Android

CVE-2017-0722 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (h263 decoder). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0721 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (libmpeg2). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0720 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (libhevc). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0719 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0718 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (mpeg2 decoder). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0716 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (libmpeg2). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0715 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (libavc). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

CVE-2017-0714 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework (h263 decoder). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0713 Aug 09, 21:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android libraries (sfntly). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0712 Aug 09, 21:29 HIGH PATCH This Week

A elevation of privilege vulnerability in the Android framework (wi-fi service). Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2015-3839 Aug 07, 17:29 MEDIUM This Month

The updateMessageStatus function in Android 5.1.1 and earlier allows local users to cause a denial of service (NULL pointer exception and process crash). Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2016-10398 Jul 17, 13:18 MEDIUM This Month

Android 6.0 has an authentication bypass for attackers with root and physical access. Rated medium severity (CVSS 6.2), this vulnerability is low attack complexity. No vendor patch available.

CVE-2017-6249 Jul 13, 16:29 HIGH This Week

An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

CVE-2014-7954 Jul 07, 17:29 MEDIUM This Month

Directory traversal vulnerability in the doSendObjectInfo method in frameworks/av/media/mtp/MtpServer.cpp in Android 4.4.4 allows physically proximate attackers with a direct connection to the target. Rated medium severity (CVSS 4.6), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2014-7953 Jul 07, 17:29 HIGH This Week

Race condition in the bindBackupAgent method in the ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system by. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2017-0340 Jul 07, 14:29 HIGH This Week

An elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size could lead to a memory corruption and possible remote. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0326 Jul 07, 14:29 MEDIUM This Month

An information disclosure vulnerability in the NVIDIA Video Driver due to an out-of-bounds read function in the Tegra Display Controller driver could result in possible information disclosure. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-6248 Jul 06, 20:29 HIGH This Week

An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-6247 Jul 06, 20:29 HIGH This Week

An elevation of privilege vulnerability in the NVIDIA sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0711 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the MediaTek networking driver. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0710 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Upstream Linux tcb. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0709 Jul 06, 20:29 LOW Monitor

A information disclosure vulnerability in the HTC sensor hub driver. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0708 Jul 06, 20:29 MEDIUM This Month

A information disclosure vulnerability in the HTC sound driver. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0707 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the HTC led driver. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0706 Jul 06, 20:29 MEDIUM This Month

A elevation of privilege vulnerability in the Broadcom wi-fi driver. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0705 Jul 06, 20:29 MEDIUM POC This Month

A elevation of privilege vulnerability in the Broadcom wi-fi driver. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-0704 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android system ui. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0703 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android system ui. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0702 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android system ui. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0701 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android system ui. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0700 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android system ui. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0699 Jul 06, 20:29 MEDIUM This Month

A information disclosure vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0698 Jul 06, 20:29 MEDIUM This Month

A information disclosure vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0697 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0696 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0695 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0694 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0693 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0692 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0691 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0690 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0689 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0688 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0686 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0685 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android media framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0684 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0683 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0682 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0681 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0680 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0679 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0678 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0677 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0676 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0675 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0674 Jul 06, 20:29 HIGH PATCH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0673 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android media framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0672 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android libraries. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0671 Jul 06, 20:29 HIGH This Week

A remote code execution vulnerability in the Android libraries. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0670 Jul 06, 20:29 MEDIUM This Month

A denial of service vulnerability in the Android framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0669 Jul 06, 20:29 MEDIUM This Month

A information disclosure vulnerability in the Android framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0668 Jul 06, 20:29 MEDIUM This Month

A information disclosure vulnerability in the Android framework. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0667 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0666 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0665 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0664 Jul 06, 20:29 HIGH This Week

A elevation of privilege vulnerability in the Android framework. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-10709 Jun 30, 16:29 MEDIUM This Month

The lockscreen on Elephone P9000 devices (running Android 6.0) allows physically proximate attackers to bypass a wrong-PIN lockout feature by pressing backspace after each PIN guess. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-3750 Jun 29, 15:29 MEDIUM This Month

On Lenovo VIBE mobile phones, the Lenovo Security Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-3749 Jun 29, 15:29 MEDIUM This Month

On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in. Rated medium severity (CVSS 6.4), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-3748 Jun 29, 15:29 HIGH This Week

On Lenovo VIBE mobile phones, improper access controls on the nac_server component can be abused in conjunction with CVE-2017-3749 and CVE-2017-3750 to elevate privileges to the root user (commonly. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2015-3840 Jun 27, 20:29 MEDIUM POC This Month

The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses of SMS and MMS messages without the associated "WRITE_SMS". Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2017-0649 Jun 14, 13:29 HIGH This Week

An elevation of privilege vulnerability in the MediaTek sound driver could enable a local malicious application to execute arbitrary code within the context of the kernel. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-0647 Jun 14, 13:29 MEDIUM This Month

An information disclosure vulnerability in libziparchive could enable a local malicious application to access data outside of its permission levels. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0646 Jun 14, 13:29 MEDIUM This Month

An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0645 Jun 14, 13:29 MEDIUM This Month

An elevation of privilege vulnerability in Bluetooth could enable a local malicious application to access data outside of its permission levels. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0644 Jun 14, 13:29 MEDIUM PATCH This Month

A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0643 Jun 14, 13:29 MEDIUM PATCH This Month

A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0642 Jun 14, 13:29 MEDIUM PATCH This Month

A remote denial of service vulnerability in libhevc in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0641 Jun 14, 13:29 MEDIUM PATCH This Month

A remote denial of service vulnerability in libvpx in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0640 Jun 14, 13:29 MEDIUM PATCH This Month

A remote denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2017-0639 Jun 14, 13:29 MEDIUM This Month

An information disclosure vulnerability in Bluetooth component could enable a local malicious application to access data outside of its permission levels. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0638 Jun 14, 13:29 HIGH This Week

A remote code execution vulnerability in System UI component could enable an attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-0637 Jun 14, 13:29 HIGH PATCH This Week

A remote code execution vulnerability in libhevc in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Buffer Overflow vulnerability could allow attackers to corrupt memory to execute arbitrary code or crash the application.

CVE-2017-0636 Jun 14, 13:29 HIGH This Week

An elevation of privilege vulnerability in the MediaTek command queue driver could enable a local malicious application to execute arbitrary code within the context of the kernel. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

CVE-2017-8242 Jun 13, 20:29 MEDIUM PATCH This Month

In all Android releases from CAF using the Linux kernel, a race condition exists in a QTEE driver potentially leading to an arbitrary memory write. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required.

CVE-2017-8241 Jun 13, 20:29 HIGH PATCH This Week

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a WLAN function due to an incorrect message length. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2017-8240 Jun 13, 20:29 HIGH PATCH This Week

In all Android releases from CAF using the Linux kernel, a kernel driver has an off-by-one buffer over-read vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2017-8239 Jun 13, 20:29 MEDIUM PATCH This Month

In all Android releases from CAF using the Linux kernel, userspace-controlled parameters for flash initialization are not sanitized potentially leading to exposure of kernel memory. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Exposure of Sensitive Information vulnerability could allow attackers to access sensitive data that should not be disclosed.

CVE-2017-8238 Jun 13, 20:29 HIGH This Week

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a camera function. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2017-8237 Jun 13, 20:29 HIGH PATCH This Week

In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists while loading a firmware image. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.