CVE-2016-3855
HighSummary
In Qualcomm components in Android before 2016-08-05, there is a vulnerability that does not validate a certain count parameter. This allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application.
Risk Assessment
The organization may be exposed to attacks that lead to denial of service, affecting the availability of systems and services. Additionally, unspecified impact may lead to further security threats.
Recommendation
It is recommended to update the Android system to a version after 2016-08-05 to mitigate this vulnerability. Monitoring applications and their sources to avoid potentially malicious software is also advised.
Other vulnerabilities in Qualcomm components in Android
See all- CVE-2016-3854High
In Qualcomm components in Android before 2016-08-05, there is a vulnerability in msm_mctl_buf.c that does not validate the image mode. This can lead to denial of service (out-of-bounds array access) or other unspecified impacts via a crafted application.
- CVE-2015-8943High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, there is no verification of mapping existence before proceeding with an unmap operation. This allows attackers to gain privileges via a crafted application.
- CVE-2015-8942High
In Qualcomm components in Android before 2016-08-05 on Nexus 6 devices, the stream state is not validated in msm_cpp.c, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8941High
The Qualcomm components in Android before 2016-08-05 on Nexus 6 and 7 (2013) devices have an issue with improper validation of array indexes, allowing attackers to gain privileges via a crafted application.
- CVE-2015-8940High
Integer overflow in q6lsm.c in Qualcomm components in Android before 2016-08-05 on Nexus 6 devices allows attackers to gain privileges via a crafted application.
- CVE-2015-8937High
In Qualcomm components in Android before 2016-08-05 on Nexus 5, 6, and 7 (2013) devices, a bug in socket process handling allows attackers to gain privileges via a crafted application.
- CVE-2014-9891High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, certain buffer addresses are not validated, allowing attackers to gain privileges via a crafted application that makes an ioctl call.
- CVE-2014-9890High
Off-by-one error in Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges via a crafted application that sends an I2C command.
- CVE-2014-9889High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 devices, CPP frame messages are not validated, allowing attackers to gain privileges via a crafted application.
- CVE-2014-9886High
In Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, there is a vulnerability that improperly validates input parameters. This allows attackers to gain privileges via a crafted application.
Original NVD description (English source)
drivers/thermal/supply_lm_core.c in the Qualcomm components in Android before 2016-08-05 does not validate a certain count parameter, which allows attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via a crafted application, aka Qualcomm internal bug CR990824.