Back to all versions

4.4.4

Graph of vulnerabilities affecting this version

Key to graph

• Black: affecting all manufacturers
• Red: only affecting some manufacturers
• Solid line: at least one unpatched vulnerability
• Dashed line: all vulnerabilities on this path are patched

Fake ID

(json)

• CVE numbers:
• Coordinated disclosure?: true
• Categories: signature
• Details: The software does not properly validate an application's certificate chain. An application can supply a specially crafted application identity certificate to impersonate a privileged application and gain access to vendor-specific device administration extensions. The vulnerability resides in the createChain() and findCert() functions of the Android JarUtils class. [securitytracker-1030654] Google bug 13678484 [blackhat-briefing-fakeid]
• Discovered by: Jeff Forristal of Bluebox [bluebox-fakeid] on: Unknown
• Reported on: 2014-07-29 [ars-fake-id]
• Fixed on: 2014-04-17 [fakeid-patch]
• Fix released on: Unknown
• Affected versions: 2.1 -- 4.4 [ars-fake-id] regex: (2.[1-9].[0-9])|(3.[0-9].[0-9])|(4.[0-3].[0-9])|(4.4.[0-4])
• Affected devices:
• Affected manufacturers: all [bluebox-fakeid]
• Fixed versions: there is no single, specific “fixed” version of Android. In fact, multiple vendors are maintaining the same prior version number, and only patching the functionality. We have confirmed “fixed” versions existing within the ranges of 4.1, 4.2, 4.3, and 4.4 [bluebox-fakeid]
• Submission: by: Khilan Gudka, on: 2014-07-29; by: Daniel R. Thomas, on: 2014-09-09; by: Jeff Forristal, on: 2014-09-11

TowelRoot

(json)

• CVE numbers: CVE-2014-3153 [threatpost-towelroot][archived]
• Coordinated disclosure?: true
• Categories: kernel
• Details: The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification. [CVE-2014-3153]
• Discovered by: Pinkie Pie [DSA-2949-1] on: 2014-05-03 [CVE-2014-3153]
• Reported on: 2014-06-05 [openwall-CVE-2014-3153]
• Fixed on: 2014-06-03 [futex-patch]
• Fix released on: Unknown
• Affected versions: 4.4 and earlier [threatpost-towelroot][archived] regex: ([1-3].[0-9].[0-9])|(4.[0-3].[0-9])|(4.4.[0-4])
• Affected devices:
• Affected manufacturers: all [threatpost-towelroot][archived]
• Fixed versions:
• Submission:

ObjectInputStream deserializable

(json)

• CVE numbers: CVE-2014-7911 [fulldisclosure-ois]
• Coordinated disclosure?: true
• Categories: system
• Details: In Android <5.0, java.io.ObjectInputStream did not check whether the Object that is being deserialized is actually serializable. That issue was fixed in Android 5.0. This means that when ObjectInputStream is used on untrusted inputs, an attacker can cause an instance of any class with a non-private parameterless constructor to be created. All fields of that instance can be set to arbitrary values. The malicious object will then typically either be ignored or cast to a type to which it doesn't fit, implying that no methods will be called on it and no data from it will be used. However, when it is collected by the GC, the GC will call the object's finalize method. [fulldisclosure-ois] luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291. [CVE-2014-7911] A POC local root exploit is available [CVE-2014-7911_poc]
• Discovered by: Jann Horn [fulldisclosure-ois] on: 2014-06-22 [fulldisclosure-ois]
• Reported on: 2014-11-14 [fulldisclosure-ois]
• Fixed on: 2014-06-25 [ois-fix]
• Fix released on: 2014-11-03 [citation-needed]
• Affected versions: 1.0-4.4.4 [CVE-2014-7911] regex: ([1-3].[0-9].[0-9])|(4.[0-3].[0-9])|(4.4.[0-4])
• Affected devices: all [fulldisclosure-ois]
• Affected manufacturers: all [fulldisclosure-ois]
• Fixed versions: 5.0.0 [CVE-2014-7911]
• Submission: by: Jann Horn, on: 2014-12-14; by: Laurent Simon, on: 2015-03-12

CVE-2015-6640

(json)

• CVE numbers: CVE-2015-6640 [Bulletin-CVE-2015-6640]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Kernel
• Details: The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123. [NIST-CVE-2015-6640]
• Discovered by: on: Unknown
• Reported on: 2016-01-01 [Bulletin-CVE-2015-6640]
• Fixed on: 2014-08-05 [ANDROID-20017123]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0 [Bulletin-CVE-2015-6640] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6640]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0 [Bulletin-CVE-2015-6640]
• Submission: by: Daniel Carter, on: 2019-07-29

prctl_set_vma_anon_name

(json)

• CVE numbers: CVE-2015-6640 [prctl-vma-bulletin]
• Coordinated disclosure?: true
• Categories: kernel
• Details: An elevation of privilege vulnerability in the kernel could enable a local malicious application to execute arbitrary code in the kernel [prctl-vma-bulletin]
• Discovered by: Edward Huang [android-paper] on: Unknown
• Reported on: Unknown
• Fixed on: 2014-08-05 [prctl-vma-commit]
• Fix released on: 2014-08-12 [prctl-vma-commit]
• Affected versions: 4.4.4 to 6.0 [prctl-vma-bulletin] regex: (4.[4-9].[4-9])|(5.[0-9].[0-9])|(6.0.[0-9])
• Affected devices: all [citation-needed]
• Affected manufacturers: all [citation-needed]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-09

CVE-2014-6060

(json)

• CVE numbers: CVE-2014-6060 [Bulletin-CVE-2014-6060]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in DHCPCD
• Details: The get_option function in dhcpcd 4.0.0 through 6.x before 6.4.3 allows remote DHCP servers to cause a denial of service by resetting the DHO_OPTIONSOVERLOADED option in the (1) bootfile or (2) servername section, which triggers the option to be processed again. [NIST-CVE-2014-6060]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2014-6060]
• Fixed on: 2014-08-15 [ANDROID-16677003]
• Fix released on: Unknown
• Affected versions: 4.4.4 [Bulletin-CVE-2014-6060] regex: (4.4.4)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2014-6060]
• Fixed versions: 4.4.4 [Bulletin-CVE-2014-6060]
• Submission: by: Daniel Carter, on: 2019-07-29

Full TrustZone

(json)

