Vulnetix
Try Vulnetix Request Demo
Google Security Advisories · November 2017 — Google Security Advisories
73 advisories 73 CVEs

GCVE / Google Cloud / Chrome / Android / Project Zero / OSS for 2017-11. Mirrored into Vulnetix VDB.

Every advisory below is enriched with the Vulnetix VDB exploit-intelligence chip (hover a CVE ID in the interactive page to see CVSS, EPSS, KEV status, and PoC maturity).

Back to archive Open Console

What would you fix first?

The advisories below are ordered by the Vulnetix risk prioritization strategy: exploitation evidence first, scores second. On the interactive page you can switch to three other lenses.

How Vulnetix ranks risk Get a free API key

Advisories

MGASA-2017-0423

Open SourcePoC exploitCRITICAL2017-11-26

Updated chromium-browser-stable packages fix security issues

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser-stable affected Mageia:6 chromium-browser-stable —
Upstream advisory

DSA-4020-1

Open SourcePoC exploit2017-11-05

chromium-browser - security update

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Debian:9 chromium-browser —
Upstream advisory

DEBIAN-CVE-2017-14992

Open SourcePoC exploitHIGH2017-11-01

DEBIAN-CVE-2017-14992

Affected products

ProductStatusVendorPackageEcosystem
docker.io affected Debian:11 docker.io —
docker.io affected Debian:12 docker.io —
docker.io affected Debian:13 docker.io —
docker.io affected Debian:14 docker.io —
golang-github-vbatts-tar-split affected Debian:11 golang-github-vbatts-tar-split —
golang-github-vbatts-tar-split affected Debian:12 golang-github-vbatts-tar-split —
golang-github-vbatts-tar-split affected Debian:13 golang-github-vbatts-tar-split —
golang-github-vbatts-tar-split affected Debian:14 golang-github-vbatts-tar-split —
Upstream advisory

CVE-2017-11089

Open SourcePoC exploitHIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with dat...

CVEs:CVE-2017-11089

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0861

Open SourcePoC exploitCRITICAL2017-11-16

Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.

CVEs:CVE-2017-0861

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6258

Open SourcePoC exploitHIGH2017-11-08

NVIDIA libnvmmlite_audio.so contains an elevation of privilege vulnerability when running in media server which may cause an out of bounds write and could lead to local code execution in a privileged process. This issue is rated as high. Product: Andro...

CVEs:CVE-2017-6258

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

DSA-4024-1

Open SourceEPSS <= 49%2017-11-08

chromium-browser - security update

Affected products

ProductStatusVendorPackageEcosystem
chromium-browser affected Debian:9 chromium-browser —
Upstream advisory

CVE-2017-15399

GoogleEPSS <= 49%HIGH2017-11-07

A use after free in V8 in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVEs:CVE-2017-15399

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

CVE-2017-15398

GoogleEPSS <= 49%CRITICAL2017-11-07

A stack buffer overflow in the QUIC networking stack in Google Chrome prior to 62.0.3202.89 allowed a remote attacker to gain code execution via a malicious server.

CVEs:CVE-2017-15398

Affected products

ProductStatusVendorPackageEcosystem
chrome affected google — —
debian_linux affected debian — —
enterprise_linux_desktop affected redhat — —
enterprise_linux_server affected redhat — —
enterprise_linux_workstation affected redhat — —
Upstream advisory

DEBIAN-CVE-2017-0841

Open SourceEPSS <= 49%CRITICAL2017-11-16

DEBIAN-CVE-2017-0841

Affected products

ProductStatusVendorPackageEcosystem
android-platform-system-core affected Debian:11 android-platform-system-core —
Upstream advisory

CVE-2017-0841

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android system (libutils). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37723026.

CVEs:CVE-2017-0841

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0833

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62896384.

CVEs:CVE-2017-0833

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0834

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63125953.

CVEs:CVE-2017-0834

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0835

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63316832.

CVEs:CVE-2017-0835

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0836

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64893226.

CVEs:CVE-2017-0836

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0832

Open SourceEPSS <= 49%HIGH2017-11-07

A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62887820.

CVEs:CVE-2017-0832

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0839

Open SourceEPSS <= 49%HIGH2017-11-07

An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64478003.

CVEs:CVE-2017-0839

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0840

Open SourceEPSS <= 49%HIGH2017-11-07

An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62948670.

CVEs:CVE-2017-0840

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11028

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the ISP Camera driver, the contents of an arbitrary kernel address can be leaked to userspace by the function msm_isp_get_stream_common_d...

