Marco Nelissen

The issue is related to the iomap write delalloc scan() function in the Linux kernel, which can lead to an infinite loop due to numerical truncation when writing to an xfs filesystem on 32-bit kernels. This occurs because folio next index() returns an unsigned long, causing iomap write delalloc scan() to inadvertently use a 32-bit position. The estimated number of potentially affected devices is not specified. There is no information about real-world incidents where this issue was exploited.

The issue is related to the `folio seek hole data()` function in the Linux kernel, which inadvertently truncates a 64-bit value to 32 bits on 32-bit kernels. This can lead to a possible infinite loop when writing to an xfs filesystem. The vulnerability may allow an attacker to cause a denial of service.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via crafted EXIF data. This is due to a buffer overflow in the exif.c file of the jhead tool, which is used in the libjhead library in Android.

The issue is related to the libstagefright component in the mediaserver of the Android operating system, which does not validate OMX buffer sizes for the GSM and G711 codecs. This allows attackers to gain privileges via a crafted application, potentially obtaining Signature or SignatureOrSystem access. The exploitation of this issue can enable a remote attacker to elevate their privileges using a specially crafted application.

The issue is related to the mediaserver in Android, which does not validate OMX buffer sizes. This allows attackers to gain privileges via a crafted application, potentially obtaining Signature or SignatureOrSystem access. The vulnerability can be exploited by a remote attacker using a specially crafted application to elevate their privileges.

The issue allows attackers to obtain sensitive information from process memory and bypass an unspecified protection mechanism via unspecified vectors. This can be demonstrated by obtaining Signature or SignatureOrSystem access. The vulnerability is related to the media/libmedia/IOMX.cpp component in the mediaserver of the Android operating system, which does not initialize a parameter data structure.

The issue allows remote attackers to execute arbitrary code or cause a denial of service via a crafted media file. This is due to an out-of-bounds read and memory corruption in the MPEG4Extractor.cpp function of the libstagefright library in the mediaserver component. The exploitation of this issue can lead to the execution of arbitrary code or a denial of service.

The issue allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file. This is due to insufficient input validation in the `MPEG4Source::fragmentedRead` function.

The issue is related to multiple integer overflows in the `addVorbisCodecInfo` function in `matroska/MatroskaExtractor.cpp` in `libstagefright` in `mediaserver`. This allows remote attackers to cause a denial of service, leading to device inoperability, via crafted Matroska data.