• CVE numbers:
• Coordinated disclosure?: true
• Categories: kernel, system
• Details: A vulnerability in a modified kernel means that a series of exploits can be used to obtain access to the Trusted Execution Environment [msm8974-pt1][archived]
• Discovered by: Gal Beniamini (laginimaineb) [msm8974-pt3][archived] on: Unknown
• Reported on: 2014-09-19 [msm8974-pt3][archived]
• Fixed on: 2014-10-01 [msm8974-pt3][archived]
• Fix released on: Unknown
• Affected versions: Crafted ROM based on 4.4.4 [msm8974-pt3][archived] regex: 4.4.4
• Affected devices: All devices using the MSM8974 SoCMSM8974 SoC [msm8974-pt3][archived]
• Affected manufacturers: Samsung [msm8974-pt3][archived], HTC [msm8974-pt3][archived], LG [msm8974-pt3][archived], Sony [msm8974-pt3][archived], OnePlus [msm8974-pt3][archived], Acer [msm8974-pt3][archived], Asus [msm8974-pt3][archived], Gionee [msm8974-pt3][archived], ZTE [msm8974-pt3][archived], Sharp [msm8974-pt3][archived], Pantech [msm8974-pt3][archived], Lenovo [msm8974-pt3][archived], Oppo [msm8974-pt3][archived], Vivo [msm8974-pt3][archived], IUNI [msm8974-pt3][archived], Hisense [msm8974-pt3][archived], Coolpad [msm8974-pt3][archived], Xiaomi [msm8974-pt3][archived], InFocus [msm8974-pt3][archived]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-09

Mediaserver code execution

(json)

• CVE numbers: CVE-2014-7920 [mediaserver-blog][archived], CVE-2014-7921 [mediaserver-blog][archived]
• Coordinated disclosure?: true
• Categories: kernel, system
• Details: Two vulnerabilities which allow arbitrary code execution in the mediaserver process [mediaserver-blog][archived]
• Discovered by: Gal Beniamini (laginimaineb) [mediaserver-blog][archived] on: Unknown
• Reported on: 2014-10-14 [mediaserver-blog][archived]
• Fixed on: 2014-10-28 [mediaserver-commit]
• Fix released on: 2014-12-04 [mediaserver-commit]
• Affected versions: 2.2 to 5.0 [mediaserver-blog][archived] regex: (2.[2-9].[0-9])|([3-4].[0-9].[0-9])|(5.0.[0-9])
• Affected devices: all [mediaserver-blog][archived]
• Affected manufacturers: all [mediaserver-blog][archived]
• Fixed versions: 5.1 [mediaserver-blog][archived]
• Submission: by: Daniel Carter, on: 2019-07-09

dhcpd buffer overrun

(json)

• CVE numbers: CVE-2014-7912 [dhcpd-fix], CVE-2014-7913 [dhcpd-fix]
• Coordinated disclosure?: true
• Categories: network
• Details: The specific flaw exists within the parsing of the DHCP options in a DHCP ACK packet. The vulnerability is triggered when the LENGTH of an option, when added to the current read position, exceeds the actual length of the DHCP options buffer. An attacker can leverage this vulnerability to execute code on the device. [ZDI-15-093] This remote code execution vulnerability executes code as the dhcp user which limit's its severity [citation-needed]
• Discovered by: Jüri Aedla [ZDI-15-093] on: 2014-11-13 [ZDI-15-093]
• Reported on: 2015-03-12 [ZDI-15-093]
• Fixed on: 2014-11-15 [dhcpd-fix]
• Fix released on: Unknown
• Affected versions: All versions below 5.1 [dhcpd-circl] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])
• Affected devices: all [dhcpd-circl]
• Affected manufacturers: all [dhcpd-circl]
• Fixed versions: 5.1 [dhcpd-circl]
• Submission: by: Laurent Simon, on: 2015-03-14; by: Daniel R. Thomas, on: 2015-03-24

CVE-2014-9028

(json)

• CVE numbers: CVE-2014-9028 [Bulletin-CVE-2014-9028]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libFLAC
• Details: Heap-based buffer overflow in stream_decoder.c in libFLAC before 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file. [NIST-CVE-2014-9028]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2014-9028]
• Fixed on: 2015-02-27 [2]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2014-9028] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2014-9028]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3832

(json)

• CVE numbers: CVE-2015-3832 [Bulletin-CVE-2015-3832]
• Coordinated disclosure?: unknown
• Categories: Buffer overflows in libstagefright MPEG4Extractor.cpp
• Details: Multiple buffer overflows in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via invalid size values of NAL units in MP4 data, aka internal bug 19641538. [NIST-CVE-2015-3832]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-3832]
• Fixed on: 2015-04-01 [ANDROID-19641538]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3832] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3832]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-1538

(json)

• CVE numbers: CVE-2015-1538 [Bulletin-CVE-2015-1538]
• Coordinated disclosure?: unknown
• Categories: Integer overflows during MP4 atom processing
• Details: Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496. [NIST-CVE-2015-1538]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-1538]
• Fixed on: 2015-04-08 [ANDROID-20139950]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-1538] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-1538]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-1539

(json)

• CVE numbers: CVE-2015-1539 [Bulletin-CVE-2015-1539]
• Coordinated disclosure?: unknown
• Categories: An integer underflow in ESDS processing
• Details: Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493. [NIST-CVE-2015-1539]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-1539]
• Fixed on: 2015-04-08 [ANDROID-20139950]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-1539] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-1539]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

Stagefright

(json)

• CVE numbers: CVE-2015-1538 [nakedsecurity-stagefright], CVE-2015-1539 [nakedsecurity-stagefright], CVE-2015-3824 [nakedsecurity-stagefright], CVE-2015-3826 [nakedsecurity-stagefright], CVE-2015-3827 [nakedsecurity-stagefright], CVE-2015-3828 [nakedsecurity-stagefright], CVE-2015-3829 [nakedsecurity-stagefright]
• Coordinated disclosure?: true
• Categories: system, network
• Details: Drake said that the vulnerabilities can be exploited by sending a single multimedia text message to an unpatched Android smartphone. While the exploit is deadly, in some cases, where phones parse the attack code prior to the message being opened, the exploits are silent and the user would have little chance of defending their data. [techworm-stagefright] Stagefright is the media playback service for Android, introduced in Android 2.2 (Froyo). Stagefright in versions of Android prior to 5.1.1_r9 may contain multiple vulnerabilities, including several integer overflows, which may allow a remote attacker to execute code on the device. [cert-kb-stagefright]
• Discovered by: Joshua J. Drake [zimperium-stagefright] on: 2015-04-09 [techworm-stagefright]
• Reported on: 2015-07-21 [zimperium-stagefright]
• Fixed on: 2015-04-08 [stagefright-fix-2]
• Fix released on: 2015-08-03 [androidpolice-sprint-update]
• Affected versions: 2.2-5.1.0 [cert-kb-stagefright] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])|(5.1.[0-1])
• Affected devices: all [cert-kb-stagefright]
• Affected manufacturers: all [cert-kb-stagefright]
• Fixed versions: 5.1.1_r9 [cert-kb-stagefright]
• Submission: by: Laurent Simon, on: 2015-07-27