CVEs:CVE-2017-11028

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11014

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing a Measurement Request IE in a Roam Neighbor Action Report, a buffer overflow can occur.

CVEs:CVE-2017-11014

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11013

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, countOffset (in function UnpackCore) is increased for each loop, while there is no boundary check against "pIe->arraybound".

CVEs:CVE-2017-11013

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0858

Open SourceEPSS <= 49%HIGH2017-11-16

Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64836894.

CVEs:CVE-2017-0858

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11015

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently, the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128 which may result in buffer overflow since the frame parser allows challe...

CVEs:CVE-2017-11015

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0853

Open SourceEPSS <= 49%CRITICAL2017-11-16

An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63121644.

CVEs:CVE-2017-0853

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0854

Open SourceEPSS <= 49%CRITICAL2017-11-16

An information disclosure vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-63873837.

CVEs:CVE-2017-0854

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11092

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the KGSL driver function kgsl_ioctl_gpu_command, a Use After Free condition can potentially occur.

CVEs:CVE-2017-11092

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6274

Open SourceEPSS <= 49%CRITICAL2017-11-14

An elevation of Privilege vulnerability exists in the Thermal Driver, where a missing bounds checks in the thermal throttle driver can cause an out-of-bounds write in the kernel. This issue is rated as moderate. Product: Pixel. Version: N/A. Android ID...

CVEs:CVE-2017-6274

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0831

Open SourceEPSS <= 49%HIGH2017-11-07

An elevation of privilege vulnerability in the Android framework (window manager). Product: Android. Versions: 8.0. Android ID: A-37442941.

CVEs:CVE-2017-0831

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0857

Open SourceEPSS <= 49%HIGH2017-11-16

Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-65122447.

CVEs:CVE-2017-0857

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0830

Open SourceEPSS <= 49%HIGH2017-11-07

An elevation of privilege vulnerability in the Android framework (device policy client). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62623498.

CVEs:CVE-2017-0830

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0850

Open SourceEPSS <= 49%HIGH2017-11-16

An information disclosure vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-64836941.

CVEs:CVE-2017-0850

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0845

Open SourceEPSS <= 49%HIGH2017-11-16

A denial of service vulnerability in the Android framework (syncstorageengine). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-35028827.

CVEs:CVE-2017-0845

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0847

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the Android media framework (mediaanalytics). Product: Android. Versions: 8.0. Android ID: A-65540999.

CVEs:CVE-2017-0847

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0852

Open SourceEPSS <= 49%HIGH2017-11-16

A denial of service vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0. Android ID: A-62815506.

CVEs:CVE-2017-0852

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0859

Open SourceEPSS <= 49%HIGH2017-11-16

Another vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-36075131.

CVEs:CVE-2017-0859

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11058

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur.

CVEs:CVE-2017-11058

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11090

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in __wlan_hdd_cfg80211_set_pmksa when user space application sends PMKID of size less than WLAN_PMKID_LEN bytes.

CVEs:CVE-2017-11090

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11093

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer Over-read in Display due to the lack of an upper-bound validation when reading "num_of_cea_blocks" from the untrusted source (EDID), ...

CVEs:CVE-2017-11093

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9696

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer over-read is possible in camera driver function msm_isp_stop_stats_stream. Variable stream_cfg_cmd->num_streams is from userspace, an...

CVEs:CVE-2017-9696

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9701

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing OEM unlock/unlock-go fastboot commands data leak may occur, resulting from writing uninitialized stack structure to non-vol...

CVEs:CVE-2017-9701

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-6275

Open SourceEPSS <= 49%HIGH2017-11-14

An information disclosure vulnerability exists in the Thermal Driver, where a missing bounds checking in the thermal driver could allow a read from an arbitrary kernel address. This issue is rated as moderate. Product: Pixel. Versions: N/A. Android ID:...

CVEs:CVE-2017-6275

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0848

Open SourceEPSS <= 49%HIGH2017-11-16

An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-64477217.

CVEs:CVE-2017-0848

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0849

Open SourceEPSS <= 49%HIGH2017-11-16

An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-62688399.

CVEs:CVE-2017-0849

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0851

Open SourceEPSS <= 49%HIGH2017-11-16

An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-35430570.

CVEs:CVE-2017-0851

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11022

Open SourceEPSS <= 49%MEDIUM2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall im...

CVEs:CVE-2017-11022

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-8279

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, missing race condition protection while updating msg mask table can lead to buffer over-read. Also access to freed memory can happen while u...

CVEs:CVE-2017-8279

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9690

Open SourceEPSS <= 49%CRITICAL2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a qbt1000 ioctl handler, an incorrect buffer size check has an integer overflow vulnerability potentially leading to a buffer overflow.

