Google Android vulnerabilities

CVE-2016-6674 [HIGH] CWE-20 CVE-2016-6674: system_server in Android before 2016-10-05 on Nexus devices allows attackers to gain privileges via system_server in Android before 2016-10-05 on Nexus devices allows attackers to gain privileges via a crafted application, aka internal bug 30445380.

CVE-2016-6673 [HIGH] CWE-264 CVE-2016-6673: The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain pr The NVIDIA camera driver in Android before 2016-10-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka internal bug 30204201.

CVE-2016-6672 [HIGH] CWE-264 CVE-2016-6672: The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 5X devices allows attackers t The Synaptics touchscreen driver in Android before 2016-10-05 on Nexus 5X devices allows attackers to gain privileges via a crafted application, aka internal bug 30537088.

CVE-2017-9720 [HIGH] CWE-193 CVE-2017-9720: In all Qualcomm products with Android releases from CAF using the Linux kernel, due to an off-by-one In all Qualcomm products with Android releases from CAF using the Linux kernel, due to an off-by-one error in a camera driver, an out-of-bounds read/write can occur.

CVE-2016-6695 [CRITICAL] CWE-119 CVE-2016-6695: sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 sound/soc/msm/qdsp6v2/msm-ds2-dap-config.c in a Qualcomm QDSP6v2 driver in Android before 2016-10-05 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted visualizer data length, aka Qualcomm internal bug CR 1033540.

CVE-2016-4477 [HIGH] CWE-19 CVE-2016-4477: wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, whic wpa_supplicant 0.4.0 through 2.5 does not reject \n and \r characters in passphrase parameters, which allows local users to trigger arbitrary library loading and consequently gain privileges, or cause a denial of service (daemon outage), via a crafted (1) SET, (2) SET_CRED, or (3) SET_NETWORK command.

CVE-2016-2504 [HIGH] CWE-264 CVE-2016-2504: The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices all The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a crafted application, aka Android internal bug 28026365 and Qualcomm internal bug CR1002974.

CVE-2014-9868 [HIGH] CWE-264 CVE-2014-9868: drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c in the Qualcomm components in Androi drivers/media/platform/msm/camera_v2/sensor/csiphy/msm_csiphy.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via an application that provides a crafted mask value, aka Android internal bug 28749721 and Qualcomm internal bug CR511976.

CVE-2017-0813 [HIGH] CWE-772 CVE-2017-0813: A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. A denial of service vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36531046.

CVE-2019-20538 [HIGH] CWE-787 CVE-2019-20538: An issue was discovered on Samsung mobile devices with P(9.0) software. There is a heap overflow in An issue was discovered on Samsung mobile devices with P(9.0) software. There is a heap overflow in the knox_kap driver. The Samsung ID is SVE-2019-14857 (November 2019).

CVE-2016-11044 [HIGH] CWE-347 CVE-2016-11044: An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint suppo An issue was discovered on Samsung mobile devices with L(5.0/5.1) and M(6.0) (with Fingerprint support) software. The check of an application's signature can be bypassed during installation. The Samsung ID is SVE-2016-5923 (June 2016).

CVE-2016-7988 [HIGH] CWE-275 CVE-2016-7988: On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible On Samsung Galaxy S4 through S7 devices, absence of permissions on the BroadcastReceiver responsible for handling the com.[Samsung].android.intent.action.SET_WIFI intent leads to unsolicited configuration messages being handled by wifi-service.jar within the Android Framework, a subset of SVE-2016-6542.

CVE-2017-0858 [HIGH] CWE-20 CVE-2017-0858: Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894.

CVE-2017-0857 [HIGH] CWE-369 CVE-2017-0857: Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447.

CVE-2020-35553 [HIGH] CWE-920 CVE-2020-35553: An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets An issue was discovered on Samsung mobile devices with Q(10.0) and R(11.0) (Qualcomm SM8250 chipsets) software. They allows attackers to cause a denial of service (unlock failure) by triggering a power-shortage incident that causes a false-positive attack detection. The Samsung ID is SVE-2020-19678 (December 2020).

CVE-2020-13830 [HIGH] CWE-532 CVE-2020-13830: An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak An issue was discovered on Samsung mobile devices with P(9.0) software. One UI HOME logging can leak information. The Samsung ID is SVE-2019-16382 (June 2020).

CVE-2017-13254 [HIGH] CVE-2017-13254: A other vulnerability in the Android media framework (AACExtractor). Product: Android. Versions: 6.0 A other vulnerability in the Android media framework (AACExtractor). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70239507.

CVE-2017-18682 [HIGH] CWE-755 CVE-2017-18682: An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) softw An issue was discovered on Samsung mobile devices with KK(4.4), L(5.0/5.1), M(6.0), and N(7.0) software. Because of incorrect exception handling and an unprotected intent, AudioService can cause a system crash, The Samsung IDs are SVE-2017-8114, SVE-2017-8116, and SVE-2017-8117 (March 2017).

CVE-2017-18674 [HIGH] CWE-20 CVE-2017-18674: An issue was discovered on Samsung mobile devices with N(7.0) software. The time service (aka Timase An issue was discovered on Samsung mobile devices with N(7.0) software. The time service (aka Timaservice) allows a kernel panic. The Samsung ID is SVE-2017-8593 (May 2017).

CVE-2017-13264 [HIGH] CVE-2017-13264: A other vulnerability in the Android media framework (Avcdec). Product: Android. Versions: 6.0, 6.0. A other vulnerability in the Android media framework (Avcdec). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70294343.