CVE-2015-3877

(json)

• CVE numbers: CVE-2015-3877 [Bulletin-CVE-2015-3877]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Skia
• Details: Skia, as used in Android before 5.1.1 LMY48T, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20723696. [NIST-CVE-2015-3877]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3877]
• Fixed on: 2015-04-16 [ANDROID-20723696]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3877] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3877]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3636

(json)

• CVE numbers: CVE-2015-3636 [Bulletin-CVE-2015-3636]
• Coordinated disclosure?: unknown
• Categories: Elevation Privilege Vulnerability in Kernel
• Details: The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect. [NIST-CVE-2015-3636]
• Discovered by: on: Unknown
• Reported on: 2015-09-01 [Bulletin-CVE-2015-3636]
• Fixed on: 2015-05-02 [ANDROID-20770158]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3636] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3636]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3824

(json)

• CVE numbers: CVE-2015-3824 [Bulletin-CVE-2015-3824]
• Coordinated disclosure?: unknown
• Categories: Integer overflow in libstagefright when parsing the MPEG4 tx3g atom
• Details: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly restrict size addition, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via a crafted MPEG-4 tx3g atom, aka internal bug 20923261. [NIST-CVE-2015-3824]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-3824]
• Fixed on: 2015-05-04 [ANDROID-20923261]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3824] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3824]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3827

(json)

• CVE numbers: CVE-2015-3827 [Bulletin-CVE-2015-3827]
• Coordinated disclosure?: unknown
• Categories: Integer underflow in libstagefright when processing MPEG4 covr atoms
• Details: The MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I does not validate the relationship between chunk sizes and skip sizes, which allows remote attackers to execute arbitrary code or cause a denial of service (integer underflow and memory corruption) via crafted MPEG-4 covr atoms, aka internal bug 20923261. [NIST-CVE-2015-3827]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-3827]
• Fixed on: 2015-05-04 [ANDROID-20923261]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3827] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3827]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3867

(json)

• CVE numbers: CVE-2015-3867 [Bulletin-CVE-2015-3867]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23213430. [NIST-CVE-2015-3867]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3867]
• Fixed on: 2015-05-08 [ANDROID-23213430]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3867] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3867]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3836

(json)

• CVE numbers: CVE-2015-3836 [Bulletin-CVE-2015-3836]
• Coordinated disclosure?: unknown
• Categories: Buffer overflow in Sonivox Parse_wave
• Details: The Parse_wave function in arm-wt-22k/lib_src/eas_mdls.c in the Sonivox DLS-to-EAS converter in Android before 5.1.1 LMY48I does not reject a negative value for a certain size field, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow) via crafted XMF data, aka internal bug 21132860. [NIST-CVE-2015-3836]
• Discovered by: on: Unknown
• Reported on: 2015-08-01 [Bulletin-CVE-2015-3836]
• Fixed on: 2015-05-14 [ANDROID-21132860]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3836] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3836]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

One class to rule them all

(json)

• CVE numbers: CVE-2015-3837 [CVE-2015-3837], CVE-2015-3825 [woot15-paper-peles], ANDROID-21437603 [woot15-paper-peles], ANDROID-21583849 [woot15-paper-peles]
• Coordinated disclosure?: true
• Categories: system
• Details: This vulnerability allows for arbitrary code execution in the context of many apps and services and results in elevation of privileges. There is a Proof-of-Concept exploit against the Google Nexus 5 device, that achieves code execution inside the highly privileged system_server process, and then either replaces an existing arbitrary application on the device with our own malware app or changes the device’s SELinux policy. For some other devices, it is also possible to gain kernel code execution by loading an arbitrary kernel modules. This vulnerability was responsibly disclosed to the Android Security Team which tagged it as CVE-2015-3825 internally as ANDROID-21437603/ANDROID-21583849 and patched Android 4.4 / 5.x / M and Google Play Services. [woot15-paper-peles] CVE-2015-3825 is the wrong CVE number (duplicate), CVE-2015-3837 should be used instead [CVE-2015-3825] The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603. [CVE-2015-3837]
• Discovered by: Or Peles and Roee Hay {orpeles,roeeh}@il.ibm.com [woot15-paper-peles] on: 2015-05-22 [woot15-paper-peles]
• Reported on: 2015-06-01 [NexusSecurityBulletinAugust2015][archived]
• Fixed on: 2015-05-28 [OneClassPatch]
• Fix released on: 2015-08-05 [droid-life-5-1-1-lmy48i][archived]
• Affected versions: 4.3-5.1, M (Preview 1) [woot15-paper-peles] regex: (4.[0-3].[0-9])|(4.4.[0-4])|(5.0.[0-9])|(5.1.[0-1])
• Affected devices: all [citation-needed]
• Affected manufacturers: all [citation-needed]
• Fixed versions: 4.4, 5.x, M [woot15-paper-peles]
• Submission: by: Laurent Simon, on: 2015-08-10; by: Roee Hay, on: 2015-10-14

CVE-2015-6601

(json)

• CVE numbers: CVE-2015-6601 [Bulletin-CVE-2015-6601]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22935234. [NIST-CVE-2015-6601]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6601]
• Fixed on: 2015-06-04 [ANDROID-22935234]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6601] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6601]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3870

(json)

• CVE numbers: CVE-2015-3870 [Bulletin-CVE-2015-3870]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22771132. [NIST-CVE-2015-3870]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3870]
• Fixed on: 2015-06-25 [ANDROID-22771132]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3870] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3870]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3823

(json)

• CVE numbers: CVE-2015-3823 [Bulletin-CVE-2015-3823]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 21335999. [NIST-CVE-2015-3823]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3823]
• Fixed on: 2015-07-16 [ANDROID-21335999]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3823] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3823]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3871

(json)

• CVE numbers: CVE-2015-3871 [Bulletin-CVE-2015-3871]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23031033. [NIST-CVE-2015-3871]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3871]
• Fixed on: 2015-08-03 [ANDROID-23031033]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3871] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3871]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6600

(json)

