13230] on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-13230]
• Fixed on: 2017-07-06 [A-65483665]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-13230]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13230]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0765

(json)

• CVE numbers: CVE-2017-0765 [Bulletin-CVE-2017-0765]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872863. [NIST-CVE-2017-0765]
• Discovered by: Xuxian Jiang of C0RE Team [Discovery-CVE-2017-0765] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0765]
• Fixed on: 2017-07-10 [A-62872863]
• Fix released on: Unknown
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0765] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0765]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0765]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11043

(json)

• CVE numbers: CVE-2017-11043 [Bulletin-CVE-2017-11043]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a WiFI driver function, an integer overflow leading to heap buffer overflow may potentially occur. [NIST-CVE-2017-11043]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-11043]
• Fixed on: 2017-07-12 [QC-CR#2067820]
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-11043]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11043]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13151

(json)

• CVE numbers: CVE-2017-13151 [Bulletin-CVE-2017-13151]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456. [NIST-CVE-2017-13151]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-13151]
• Fixed on: 2017-07-12 [A-63874456]
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-13151]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13151] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13151]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-13151]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0764

(json)

• CVE numbers: CVE-2017-0764 [Bulletin-CVE-2017-0764]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libvorbis). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872015. [NIST-CVE-2017-0764]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0764] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0764]
• Fixed on: 2017-07-13 [A-62872015]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0764] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0764]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0764]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0781

(json)

• CVE numbers: CVE-2017-0781 [Bulletin-CVE-2017-0781]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105. [NIST-CVE-2017-0781]
• Discovered by: Gregory Vishnepolsky of Armis, Inc. [Discovery-CVE-2017-0781] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0781]
• Fixed on: 2017-07-17 [2]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0781] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0781]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0781]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0782

(json)

• CVE numbers: CVE-2017-0782 [Bulletin-CVE-2017-0782]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146237. [NIST-CVE-2017-0782]
• Discovered by: Gregory Vishnepolsky of Armis, Inc. [Discovery-CVE-2017-0782] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0782]
• Fixed on: 2017-07-17 [3]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0782] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0782]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0782]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-18067

(json)

• CVE numbers: CVE-2017-18067 [Bulletin-CVE-2017-18067]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in lim_send_auth_mgmt_frame() leads to buffer overflow. [NIST-CVE-2017-18067]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-18067]
• Fixed on: 2017-07-27 [2]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-18067]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18067]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-15860

(json)

• CVE numbers: CVE-2017-15860 [Bulletin-CVE-2017-15860]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur. [NIST-CVE-2017-15860]
• Discovered by: on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-15860]
• Fixed on: 2017-07-31 [QC-CR#2082544]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-15860]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15860]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13249

(json)

• CVE numbers: CVE-2017-13249 [Bulletin-CVE-2017-13249]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2d_api_set_display_frame of impeg2d_api_main.c, there is an out of bound write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70399408. [NIST-CVE-2017-13249]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13249] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13249]
• Fixed on: 2017-08-09 [A-70399408]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13249]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13249]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0841

(json)

• CVE numbers: CVE-2017-0841 [Bulletin-CVE-2017-0841]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026. [NIST-CVE-2017-0841]
• Discovered by: Jose Martinez [Discovery-CVE-2017-0841] on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0841]
• Fixed on: 2017-08-14 [A-37723026]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0841]
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0841] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0841]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0841]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0878

(json)

• CVE numbers: CVE-2017-0878 [Bulletin-CVE-2017-0878]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291. [NIST-CVE-2017-0878]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-0878]
• Fixed on: 2017-08-29 [A-65186291]
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-0878]
• Affected versions: 8.0 [Bulletin-CVE-2017-0878] regex: (8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0878]
• Fixed versions: 8.0 [Bulletin-CVE-2017-0878]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2018-9473

(json)

• CVE numbers: CVE-2018-9473 [Bulletin-CVE-2018-9473]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android ID: A-65484460 [NIST-CVE-2018-9473]
• Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2018-9473] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9473]
• Fixed on: 2017-08-29 [A-65484460]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9473]
• Affected versions: 8.0 [Bulletin-CVE-2018-9473] regex: (8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9473]
• Fixed versions: 8.0 [Bulletin-CVE-2018-9473]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0836

(json)

