Summary
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Android und Pixel/Nexus ausnutzen, um beliebigen Programmcode mit erhöhten Rechten auszuführen, um seine Privilegien zu erhöhen, um Informationen offenzulegen oder um einen Denial of Service Zustand herbeizuführen.
Product
Das Android Betriebssystem von Google ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 70
-
Critical 10.0
In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to an unusual root cause. This could lead to …
-
Critical 9.8
In smp_data_received of smp_l2c.cc, there is a possible out of bounds read followed by code execution due to a missing …
-
Critical 9.8
In prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect bounds check. This could le…
-
Critical 9.8
In ArrayConcatVisitor of builtins-array.cc, there is a possible type confusion due to improper input validation. This c…
-
High 8.8CVE-2018-9411 Public exploit
In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could l…
-
High 8.8
In handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a missing bounds check. …
-
High 8.4
In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free. This cou…
-
High 8.0
In handle_notification_response of btif_rc.cc, there is a possible out of bounds write due to a missing bounds check. T…
-
High 7.8
In rpc_msg_handler and related handlers of drivers/misc/mediatek/eccci/port_rpc.c, there is a possible out of bounds wr…
-
High 7.8
In gattServerSendResponseNative of com_android_bluetooth_gatt.cpp, there is a possible out of bounds stack write due to…
-
High 7.8
In f_hidg_read and hidg_disable of f_hid.c, there is a possible use-after-free due to improper locking. This could lead…
-
High 7.8
In CryptoPlugin::decrypt of CryptoPlugin.cpp, there is a possible out of bounds write due to a missing bounds check. Th…
-
High 7.8
In OSUInfo of OSUInfo.java, there is a possible escalation of privilege due to improper input validation. This could le…
-
High 7.8
In createPhonebookDialogView and createMapDialogView of BluetoothPermissionActivity.java, there is a possible permissio…
-
High 7.8
In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could l…
-
High 7.5
In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds read due to a missing bounds check. This cou…
-
Medium 6.5
In RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java, an incorrect implementation could cause wea…
-
Medium 6.5
In buildImageItemsIfPossible of ItemTable.cpp there is a possible out of bound read due to uninitialized data. This cou…
-
Medium 5.5
In analyzeAxes of FontUtils.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead …
-
Medium 5.5
In removeUnsynchronization of ID3.cpp there is a possible resource exhaustion due to improper input validation. This co…
-
Medium 5.5
In BnCameraService::onTransact of CameraService.cpp, there is a possible information disclosure due to uninitialized da…
-
Medium 5.5
In writeInplace of Parcel.cpp, there is a possible information leak across processes, using Binder, due to uninitialize…
-
Medium 5.5
In ihevcd_parse_slice_header of ihevcd_parse_slice_header.c there is a possible out of bound read due to missing bounds…
-
Unscored —CVE-2016-2108 EPSS 78%
The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary …
-
Unscored —
An elevation of privilege vulnerability in the Qualcomm sound driver could enable a local malicious application to exec…
-
Unscored —CVE-2017-1000 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to a…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) durin…
-
Unscored —
Wi-Fi Protected Access (WPA and WPA2) allows reinstallation of the Group Temporal Key (GTK) during the four-way handsha…
-
Unscored —
When HOST sends a Special command ID packet, Controller triggers a RAM Dump and FW reset in Snapdragon Mobile in versio…
-
Unscored —
Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera c…
-
Unscored —
In QTEE, an incorrect fuse value can be blown in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version M…
-
Unscored —
Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile …
-
Unscored —
Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory co…
-
Unscored —
In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting …
-
Unscored —
In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snap…
-
Unscored —CVE-2017-1821 Rejected
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to a…
-
Unscored —
While iterating through the models contained in a fixed-size array in the actData structure, which also stores an incor…
-
Unscored —
A new account can be inserted into simContacts service using Android command line tool in Snapdragon Automobile, Snapdr…
-
Unscored —
Secure camera logic allows display/secure camera controllers to access HLOS memory during secure display or camera sess…
-
Unscored —
When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop with…
-
Unscored —
An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is big…
-
Unscored —
Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdrago…
-
Unscored —
The netfilter subsystem in the Linux kernel through 4.15.7 mishandles the case of a rule blob that contains a jump but …
-
Unscored —
Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secur…
-
Unscored —
In ADSP RPC in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, a Use After Free condition can occur in ve…
-
Unscored —
Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From …
-
Unscored —
Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that lea…
-
Unscored —
In the cpuidle driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linu…
-
Unscored —
An integer overflow to buffer overflow vulnerability exists in the ADSPRPC heap manager in all Android releases(Android…
-
Unscored —
The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause …
-
Unscored —
In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, …
-
Unscored —
Improper Validation of Array Index In the adreno OpenGL driver in Snapdragon Automobile, Snapdragon Mobile and Snapdrag…
-
Unscored —
While padding or shrinking a nested wmi packet in all Android releases from CAF using the Linux kernel (Android for MSM…
-
Unscored —
In the audio debugfs in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD …
-
Unscored —
Due to a race condition in the MDSS MDP driver in all Android releases from CAF using the Linux kernel (Android for MSM…
-
Unscored —
In __wlan_hdd_cfg80211_vendor_scan() in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox …
-
Unscored —
While processing a WMI_APFIND event in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox O…
-
Unscored —
While processing a debug log event from firmware in all Android releases from CAF using the Linux kernel (Android for M…
-
Unscored —
While parsing over-the-air information elements in all Android releases from CAF using the Linux kernel (Android for MS…
-
Unscored —CVE-2018-5873 Public exploit
An issue was discovered in the __ns_get_path function in fs/nsfs.c in the Linux kernel before 4.11. Due to a race condi…
-
Unscored —
While parsing an mp4 file, a stack-based buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snap…
-
Unscored —
While parsing an mp4 file, an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile, Snapdra…
-
Unscored —
While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.
-
Unscored —
While sending the response to a RIL_REQUEST_GET_SMSC_ADDRESS message, a buffer overflow can occur in Snapdragon Automob…
-
Unscored —
While parsing a Flac file with a corrupted comment block, a buffer over-read can occur in Snapdragon Automobile, Snapdr…
-
Unscored —
Possible buffer overflow in msm_adsp_stream_callback_put due to lack of input validation of user-provided data that lea…
-
Unscored —
The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial…
-
Unscored —
Race condition in the store_int_with_restart() function in arch/x86/kernel/cpu/mcheck/mce.c in the Linux kernel through…
-
Unscored —
In driver_override_store and driver_override_show of bus.c, there is a possible double free due to improper locking. Th…
-
Unscored —
In get_futex_key of futex.c, there is a use-after-free due to improper locking. This could lead to local escalation of …
Revision history
-
#4
Referenz(en) aufgenommen: EUVD-2017-10837
-
#3
New remediations available
-
#1
Initial Release
-
#2
Version nicht vorhanden
References
-
Android Security Bulletin Juli 2018 vom 2018-07-02
https://source.android.com/security/bulletin/2018-07-01
-
Pixel/Nexus Security Bulletin Juli 2018 vom 2018-07-02
https://source.android.com/security/bulletin/pixel/2018-07-01
-
Oracle Linux Security Advisory ELSA-2018-4227 vom 2018-09-26
http://linux.oracle.com/errata/ELSA-2018-4227.html