• CVE numbers: CVE-2015-6600 [Bulletin-CVE-2015-6600]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 22882938. [NIST-CVE-2015-6600]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6600]
• Fixed on: 2015-08-04 [ANDROID-22882938]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6600] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6600]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3869

(json)

• CVE numbers: CVE-2015-3869 [Bulletin-CVE-2015-3869]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23036083. [NIST-CVE-2015-3869]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3869]
• Fixed on: 2015-08-06 [ANDROID-23036083]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3869] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3869]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6617

(json)

• CVE numbers: CVE-2015-6617 [Bulletin-CVE-2015-6617]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Skia
• Details: Skia, as used in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23648740. [NIST-CVE-2015-6617]
• Discovered by: on: Unknown
• Reported on: 2015-12-01 [Bulletin-CVE-2015-6617]
• Fixed on: 2015-08-06 [ANDROID-23648740]
• Fix released on: Unknown
• Affected versions: 6.0 and below [Bulletin-CVE-2015-6617] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6617]
• Fixed versions: 6.0 and below [Bulletin-CVE-2015-6617]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3864

(json)

• CVE numbers: CVE-2015-3864 [Bulletin-CVE-2015-3864]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824. [NIST-CVE-2015-3864]
• Discovered by: on: Unknown
• Reported on: 2015-09-01 [Bulletin-CVE-2015-3864]
• Fixed on: 2015-08-07 [ANDROID-23034759]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3864] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3864]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6604

(json)

• CVE numbers: CVE-2015-6604 [Bulletin-CVE-2015-6604]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23129786. [NIST-CVE-2015-6604]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6604]
• Fixed on: 2015-08-12 [ANDROID-23129786]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6604] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6604]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6603

(json)

• CVE numbers: CVE-2015-6603 [Bulletin-CVE-2015-6603]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23227354. [NIST-CVE-2015-6603]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6603]
• Fixed on: 2015-08-14 [ANDROID-23227354]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6603] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6603]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3876

(json)

• CVE numbers: CVE-2015-3876 [Bulletin-CVE-2015-3876]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file. [NIST-CVE-2015-3876]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3876]
• Fixed on: 2015-08-15 [ANDROID-23285192]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3876] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3876]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

Stagefright2

(json)

• CVE numbers: CVE-2015-6602 [zimperium-stagefright2], CVE-2015-3876 [android-security-october][archived]
• Coordinated disclosure?: true
• Categories: system, network
• Details: Meet Stagefright 2.0, a set of two vulnerabilities that manifest when processing specially crafted MP3 audio or MP4 video files. The first vulnerability (in libutils) impacts almost every Android device since version 1.0 released in 2008. We found methods to trigger that vulnerability in devices running version 5.0 and up using the second vulnerability (in libstagefright). Google assigned CVE-2015-6602 to vulnerability in libutils. [zimperium-stagefright2]
• Discovered by: Joshua J. Drake [zimperium-stagefright2] on: 2015-08-15 [zimperium-stagefright2]
• Reported on: 2015-10-01 [zimperium-stagefright2]
• Fixed on: Unknown
• Fix released on: 2015-10-05 [register-stagefright2]
• Affected versions: 5.1 and below [android-security-october][archived] regex: ([1-4].[0-9].[0-9])|(5.0.[0-9])|(5.1.[0-1])
• Affected devices: all [zimperium-stagefright2]
• Affected manufacturers: all [zimperium-stagefright2]
• Fixed versions: 5.1.1, LMY48T or later, LMY48W [android-security-october][archived]
• Submission: by: Daniel R. Thomas, on: 2015-10-06; by: Laurent Simon, on: 2015-10-02; by: Alastair R. Beresford, on: 2015-10-01

CVE-2015-3868

(json)

• CVE numbers: CVE-2015-3868 [Bulletin-CVE-2015-3868]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23270724. [NIST-CVE-2015-3868]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3868]
• Fixed on: 2015-08-18 [ANDROID-23270724]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3868] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3868]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3873

(json)

• CVE numbers: CVE-2015-3873 [Bulletin-CVE-2015-3873]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23016072, 23248776, 23247055, 22845824, 22008959, 21814993, 21048776, 20718524, 20674674, 22388975, 20674086, 21443020, and 22077698, a different vulnerability than CVE-2015-7716. [NIST-CVE-2015-3873]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3873]
• Fixed on: 2015-08-18 [ANDROID-23247055]
• Fix released on: Unknown
• Affected versions: 5.1 and below, 5.0 and 5.1 [Bulletin-CVE-2015-3873] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3873]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3875

(json)

• CVE numbers: CVE-2015-3875 [Bulletin-CVE-2015-3875]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libutils
• Details: libutils in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22952485. [NIST-CVE-2015-3875]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3875]
• Fixed on: 2015-08-18 [ANDROID-22952485]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3875] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3875]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6598

(json)

• CVE numbers: CVE-2015-6598 [Bulletin-CVE-2015-6598]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638. [NIST-CVE-2015-6598]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6598]
• Fixed on: 2015-08-18 [ANDROID-23306638]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6598] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6598]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3872

(json)

• CVE numbers: CVE-2015-3872 [Bulletin-CVE-2015-3872]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23346388. [NIST-CVE-2015-3872]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3872]
• Fixed on: 2015-08-19 [ANDROID-23346388]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3872] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3872]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6602

(json)

• CVE numbers: CVE-2015-6602 [Bulletin-CVE-2015-6602]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libutils
• Details: libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x. [NIST-CVE-2015-6602]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6602]
• Fixed on: 2015-08-20 [ANDROID-23290056]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6602] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6602]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-3874

(json)

• CVE numbers: CVE-2015-3874 [Bulletin-CVE-2015-3874]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in Sonivox
• Details: The Sonivox components in Android before 5.1.1 LMY48T allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 23335715, 23307276, and 23286323. [NIST-CVE-2015-3874]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-3874]
• Fixed on: 2015-08-21 [2]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-3874] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-3874]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6599

(json)

• CVE numbers: CVE-2015-6599 [Bulletin-CVE-2015-6599]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libstagefright
• Details: libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23416608. [NIST-CVE-2015-6599]
• Discovered by: on: Unknown
• Reported on: 2015-10-01 [Bulletin-CVE-2015-6599]
• Fixed on: 2015-08-21 [ANDROID-23416608]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6599] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6599]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6609

(json)