• CVE numbers: CVE-2017-0836 [Bulletin-CVE-2017-0836]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226. [NIST-CVE-2017-0836]
• Discovered by: Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-0836] on: Unknown
• Reported on: 2017-11-01 [Bulletin-CVE-2017-0836]
• Fixed on: 2017-08-31 [A-64893226]
• Fix released on: 2017-11-06 [Bulletin-CVE-2017-0836]
• Affected versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0836] regex: (5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0836]
• Fixed versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0836]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-15815

(json)

• CVE numbers: CVE-2017-15815 [Bulletin-CVE-2017-15815]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a potential buffer overflow can happen when processing any 802.11 MGMT frames like Auth frame in limProcessAuthFrame. [NIST-CVE-2017-15815]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-15815]
• Fixed on: 2017-08-31 [QC-CR#2093392]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-15815]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15815]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-11041

(json)

• CVE numbers: CVE-2017-11041 [Bulletin-CVE-2017-11041]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In all Qualcomm products with Android releases from CAF using the Linux kernel, an output buffer is accessed in one thread and can be potentially freed in another. [NIST-CVE-2017-11041]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-11041]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11041]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11120

(json)

• CVE numbers: CVE-2017-11120 [Bulletin-CVE-2017-11120]
• Coordinated disclosure?: unknown
• Categories: Broadcom components
• Details: On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, an attacker can craft a malformed RRM neighbor report frame to trigger an internal buffer overflow in the Wi-Fi firmware, aka B-V2017061204. [NIST-CVE-2017-11120]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-11120]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-11120]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11121

(json)

• CVE numbers: CVE-2017-11121 [Bulletin-CVE-2017-11121]
• Coordinated disclosure?: unknown
• Categories: Broadcom components
• Details: On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially trigger internal Wi-Fi firmware heap and/or stack overflows, leading to denial of service or other effects, aka B-V2017061205. [NIST-CVE-2017-11121]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-11121]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-11121]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-7065

(json)

• CVE numbers: CVE-2017-7065 [Bulletin-CVE-2017-7065]
• Coordinated disclosure?: unknown
• Categories: Broadcom components
• Details: An issue was discovered in certain Apple products. iOS before 10.3.3 is affected. macOS before 10.12.6 is affected. tvOS before 10.2.2 is affected. The issue involves the "Wi-Fi" component. It allows remote attackers to execute arbitrary code (on the Wi-Fi chip) or cause a denial of service (memory corruption) by leveraging proximity for 802.11. [NIST-CVE-2017-7065]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-7065]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-7065]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0872

(json)

• CVE numbers: CVE-2017-0872 [Bulletin-CVE-2017-0872]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323. [NIST-CVE-2017-0872]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-0872]
• Fixed on: 2017-09-27 [A-65290323]
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-0872]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0872] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0872]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0872]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-11053

(json)

• CVE numbers: CVE-2017-11053 [Bulletin-CVE-2017-11053]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when qos map set IE of length less than 16 is received in association response or in qos map configure action frame, a buffer overflow can potentially occur in ConvertQosMapsetFrame(). [NIST-CVE-2017-11053]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2017-11053] on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-11053]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11053]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13178

(json)

• CVE numbers: CVE-2017-13178 [Bulletin-CVE-2017-13178]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969281. [NIST-CVE-2017-13178]
• Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13178] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13178]
• Fixed on: 2017-10-04 [A-66969281]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13178]
• Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13178]
• Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13179

(json)

• CVE numbers: CVE-2017-13179 [Bulletin-CVE-2017-13179]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both ps_codec_obj and ps_create_op->s_ivd_create_op_t.pv_handle point to the same memory and ps_codec_obj could be freed without clearing ps_create_op->s_ivd_create_op_t.pv_handle. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969193. [NIST-CVE-2017-13179]
• Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13179] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13179]
• Fixed on: 2017-10-04 [A-66969193]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13179]
• Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13179]
• Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13177

(json)

• CVE numbers: CVE-2017-13177 [Bulletin-CVE-2017-13177]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413. [NIST-CVE-2017-13177]
• Discovered by: on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13177]
• Fixed on: 2017-10-09 [A-68320413]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13177]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13177]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-15822

(json)

• CVE numbers: CVE-2017-15822 [Bulletin-CVE-2017-15822]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing a 802.11 management frame, a buffer overflow may potentially occur. [NIST-CVE-2017-15822]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-15822]
• Fixed on: 2017-10-12 [QC-CR#2123807]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-15822]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15822]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13208

