CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
Browse vulnerabilities by packageCISA KEV catalog updated: (v2026.09.18)
Weekly CVE digest
One email a week with newly published vulnerabilities worth knowing about. No account needed.
This digest covers new vulnerabilities in general, not your servers. If you want to know which of them actually run in your infrastructure, that is what Secvalis does: it scans your machines and reports only what concerns them.
Multiple buffer overflows in libdex/OptInvocation.cpp in DexClassLoader in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016 allow attackers to gain privileges via a crafted application that provides a long filename.
The print_maps function in toolbox/lsof.c in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows user-assisted attackers to gain privileges via a crafted application that attempts to list a long name of a memory-mapped file.
In the mediaserver component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016, the number of partitions is not validated, allowing remote attackers to cause a denial of service (device hang or reboot) via a crafted media file.
The decoder/ih264d_parse_pslice.c in mediaserver in Android 6.x before 2016-07-01 does not properly select concealment frames, allowing remote attackers to cause a denial of service (device hang or reboot) via a crafted media file.
In Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01, the mediaserver component does not limit process memory usage. This allows remote attackers to cause a denial of service via a crafted media file.
The vulnerability in mediaserver in Android 4.x before 4.4.4 allows remote attackers to obtain sensitive information via unspecified vectors.
The ChooserTarget service in Android 6.x before July 1, 2016, mishandles target security checks, allowing attackers to gain privileges via a crafted application.
Unspecified vulnerability in libpng before version 1.6.20, used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016, allows attackers to gain privileges via a crafted application.
The Parcels Framework in Android versions 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016, does not validate the return value of the dup system call. This allows attackers to bypass an isolation protection mechanism via a crafted application.
In the LockSettingsService in Android 6.x before July 1, 2016, attackers can modify the screen-lock password or pattern via a crafted application.
The sockets subsystem in Android 6.x before 2016-07-01 allows attackers to bypass intended system-call restrictions via a crafted application that makes an ioctl call.
A use-after-free vulnerability in the mm-video-v4l2 venc component in mediaserver in Android versions before 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, allows attackers to gain privileges via a crafted application.
Use-after-free vulnerability in the mm-video-v4l2 vdec component in mediaserver in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows attackers to gain privileges via a crafted application.
Multiple buffer overflows in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 allow attackers to gain privileges via a crafted application that provides an AudioEffect reply.
Buffer overflow in the create_pbuf function in the Bluetooth module in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016, allows remote attackers to gain privileges via a crafted pairing operation.
The decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The decoder/ih264d_process_intra_mb.c file in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
The GenericSource.cpp file in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before July 1, 2016 does not validate certain track data, allowing remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file.
Integer overflow in libstagefright in Android before version 4.4.4, 5.0.2, 5.1.1, and 6.x before July 1, 2016 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file.