CVEs:CVE-2017-9690

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0862

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the Upstream kernel kernel. Product: Android. Versions: Android kernel. Android ID: A-36006779.

CVEs:CVE-2017-0862

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0842

Open SourceEPSS <= 49%CRITICAL2017-11-07

An elevation of privilege vulnerability in the Android system (bluetooth). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID: A-37502513.

CVEs:CVE-2017-0842

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11035

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or information leak in the functions "sme_set_ft_ies" and "csr_roam_issue_ft_preauth_req" due to incorrect initiali...

CVEs:CVE-2017-11035

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11017

Open SourceEPSS <= 49%HIGH2017-11-07

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a specially crafted UBI image, it is possible to corrupt memory, or access uninitialized memory.

CVEs:CVE-2017-11017

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0843

Open SourceEPSS <= 49%CRITICAL2017-11-07

An elevation of privilege vulnerability in the MediaTek ccci. Product: Android. Versions: Android kernel. Android ID: A-62670819. References: M-ALPS03361488.

CVEs:CVE-2017-0843

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0863

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the Upstream kernel video driver. Product: Android. Versions: Android kernel. Android ID: A-37950620.

CVEs:CVE-2017-0863

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0838

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the Android media framework (libstagefright). Product: Android. Versions: 7.0, 7.1.1, 7.1.2. Android ID: A-63522818.

CVEs:CVE-2017-0838

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11038

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the boot image header, range checks can be bypassed by supplying different versions of the header at the time of check and ...

CVEs:CVE-2017-11038

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0864

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the MediaTek ioctl (flashlight). Product: Android. Versions: Android kernel. Android ID: A-37277147. References: M-ALPS03394571.

CVEs:CVE-2017-0864

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0865

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the MediaTek soc driver. Product: Android. Versions: Android kernel. Android ID: A-65025090. References: M-ALPS02973195.

CVEs:CVE-2017-0865

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11018

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, array access out of bounds may occur in the camera driver in the kernel

CVEs:CVE-2017-11018

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11023

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of out-of-bound buffer accesses due to no synchronization in accessing global variables by multiple threads.

CVEs:CVE-2017-11023

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11024

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in the rmnet USB control driver can potentially lead to a Use After Free condition.

CVEs:CVE-2017-11024

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11027

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing UBI image, size is not validated for being smaller than minimum header size causing unintialized data access vulnerability.

CVEs:CVE-2017-11027

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11032

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a double free can occur when kmalloc fails to allocate memory for pointers resp/req in the service-locator driver function service_locator_s...

CVEs:CVE-2017-11032

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11073

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qcacld pktlog allows mapping memory via /proc/ath_pktlog/cld to user space.

CVEs:CVE-2017-11073

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11091

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function mdss_rotator_ioctl in the driver /dev/mdss_rotator, a Use-After-Free condition can potentially occur due to a fence being in...

CVEs:CVE-2017-11091

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9702

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a user-space pointer is directly accessed in a camera driver.

CVEs:CVE-2017-9702

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11029

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buff...

CVEs:CVE-2017-11029

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11085

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler, file msm-audio-eff...

CVEs:CVE-2017-11085

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9719

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the kernel driver MDSS, a buffer overflow can occur in HDMI CEC parsing if frame size is out of range.

CVEs:CVE-2017-9719

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-9721

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the boot loader, a buffer overflow can occur while parsing the splash image.

CVEs:CVE-2017-9721

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11026

Open SourceEPSS <= 49%HIGH2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partition using reference FRP unlock, authentication method can be compromised for static keys.

CVEs:CVE-2017-11026

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-0860

Open SourceEPSS <= 49%CRITICAL2017-11-16

An elevation of privilege vulnerability in the Android system (inputdispatcher). Product: Android. Versions: 5.0.2, 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2. Android ID: A-31097064.

CVEs:CVE-2017-0860

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11012

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_ENCRYPTION_TEST cfg80211 vendor command a stack-based buffer overflow can occur.

CVEs:CVE-2017-11012

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

CVE-2017-11025

Open SourceEPSS <= 49%CRITICAL2017-11-16

In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the function audio_effects_shared_ioctl(), memory corruption can occur.

CVEs:CVE-2017-11025

Affected products

ProductStatusVendorPackageEcosystem
android affected google — —
Upstream advisory

Need live exploit intelligence?

Every CVE above is indexed in the Vulnetix VDB with KEV, EPSS, and PoC maturity. The interactive page surfaces that on hover.

All months Open Console