CVE-2014-9887
HighSummary
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain length values are not validated, allowing attackers to gain privileges via a crafted application.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the system, potentially leading to serious security breaches.
Recommendation
It is recommended to update the Android system to a version after 2016-08-05 to mitigate this vulnerability.
Other vulnerabilities in drivers/misc/qseecom.c
See all- CVE-2014-9884High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, certain pointers are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9865High
The Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices do not properly restrict user-space input, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9864High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, ioctl calls are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9787High
Integer overflow in drivers/misc/qseecom.c in Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.
- CVE-2014-9785High
The Qualcomm components in Android before 2016-07-05 on Nexus 7 (2013) devices do not validate addresses before copying data, allowing attackers to gain privileges via a crafted application.
Original NVD description (English source)
drivers/misc/qseecom.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not validate certain length values, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28804057 and Qualcomm internal bug CR636633.