(json)

• CVE numbers: CVE-2017-13208 [Bulletin-CVE-2017-13208]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67474440. [NIST-CVE-2017-13208]
• Discovered by: tintinweb [Discovery-CVE-2017-13208] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13208]
• Fixed on: 2017-10-13 [A-67474440]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13208]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13208] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13208]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13208]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3565

(json)

• CVE numbers: CVE-2018-3565 [Bulletin-CVE-2018-3565]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overflow can occur. [NIST-CVE-2018-3565]
• Discovered by: on: Unknown
• Reported on: 2018-05-01 [Bulletin-CVE-2018-3565]
• Fixed on: 2017-11-07 [QC-CR#2138555]
• Fix released on: 2018-05-05 [Bulletin-CVE-2018-3565]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3565]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13228

(json)

• CVE numbers: CVE-2017-13228 [Bulletin-CVE-2017-13228]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425. [NIST-CVE-2017-13228]
• Discovered by: on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-13228]
• Fixed on: 2017-11-28 [A-69478425]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-13228]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13228]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3580

(json)

• CVE numbers: CVE-2018-3580 [Bulletin-CVE-2018-3580]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: Stack-based buffer overflow can occur In the WLAN driver if the pmkid_count value is larger than the PMKIDCache size in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. [NIST-CVE-2018-3580]
• Discovered by: on: Unknown
• Reported on: 2018-05-01 [Bulletin-CVE-2018-3580]
• Fixed on: 2017-11-29 [QC-CR#2149187]
• Fix released on: 2018-05-05 [Bulletin-CVE-2018-3580]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3580]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-0876

(json)

• CVE numbers: CVE-2017-0876 [Bulletin-CVE-2017-0876]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675. [NIST-CVE-2017-0876]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-0876]
• Fixed on: Unknown
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-0876]
• Affected versions: 6.0 [Bulletin-CVE-2017-0876] regex: (6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0876]
• Fixed versions: 6.0 [Bulletin-CVE-2017-0876]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0877

(json)

• CVE numbers: CVE-2017-0877 [Bulletin-CVE-2017-0877]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937. [NIST-CVE-2017-0877]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-0877]
• Fixed on: Unknown
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-0877]
• Affected versions: 6.0 [Bulletin-CVE-2017-0877] regex: (6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0877]
• Fixed versions: 6.0 [Bulletin-CVE-2017-0877]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-6211

(json)

• CVE numbers: CVE-2017-6211 [Bulletin-CVE-2017-6211]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of a downlink supplementary services message, a buffer overflow can occur. [NIST-CVE-2017-6211]
• Discovered by: on: Unknown
• Reported on: 2017-12-01 [Bulletin-CVE-2017-6211]
• Fixed on: Unknown
• Fix released on: 2017-12-05 [Bulletin-CVE-2017-6211]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-6211]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-13248

(json)

• CVE numbers: CVE-2017-13248 [Bulletin-CVE-2017-13248]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2_idct_recon_sse42() of impeg2_idct_recon_sse42_intr.c, there is an out of bound write due to a missing bounds check. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70349612. [NIST-CVE-2017-13248]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13248] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13248]
• Fixed on: 2017-12-18 [A-70349612]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13248]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13248]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3569

(json)

• CVE numbers: CVE-2018-3569 [Bulletin-CVE-2018-3569]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: A buffer over-read can occur during a fast initial link setup (FILS) connection in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05. [NIST-CVE-2018-3569]
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-3569]
• Fixed on: 2017-12-20 [QC-CR#2161920]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-3569]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3569]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13250

(json)

• CVE numbers: CVE-2017-13250 [Bulletin-CVE-2017-13250]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c, there is an out of bound write due to a missing out of bounds check because of a multiplication error. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71375536. [NIST-CVE-2017-13250]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13250]
• Fixed on: 2017-12-27 [A-71375536]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13250]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13250]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13251

(json)

• CVE numbers: CVE-2017-13251 [Bulletin-CVE-2017-13251]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2d_dec_pic_data_thread of impeg2d_dec_hdr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when running multi threaded with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69269702. [NIST-CVE-2017-13251]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13251] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13251]
• Fixed on: 2017-12-28 [A-69269702]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13251]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13251]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251]
• Submission: by: Daniel Carter, on: 2019-07-25