CVE-2015-8941
HighSummary
The Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices have an issue with improper validation of array indexes, allowing attackers to gain privileges via a crafted application.
Risk Assessment
An attacker could exploit this vulnerability to gain unauthorized access to the system, posing a serious threat to user data security.
Recommendation
It is recommended to update devices to the latest version of Android to mitigate this vulnerability and to monitor applications installed on these devices.
Other vulnerabilities in Qualcomm components in Android
See all- CVE-2016-3855High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
- CVE-2016-3854High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
- CVE-2015-8943High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
- CVE-2015-8942High
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8940High
Integer overflow in q6lsm.c in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
- CVE-2015-8937High
In Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices, a bug in socket process handling allows attackers to gain privileges via a crafted application.
- CVE-2014-9891High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, certain buffer addresses are not validated, allowing attackers to gain privileges via a crafted application that makes an ioctl call.
- CVE-2014-9890High
Off-by-one error in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application that sends an I2C command.
- CVE-2014-9889High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, CPP frame messages are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9886High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, there is a vulnerability that improperly validates input parameters. This allows attackers to gain privileges via a crafted application.
Original NVD description (English source)
drivers/media/platform/msm/camera_v2/isp/msm_isp_axi_util.c in the Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices does not properly validate array indexes, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28814502 and Qualcomm internal bug CR792473.