• CVE numbers: CVE-2015-6609 [Bulletin-CVE-2015-6609]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in libutils
• Details: libutils in Android before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted audio file, aka internal bug 22953624. [NIST-CVE-2015-6609]
• Discovered by: on: Unknown
• Reported on: 2015-11-01 [Bulletin-CVE-2015-6609]
• Fixed on: 2015-09-02 [ANDROID-22953624]
• Fix released on: Unknown
• Affected versions: 6.0 and below [Bulletin-CVE-2015-6609] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6609]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6608

(json)

• CVE numbers: CVE-2015-6608 [Bulletin-CVE-2015-6608]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in Mediaserver
• Details: mediaserver in Android 5.x before 5.1.1 LMY48X and 6.0 before 2015-11-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 19779574, 23680780, 23876444, and 23658148, a different vulnerability than CVE-2015-8072 and CVE-2015-8073. [NIST-CVE-2015-6608]
• Discovered by: on: Unknown
• Reported on: 2015-11-01 [Bulletin-CVE-2015-6608]
• Fixed on: 2015-09-08 [ANDROID-23876444]
• Fix released on: Unknown
• Affected versions: 5.0, 5.1, 6.0, 4.4, 5.0, 5.1, 6.0, 4.4 and 5.1, 5.0, 5.1, 6.0 [Bulletin-CVE-2015-6608] regex: (5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])|(4.4.[0-9])|(5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])|(4.4.[0-9])|(5.1.[0-9])|(5.0.[0-9])|(5.1.[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6608]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6619

(json)

• CVE numbers: CVE-2015-6619 [Bulletin-CVE-2015-6619]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege in Kernel
• Details: The kernel in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows attackers to gain privileges via a crafted application, aka internal bug 23520714. [NIST-CVE-2015-6619]
• Discovered by: on: Unknown
• Reported on: 2015-12-01 [Bulletin-CVE-2015-6619]
• Fixed on: 2015-09-22 [ANDROID-23520714]
• Fix released on: Unknown
• Affected versions: 6.0 and below [Bulletin-CVE-2015-6619] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6619]
• Fixed versions: 6.0 and below [Bulletin-CVE-2015-6619]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6616

(json)

• CVE numbers: CVE-2015-6616 [Bulletin-CVE-2015-6616]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in Mediaserver
• Details: mediaserver in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bugs 24630158 and 23882800, a different vulnerability than CVE-2015-8505, CVE-2015-8506, and CVE-2015-8507. [NIST-CVE-2015-6616]
• Discovered by: on: Unknown
• Reported on: 2015-12-01 [Bulletin-CVE-2015-6616]
• Fixed on: 2015-10-05 [ANDROID-24630158]
• Fix released on: Unknown
• Affected versions: 6.0 and below, 5.1 and below, 6.0 and below, 6.0 [Bulletin-CVE-2015-6616] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6616]
• Fixed versions: 6.0 and below, 5.1 and below, 6.0 and below, 6.0 [Bulletin-CVE-2015-6616]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6634

(json)

• CVE numbers: CVE-2015-6634 [Bulletin-CVE-2015-6634]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in Display Driver
• Details: The display drivers in Android before 5.1.1 LMY48Z allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 24163261. [NIST-CVE-2015-6634]
• Discovered by: on: Unknown
• Reported on: 2015-12-01 [Bulletin-CVE-2015-6634]
• Fixed on: 2015-10-16 [ANDROID-24163261]
• Fix released on: Unknown
• Affected versions: 5.1 and below [Bulletin-CVE-2015-6634] regex: ([1-4].[0-9].[0-9])|(5.[0-1].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6634]
• Fixed versions: 5.1 and below [Bulletin-CVE-2015-6634]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0803

(json)

• CVE numbers: CVE-2016-0803 [Bulletin-CVE-2016-0803]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation in the (1) SoftMPEG4Encoder or (2) SoftVPXEncoder component, aka internal bug 25812794. [NIST-CVE-2016-0803]
• Discovered by: on: Unknown
• Reported on: 2016-02-01 [Bulletin-CVE-2016-0803]
• Fixed on: 2015-11-20 [ANDROID-25812794]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0803] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0803]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0803]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0801

(json)

• CVE numbers: CVE-2016-0801 [Bulletin-CVE-2016-0801]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Broadcom Wi-Fi Driver
• Details: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25662029. [NIST-CVE-2016-0801]
• Discovered by: on: Unknown
• Reported on: 2016-02-01 [Bulletin-CVE-2016-0801]
• Fixed on: 2015-11-30 [ANDROID-25662029]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0801] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2016-0801]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0801]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6633

(json)

• CVE numbers: CVE-2015-6633 [Bulletin-CVE-2015-6633]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in Display Driver
• Details: The display drivers in Android before 5.1.1 LMY48Z and 6.0 before 2015-12-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23987307. [NIST-CVE-2015-6633]
• Discovered by: on: Unknown
• Reported on: 2015-12-01 [Bulletin-CVE-2015-6633]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 6.0 and below [Bulletin-CVE-2015-6633] regex: ([1-5].[0-9].[0-9])|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6633]
• Fixed versions: 6.0 and below [Bulletin-CVE-2015-6633]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0802

(json)

• CVE numbers: CVE-2016-0802 [Bulletin-CVE-2016-0802]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Broadcom Wi-Fi Driver
• Details: The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal bug 25306181. [NIST-CVE-2016-0802]
• Discovered by: on: Unknown
• Reported on: 2016-02-01 [Bulletin-CVE-2016-0802]
• Fixed on: 2015-12-09 [ANDROID-25306181]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0802] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2016-0802]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0802]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0818

(json)

• CVE numbers: CVE-2016-0818 [Bulletin-CVE-2016-0818]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege in Conscrypt
• Details: The caching functionality in the TrustManagerImpl class in TrustManagerImpl.java in Conscrypt in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 mishandles the distinction between an intermediate CA and a trusted root CA, which allows man-in-the-middle attackers to spoof servers by leveraging access to an intermediate CA to issue a certificate, aka internal bug 26232830. [NIST-CVE-2016-0818]
• Discovered by: on: Unknown
• Reported on: 2016-03-01 [Bulletin-CVE-2016-0818]
• Fixed on: 2015-12-20 [[2]]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0818] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0818]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0818]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-6637

(json)

• CVE numbers: CVE-2015-6637 [Bulletin-CVE-2015-6637]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in misc-sd driver
• Details: The MediaTek misc-sd driver in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted application, aka internal bug 25307013. [NIST-CVE-2015-6637]
• Discovered by: on: Unknown
• Reported on: 2016-01-01 [Bulletin-CVE-2015-6637]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-6637] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-6637]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-6637]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2464

(json)

