PT-2017-2747 · Google+1 · Android+1

Published 2017-01-03 · Updated 2017-08-20 · CVE-2016-5861

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:A/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm display driver versions (affected versions not specified)

Description The issue is related to insufficient access control in a display driver for mobile applications on the Android operating system. It involves the use of a variable controlled by userspace to calculate offsets and sizes for copy operations, potentially leading to a heap overflow. This could allow a remote attacker to exploit the issue.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-01989

CVE-2016-5861

Affected Products

Android

Qualcomm Display Driver

References · 5

• https://bdu.fstec.ru/vul/2017-01989 · Security Note
• https://source.android.com/security/bulletin/2017-06-01 · Vendor Advisory
• https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=cf3c97b8b6165f13810e530068fbf94b07f1f77d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2016-5861 · Security Note
• http://securitytracker.com/id/1038623 · Note