Scottybauer1

**Name of the Vulnerable Software and Affected Versions** Android kernel **Description** A remote code execution issue exists in the Broadcom networking driver. This affects Android products. **Recommendations** For Android kernel, apply the fix referenced by Android ID A-37168488 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 7.0 through 7.1.1 **Description** A remote code execution issue in the Surfaceflinger service could allow an attacker to cause memory corruption during media file and data processing by using a specially crafted file. This issue is rated as Critical due to the possibility of remote code execution within the context of the Surfaceflinger process. The vulnerability is caused by a buffer overflow in memory, which can be exploited by a remote attacker to inject arbitrary code. **Recommendations** For Android versions 7.0 through 7.1.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-11-05 **Description** An information disclosure issue in Qualcomm components, including the GPU driver, power driver, SMSM Point-to-Point driver, and sound driver, could allow a local malicious application to access data outside of its permission levels. This issue requires compromising a privileged process. **Recommendations** For Android versions prior to 2016-11-05, update to a version released after 2016-11-05 to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions prior to 2016-07-01 patchday **Description** The issue is related to errors in frame handling in the decoder/ih264d parse pslice.c file of the Android mediaserver. It allows a remote attacker to cause a denial of service, resulting in device hang or reboot, by using a specially crafted media file. **Recommendations** For Android versions prior to 2016-07-01 patchday, apply the July 2016 security patch to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Android versions 4.x through 4.4.3 Android versions 5.0.x through 5.0.1 Android versions 5.1.x through 5.1.0 Android versions 6.x before 2016-07-01 **Description** The issue is related to the mediaserver in Android, which does not limit process-memory usage. This allows remote attackers to cause a denial of service, resulting in a device hang or reboot, via a crafted media file. **Recommendations** For Android versions 4.x through 4.4.3, update to version 4.4.4 or later. For Android versions 5.0.x through 5.0.1, update to version 5.0.2 or later. For Android versions 5.1.x through 5.1.0, update to version 5.1.1 or later. For Android versions 6.x before 2016-07-01, update to a version released on or after 2016-07-01.

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 3.x **Description** The issue is related to an integer signedness error in the MSM QDSP6 audio driver. This error can be exploited by attackers to gain privileges or cause a denial of service, resulting in memory corruption. The exploitation is possible via a crafted application that makes an ioctl call. **Recommendations** For Linux kernel version 3.x, update to a version that includes a fix for the integer signedness error in the MSM QDSP6 audio driver.