• CVE numbers: CVE-2016-2464 [Bulletin-CVE-2016-2464]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libwebm
• Details: libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted mkv file, aka internal bug 23167726. [NIST-CVE-2016-2464]
• Discovered by: on: Unknown
• Reported on: 2016-06-01 [Bulletin-CVE-2016-2464]
• Fixed on: 2016-01-11 [2]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2464] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2464]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2464]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0815

(json)

• CVE numbers: CVE-2016-0815 [Bulletin-CVE-2016-0815]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349. [NIST-CVE-2016-0815]
• Discovered by: on: Unknown
• Reported on: 2016-03-01 [Bulletin-CVE-2016-0815]
• Fixed on: 2016-01-12 [ANDROID-26365349]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0815] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0815]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0815]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0838

(json)

• CVE numbers: CVE-2016-0838 [Bulletin-CVE-2016-0838]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative number of samples, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to arm-wt-22k/lib_src/eas_wtengine.c and arm-wt-22k/lib_src/eas_wtsynth.c, aka internal bug 26366256. [NIST-CVE-2016-0838]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2016-0838]
• Fixed on: 2016-01-12 [2]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0838] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0838]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0838]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-1621

(json)

• CVE numbers: CVE-2016-1621 [Bulletin-CVE-2016-1621]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerabilities in libvpx
• Details: libvpx in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.0 before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, related to libwebm/mkvparser.cpp and other files, aka internal bug 23452792. [NIST-CVE-2016-1621]
• Discovered by: on: Unknown
• Reported on: 2016-03-01 [Bulletin-CVE-2016-1621]
• Fixed on: 2016-01-19 [[3]]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0 [Bulletin-CVE-2016-1621] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-1621]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0 [Bulletin-CVE-2016-1621]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0805

(json)

• CVE numbers: CVE-2016-0805 [Bulletin-CVE-2016-0805]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Qualcomm Performance Module
• Details: The performance event manager for Qualcomm ARM processors in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25773204. [NIST-CVE-2016-0805]
• Discovered by: on: Unknown
• Reported on: 2016-02-01 [Bulletin-CVE-2016-0805]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0805] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-0805]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0805]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0806

(json)

• CVE numbers: CVE-2016-0806 [Bulletin-CVE-2016-0806]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Qualcomm Wi-Fi Driver
• Details: The Qualcomm Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows attackers to gain privileges via a crafted application, aka internal bug 25344453. [NIST-CVE-2016-0806]
• Discovered by: on: Unknown
• Reported on: 2016-02-01 [Bulletin-CVE-2016-0806]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0806] regex: (4.4.4)|(5.0.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-0806]
• Fixed versions: 4.4.4, 5.0, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0806]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-1503

(json)

• CVE numbers: CVE-2016-1503 [Bulletin-CVE-2016-1503]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in DHCPCD
• Details: dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other products, mismanages option lengths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a malformed DHCP response, aka internal bug 26461634. [NIST-CVE-2016-1503]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2016-1503]
• Fixed on: 2016-02-11 [ANDROID-26461634]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-1503] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-1503]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-1503]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0841

(json)

• CVE numbers: CVE-2016-0841 [Bulletin-CVE-2016-0841]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 mishandles cleared service binders, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26040840. [NIST-CVE-2016-0841]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2016-0841]
• Fixed on: 2016-02-18 [ANDROID-26040840]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0841] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0841]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0841]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0837

(json)

• CVE numbers: CVE-2016-0837 [Bulletin-CVE-2016-0837]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds read and memory corruption) via a crafted media file, aka internal bug 27208621. [NIST-CVE-2016-0837]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2016-0837]
• Fixed on: 2016-02-23 [ANDROID-27208621]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0837] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0837]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0837]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0728

(json)

• CVE numbers: CVE-2016-0728 [Bulletin-CVE-2016-0728]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Kernel Keyring Component
• Details: The join_session_keyring function in security/keys/process_keys.c in the Linux kernel before 4.4.1 mishandles object references in a certain error case, which allows local users to gain privileges or cause a denial of service (integer overflow and use-after-free) via crafted keyctl commands. [NIST-CVE-2016-0728]
• Discovered by: on: Unknown
• Reported on: 2016-03-01 [Bulletin-CVE-2016-0728]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0728] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-0728]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0728]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0819

(json)

• CVE numbers: CVE-2016-0819 [Bulletin-CVE-2016-0819]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in the Qualcomm Performance Component
• Details: The Qualcomm performance component in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows attackers to gain privileges via a crafted application, aka internal bug 25364034. [NIST-CVE-2016-0819]
• Discovered by: on: Unknown
• Reported on: 2016-03-01 [Bulletin-CVE-2016-0819]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0819] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-0819]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0819]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2429

(json)

• CVE numbers: CVE-2016-2429 [Bulletin-CVE-2016-2429]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: libFLAC/stream_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not prevent free operations on uninitialized memory, which allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via a crafted media file, aka internal bug 27211885. [NIST-CVE-2016-2429]
• Discovered by: on: Unknown
• Reported on: 2016-05-01 [Bulletin-CVE-2016-2429]
• Fixed on: 2016-03-11 [27211885]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2429] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2429]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2429]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2428

(json)

• CVE numbers: CVE-2016-2428 [Bulletin-CVE-2016-2428]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: libAACdec/src/aacdec_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly limit the number of threads, which allows remote attackers to execute arbitrary code or cause a denial of service (stack memory corruption) via a crafted media file, aka internal bug 26751339. [NIST-CVE-2016-2428]
• Discovered by: on: Unknown
• Reported on: 2016-05-01 [Bulletin-CVE-2016-2428]
• Fixed on: 2016-03-21 [26751339]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2428] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2428]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2428]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2430

(json)

• CVE numbers: CVE-2016-2430 [Bulletin-CVE-2016-2430]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Debuggerd
• Details: libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to gain privileges via an application containing a crafted symbol name, aka internal bug 27299236. [NIST-CVE-2016-2430]
• Discovered by: on: Unknown
• Reported on: 2016-05-01 [Bulletin-CVE-2016-2430]
• Fixed on: 2016-03-23 [27299236]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2430] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2430]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2430]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2015-1805

(json)

• CVE numbers: CVE-2015-1805 [Bulletin-CVE-2015-1805]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Kernel
• Details: The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun." [NIST-CVE-2015-1805]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2015-1805]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-1805] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-1805]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2015-1805]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-0843

(json)

