CVE-2014-9785
HighSummary
The Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices do not validate addresses before copying data, allowing attackers to gain privileges via a crafted application.
Risk Assessment
An attacker can exploit this vulnerability to gain elevated privileges on the system, posing a serious threat to the security of the device and user data.
Recommendation
It is recommended to update the Android system to the latest version to mitigate this vulnerability and to monitor applications installed on the devices.
Other vulnerabilities in drivers/misc/qseecom.c
See all- CVE-2014-9887High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain length values are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9884High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain pointers are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9865High
The Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices do not properly restrict user-space input, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9864High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, ioctl calls are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9787High
Integer overflow in drivers/misc/qseecom.c in Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
Original NVD description (English source)
drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices does not validate addresses before copying data, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28469042 and Qualcomm internal bug CR545747.