PT-2017-2747 · Google+1 · Android+1

Publicado 2017-01-03 · Atualizado 2017-08-20 · CVE-2016-5861

Positive Technologies (AI Summary)

CVSS v2.0

8.3

Alta

Vetor base

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm display driver versions (affected versions not specified)

Description The issue is related to insufficient access control in a display driver for mobile applications on the Android operating system. It involves the use of a variable controlled by userspace to calculate offsets and sizes for copy operations, potentially leading to a heap overflow. This could allow a remote attacker to exploit the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-01989

CVE-2016-5861

Produtos afetados

Android

Qualcomm Display Driver

Referências · 5

• https://bdu.fstec.ru/vul/2017-01989 · Nota de Segurança
• https://source.android.com/security/bulletin/2017-06-01 · Aviso do Fabricante
• https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=cf3c97b8b6165f13810e530068fbf94b07f1f77d · Correção
• http://securitytracker.com/id/1038623 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-5861 · Nota de Segurança