• CVE numbers: CVE-2016-0843 [Bulletin-CVE-2016-0843]
• Coordinated disclosure?: unknown
• Categories: Elevation of Privilege Vulnerability in Qualcomm Performance Module
• Details: The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application, aka internal bug 25801197. [NIST-CVE-2016-0843]
• Discovered by: on: Unknown
• Reported on: 2016-04-02 [Bulletin-CVE-2016-0843]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0843] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-0843]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-0843]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2463

(json)

• CVE numbers: CVE-2016-2463 [Bulletin-CVE-2016-2463]
• Coordinated disclosure?: unknown
• Categories: Remote Code Execution Vulnerability in Mediaserver
• Details: Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file that triggers a large memory allocation, aka internal bug 27855419. [NIST-CVE-2016-2463]
• Discovered by: on: Unknown
• Reported on: 2016-06-01 [Bulletin-CVE-2016-2463]
• Fixed on: 2016-04-08 [27855419]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2463] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2463]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2463]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2507

(json)

• CVE numbers: CVE-2016-2507 [Bulletin-CVE-2016-2507]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: Integer overflow in codecs/on2/h264dec/source/h264bsd_storage.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28532266. [NIST-CVE-2016-2507]
• Discovered by: on: Unknown
• Reported on: 2016-07-01 [Bulletin-CVE-2016-2507]
• Fixed on: 2016-05-11 [A-28532266]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2507] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2507]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2507]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3840

(json)

• CVE numbers: CVE-2016-3840 [Bulletin-CVE-2016-3840]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Conscrypt
• Details: Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153. [NIST-CVE-2016-3840]
• Discovered by: on: Unknown
• Reported on: 2016-08-01 [Bulletin-CVE-2016-3840]
• Fixed on: 2016-05-12 [A-28751153]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3840] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-3840]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3840]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2506

(json)

• CVE numbers: CVE-2016-2506 [Bulletin-CVE-2016-2506]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: DRMExtractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate a certain offset value, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28175045. [NIST-CVE-2016-2506]
• Discovered by: on: Unknown
• Reported on: 2016-07-01 [Bulletin-CVE-2016-2506]
• Fixed on: 2016-05-13 [A-28175045]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2506] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2506]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2506]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3819

(json)

• CVE numbers: CVE-2016-3819 [Bulletin-CVE-2016-3819]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: Integer overflow in codecs/on2/h264dec/source/h264bsd_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28533562. [NIST-CVE-2016-3819]
• Discovered by: on: Unknown
• Reported on: 2016-08-01 [Bulletin-CVE-2016-3819]
• Fixed on: 2016-06-07 [A-28533562]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3819] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-3819]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3819]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3821

(json)

• CVE numbers: CVE-2016-3821 [Bulletin-CVE-2016-3821]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect declarations, which allows remote attackers to execute arbitrary code or cause a denial of service (NULL pointer dereference or memory corruption) via a crafted media file, aka internal bug 28166152. [NIST-CVE-2016-3821]
• Discovered by: on: Unknown
• Reported on: 2016-08-01 [Bulletin-CVE-2016-3821]
• Fixed on: 2016-06-07 [A-28166152]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3821] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-3821]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3821]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2508

(json)

• CVE numbers: CVE-2016-2508 [Bulletin-CVE-2016-2508]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: media/libmediaplayerservice/nuplayer/GenericSource.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not validate certain track data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28799341. [NIST-CVE-2016-2508]
• Discovered by: on: Unknown
• Reported on: 2016-07-01 [Bulletin-CVE-2016-2508]
• Fixed on: 2016-06-14 [2]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2508] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2508]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-2508]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3861

(json)

• CVE numbers: CVE-2016-3861 [Bulletin-CVE-2016-3861]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in LibUtils
• Details: LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between Unicode character encodings with different encoding widths, which allows remote attackers to execute arbitrary code or cause a denial of service (heap-based buffer overflow) via a crafted file, aka internal bug 29250543. [NIST-CVE-2016-3861]
• Discovered by: on: Unknown
• Reported on: 2016-09-01 [Bulletin-CVE-2016-3861]
• Fixed on: 2016-06-28 [A-29250543]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 [Bulletin-CVE-2016-3861] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-3861]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0 [Bulletin-CVE-2016-3861]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-3862

(json)

• CVE numbers: CVE-2016-3862 [Bulletin-CVE-2016-3862]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: media/ExifInterface.java in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 does not properly interact with the use of static variables in libjhead_jni, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 29270469. [NIST-CVE-2016-3862]
• Discovered by: on: Unknown
• Reported on: 2016-09-01 [Bulletin-CVE-2016-3862]
• Fixed on: 2016-07-13 [A-29270469]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3862] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-3862]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2016-3862]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2016-2182

(json)

• CVE numbers: CVE-2016-2182 [Bulletin-CVE-2016-2182]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in OpenSSL & BoringSSL
• Details: The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via unknown vectors. [NIST-CVE-2016-2182]
• Discovered by: on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2016-2182]
• Fixed on: 2016-08-22 [A-32096880]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2016-2182] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-2182]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2016-2182]
• Submission: by: Daniel Carter, on: 2019-07-26

dirtyc0w

(json)

• CVE numbers: CVE-2016-5195 [dirtyc0w-redhat]
• Coordinated disclosure?: false
• Categories: kernel
• Details: A race condition in the Linux kernel's handling of copy-on-write (COW) operations means that users can gain write access to otherwise read-only areas of memory and gain permissions [dirtyc0w-redhat]
• Discovered by: Phil Oester [dirtyc0w-redhat] on: Unknown
• Reported on: 2016-10-13 [dirtyc0w-bugzilla]
• Fixed on: 2016-10-18 [dirtyc0w-github][archived]
• Fix released on: 2016-11-06 [dirtyc0w-bulletin]
• Affected versions: 1.0 to 7.0 [dirtyc0w-arstechnica][archived] regex: ([1-6].[0-9].[0-9])|(7.0.[0-9])
• Affected devices: all [dirtyc0w-arstechnica][archived]
• Affected manufacturers: all [dirtyc0w-arstechnica][archived]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-09

CVE-2017-0592

(json)

• CVE numbers: CVE-2017-0592 [Bulletin-CVE-2017-0592]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in FLACExtractor.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34970788. [NIST-CVE-2017-0592]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0592]
• Fixed on: 2016-10-24 [A-34970788]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0592]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0592]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-6700

(json)

