CVE-2016-5864
Qualcomm, Inc. All Qualcomm products
HIGH 7.8
En bref
- Source
- NVD
- EPSS
- EPSS 0.69 % · centile 52 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- qualcomm
- Statut NVD
- Modified
Description
In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from userspace, and if they are set to a large value, integer overflow is possible followed by buffer overflow. In another function, a missing check for a lower bound may result in an out of bounds memory access.
Faiblesses (CWE)
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.8 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2016-6798
- GCVE · GCVE-0-2016-5864
Avis du CERT-FR
- CERTFR-2017-AVI-167 — Multiples vulnérabilités dans Google Android (Nexus) · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:google:android:*:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Qualcomm, Inc. · All Qualcomm products | affected Android for MSM, Firefox OS for MSM, QRD Android |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |