2018

In ashmem_ioctl of ashmem.c, there is an out-of-bounds write due to insufficient locking when accessing asma. This could

A elevation of privilege vulnerability in the Upstream kernel skcipher. Product: Android. Versions: Android kernel. Andr

In the hardware HEVC decoder, some media files could cause a page fault. This could lead to a remote denial of service o

An elevation of privilege vulnerability in the Broadcom bcmdhd driver. Product: Android. Versions: Android kernel. Andro

An elevation of privilege vulnerability in the Android system (systemui). Product: Android. Versions: 5.1.1, 6.0, 6.0.1,

In bta_scan_results_cb_impl of btif_ble_scanner.cc, there is possible resource exhaustion if a large number of repeated

In CameraDeviceClient::submitRequestList of CameraDeviceClient.cpp, there is an out-of-bounds write if metadataSize is t

In the ServiceManager::add function in the hardware service manager, there is an insecure permissions check based on the

In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the

An information disclosure vulnerability in the Android media framework (stagefright mpeg4writer). Product: Android. Vers

An information disclosure vulnerability in the Android media framework (aacdec). Product: Android. Versions: 5.1.1, 6.0,

An information disclosure vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 7.0, 7.1.

An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1,

An information disclosure vulnerability in the Android media framework (libavc). Product: Android. Versions: 7.0, 7.1.1,

An information disclosure vulnerability in the Android media framework (libeffects). Product: Android. Versions: 5.1.1,

An information disclosure vulnerability in the Android media framework (mediadrm). Product: Android. Versions: 5.1.1, 6.

An information disclosure vulnerability in the Android media framework (av) related to id3 unsynchronization. Product: A

In Bitmap.ccp if Bitmap.nativeCreate fails an out of memory exception is not thrown leading to a java.io.IOException lat

A vulnerability in the Android media framework (ex) related to composition of frames lacking a color map. Product: Andro

In the ihevcd_parse_slice.c function, slave threads are not joined if there is an error. This could lead to a remote den

In several places in ihevcd_decode.c, a dead loop could occur due to incomplete frames which could lead to memory leaks.

In the ihevcd_parse_sps function of ihevcd_parse_headers.c, several parameter values could be negative which could lead

A vulnerability in the Android media framework (libvpx) related to odd frame width. Product: Android. Versions: 7.0, 7.1

In ihevcd_decode.c there is a possible infinite loop due to bytes for an sps of unsupported resolution resulting in the

In the ihevcd_parse_slice_header function of ihevcd_parse_slice_header.c a slice address of zero after the first slice c

In the ihevcd_decode function of ihevcd_decode.c, there is an infinite loop due to an incomplete frame error. This could

A vulnerability in the Android media framework (libhevc) related to handling ps_codec_obj memory allocation failures. Pr

A vulnerability in the Android media framework (libavc) related to handling dec_hdl memory allocation failures. Product:

An information disclosure vulnerability in the Android media framework (aac). Product: Android. Versions: 7.0, 7.1.1, 7.

An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1

A vulnerability in the Android media framework (libavc) related to incorrect use of mmco parameters. Product: Android. V

An information disclosure vulnerability in the Android media framework (libhevc). Product: Android. Versions: 7.0, 7.1.1

In the enableVSyncInjections function of SurfaceFlinger, there is a possible use after free of mVSyncInjector. This coul

In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condi

In the sendFormatChange function of ACodec, there is a possible integer overflow which could lead to an out-of-bounds wr

In the doGetThumb and getThumbnail functions of MtpServer, there is a possible double free due to not NULLing out a free

In the onQueueFilled function of SoftAVCDec, there is a possible out-of-bounds write due to a use after free if a bad he

In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due

In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free

In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privile

In the parseURL function of URLStreamHandler, there is improper input validation of the host field. This could lead to a

In MPEG4Extractor.cpp, there are several places where functions return early without cleaning up internal buffers which

An information disclosure vulnerability in the Android framework (clipboardservice). Product: Android. Versions: 5.1.1,

In Long Range Zip (aka lrzip) 0.631, there is an infinite loop and application hang in the unzip_match function in runzi

An issue was discovered in Skybox Platform before 7.5.201. Directory Traversal exists in /skyboxview/webskybox/attachmen

An issue was discovered in Skybox Platform before 7.5.201. SQL Injection exists in /skyboxview/webservice/services/Versi

An issue was discovered in Skybox Platform before 7.5.201. Stored cross-site scripting vulnerabilities exist in the titl

An issue was discovered in Skybox Platform before 7.5.401. Reflected cross-site scripting vulnerabilities exist in /skyb

An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archiv

In ImageMagick 7.0.6-10 Q16, a memory leak vulnerability was found in the function ReadMATImage in coders/mat.c, which a