• CVE numbers: CVE-2016-6700 [Bulletin-CVE-2016-6700]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in libzipfile
• Details: An elevation of privilege vulnerability in libzipfile in Android 4.x before 4.4.4, 5.0.x before 5.0.2, and 5.1.x before 5.1.1 could enable a local malicious application to execute arbitrary code within the context of a privileged process. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Android ID: A-30916186. [NIST-CVE-2016-6700]
• Discovered by: on: Unknown
• Reported on: 2016-11-01 [Bulletin-CVE-2016-6700]
• Fixed on: Unknown
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1 [Bulletin-CVE-2016-6700] regex: (4.4.4)|(5.0.2)|(5.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2016-6700]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1 [Bulletin-CVE-2016-6700]
• Submission: by: Daniel Carter, on: 2019-07-29

CVE-2017-0475

(json)

• CVE numbers: CVE-2017-0475 [Bulletin-CVE-2017-0475]
• Coordinated disclosure?: unknown
• Categories: Elevation of privilege vulnerability in recovery verifier
• Details: An elevation of privilege vulnerability in the recovery verifier could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as Critical due to the possibility of a local permanent device compromise, which may require reflashing the operating system to repair the device. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-31914369. [NIST-CVE-2017-0475]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0475] on: Unknown
• Reported on: 2017-03-01 [Bulletin-CVE-2017-0475]
• Fixed on: 2016-12-16 [A-31914369]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0475] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0475]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0475]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0541

(json)

• CVE numbers: CVE-2017-0541 [Bulletin-CVE-2017-0541]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in sonivox in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1. Android ID: A-34031018. [NIST-CVE-2017-0541]
• Discovered by: Jianjun Dai (@Jioun_dai) of Qihoo 360 Skyeye Labs [Discovery-CVE-2017-0541] on: Unknown
• Reported on: 2017-04-01 [Bulletin-CVE-2017-0541]
• Fixed on: 2017-02-07 [A-34031018]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0541]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1 [Bulletin-CVE-2017-0541]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0588

(json)

• CVE numbers: CVE-2017-0588 [Bulletin-CVE-2017-0588]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in Mediaserver
• Details: A remote code execution vulnerability in id3/ID3.cpp in libstagefright in Mediaserver could enable an attacker using a specially crafted file to cause memory corruption during media file and data processing. This issue is rated as Critical due to the possibility of remote code execution within the context of the Mediaserver process. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34618607. [NIST-CVE-2017-0588]
• Discovered by: Yong Wang (王勇) (@ThomasKing2014) of Alibaba Inc. [Discovery-CVE-2017-0588] on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2017-0588]
• Fixed on: 2017-03-10 [A-34618607]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0588]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0588]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0756

(json)

• CVE numbers: CVE-2017-0756 [Bulletin-CVE-2017-0756]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-34621073. [NIST-CVE-2017-0756]
• Discovered by: on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0756]
• Fixed on: 2017-03-10 [A-34621073]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0756] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0756]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0756]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-7555

(json)

• CVE numbers: CVE-2015-7555 [Bulletin-CVE-2015-7555]
• Coordinated disclosure?: unknown
• Categories: Remote code execution vulnerability in GIFLIB
• Details: Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted image and logical screen width fields in a GIF file. [NIST-CVE-2015-7555]
• Discovered by: on: Unknown
• Reported on: 2017-05-01 [Bulletin-CVE-2015-7555]
• Fixed on: 2017-03-13 [A-34697653]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2015-7555] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2015-7555]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2015-7555]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0681

(json)

• CVE numbers: CVE-2017-0681 [Bulletin-CVE-2017-0681]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework. Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37208566. [NIST-CVE-2017-0681]
• Discovered by: Xuxian Jiang of C0RE Team [Discovery-CVE-2017-0681] on: Unknown
• Reported on: 2017-07-01 [Bulletin-CVE-2017-0681]
• Fixed on: 2017-05-11 [A-37208566]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0681]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0681]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0745

(json)

• CVE numbers: CVE-2017-0745 [Bulletin-CVE-2017-0745]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (avc decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37079296. [NIST-CVE-2017-0745]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0745] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0745]
• Fixed on: 2017-05-18 [A-37079296]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0745]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0745]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0714

(json)

• CVE numbers: CVE-2017-0714 [Bulletin-CVE-2017-0714]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-36492637. [NIST-CVE-2017-0714]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0714] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0714]
• Fixed on: 2017-05-19 [A-36492637]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0714]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0714]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0722

(json)

• CVE numbers: CVE-2017-0722 [Bulletin-CVE-2017-0722]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (h263 decoder). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-37660827. [NIST-CVE-2017-0722]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0722] on: Unknown
• Reported on: 2017-08-01 [Bulletin-CVE-2017-0722]
• Fixed on: 2017-05-19 [A-37660827]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0722]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2017-0722]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0809

(json)

• CVE numbers: CVE-2017-0809 [Bulletin-CVE-2017-0809]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: A remote code execution vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62673128. [NIST-CVE-2017-0809]
• Discovered by: on: Unknown
• Reported on: 2017-10-01 [Bulletin-CVE-2017-0809]
• Fixed on: 2017-06-27 [A-62673128]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0809]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0809]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0764

(json)

• CVE numbers: CVE-2017-0764 [Bulletin-CVE-2017-0764]
• Coordinated disclosure?: unknown
• Categories: Media Framework
• Details: A remote code execution vulnerability in the Android media framework (libvorbis). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62872015. [NIST-CVE-2017-0764]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-0764] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0764]
• Fixed on: 2017-07-13 [A-62872015]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0764] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0764]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0764]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0781

(json)

• CVE numbers: CVE-2017-0781 [Bulletin-CVE-2017-0781]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146105. [NIST-CVE-2017-0781]
• Discovered by: Gregory Vishnepolsky of Armis, Inc. [Discovery-CVE-2017-0781] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0781]
• Fixed on: 2017-07-17 [2]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0781] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0781]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0781]
• Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-0782

(json)

• CVE numbers: CVE-2017-0782 [Bulletin-CVE-2017-0782]
• Coordinated disclosure?: unknown
• Categories: System
• Details: A remote code execution vulnerability in the Android system (bluetooth). Product: Android. Versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63146237. [NIST-CVE-2017-0782]
• Discovered by: Gregory Vishnepolsky of Armis, Inc. [Discovery-CVE-2017-0782] on: Unknown
• Reported on: 2017-09-01 [Bulletin-CVE-2017-0782]
• Fixed on: 2017-07-17 [3]
• Fix released on: Unknown
• Affected versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0782] regex: (4.4.4)|(5.0.2)|(5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-0782]
• Fixed versions: 4.4.4, 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0 [Bulletin-CVE-2017-0782]
• Submission: by: Daniel Carter, on: 2019-07-26