deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-16852
Published: 2017-11-16
Description: shibsp/metadata/DynamicMetadataProvider.cpp in the Dynamic MetadataProvider plugin in Shibboleth Service Provider before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka SSPCPP-763.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: https://bugs.debian.org/881857; https://git.shibboleth.net/view/?p=cpp-sp.git%3Ba=commit%3Bh=b66cceb0e992c351ad5e2c665229ede82f261b16; https://lists.debian.org/debian-lts-announce/2017/11/msg00025.html
CVE: CVE-2017-16853
Published: 2017-11-16
Description: The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105.
CVSS Score: 8.1 (HIGH)
CWE: CWE-347
References: http://www.securityfocus.com/bid/101898; https://bugs.debian.org/881856; https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d
CVE: CVE-2017-16855
Published: 2017-11-16
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER.  ConsultIDs: CVE-2016-8638.  Reason: This candidate is a reservation duplicate of CVE-2016-8638.  Notes: All CVE users should reference CVE-2016-8638 instead of this candidate.  All references and descriptions in this candidate have been removed to prevent accidental usage
CVE: CVE-2017-1086
Published: 2017-11-16
Description: In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, not all information in the struct ptrace_lwpinfo is relevant for the state of any thread, and the kernel does not fill the irrelevant bytes or short strings. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information of the kernel stack of the thread is possible from the debugger. As a result, some bytes from the kernel stack of the thread using ptrace (PT_LWPINFO) call can be observed in userspace.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101861; http://www.securitytracker.com/id/1039809; https://www.freebsd.org/security/advisories/FreeBSD-SA-17:08.ptrace.asc
CVE: CVE-2017-1087
Published: 2017-11-16
Description: In FreeBSD 10.x before 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24 named paths are globally scoped, meaning a process located in one jail can read and modify the content of POSIX shared memory objects created by a process in another jail or the host system. As a result, a malicious user that has access to a jailed system is able to abuse shared memory by injecting malicious content in the shared memory region. This memory region might be executed by applications trusting the shared memory, like Squid. This issue could lead to a Denial of Service or local privilege escalation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22
References: http://www.securityfocus.com/bid/101867; http://www.securitytracker.com/id/1039810; https://www.freebsd.org/security/advisories/FreeBSD-SA-17:09.shm.asc
CVE: CVE-2017-1088
Published: 2017-11-16
Description: In FreeBSD before 11.1-STABLE, 11.1-RELEASE-p4, 11.0-RELEASE-p15, 10.4-STABLE, 10.4-RELEASE-p3, and 10.3-RELEASE-p24, the kernel does not properly clear the memory of the kld_file_stat structure before filling the data. Since the structure filled by the kernel is allocated on the kernel stack and copied to userspace, a leak of information from the kernel stack is possible. As a result, some bytes from the kernel stack can be observed in userspace.
CVSS Score: 3.3 (LOW)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101857; http://www.securitytracker.com/id/1039811; https://www.freebsd.org/security/advisories/FreeBSD-SA-17:10.kldstat.asc
CVE: CVE-2017-14028
Published: 2017-11-16
Description: A Resource Exhaustion issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exhaust memory resources by sending a large amount of TCP SYN packets.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400, CWE-400
References: http://www.securityfocus.com/bid/101885; https://ics-cert.us-cert.gov/advisories/ICSA-17-320-01; http://www.securityfocus.com/bid/101885
CVE: CVE-2017-16715
Published: 2017-11-16
Description: An Information Exposure issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to exploit a flaw in the handling of Ethernet frame padding that may allow for information exposure.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200, CWE-200
References: http://www.securityfocus.com/bid/101885; https://ics-cert.us-cert.gov/advisories/ICSA-17-320-01; http://www.securityfocus.com/bid/101885
CVE: CVE-2017-16719
Published: 2017-11-16
Description: An Injection issue was discovered in Moxa NPort 5110 Version 2.2, NPort 5110 Version 2.4, NPort 5110 Version 2.6, NPort 5110 Version 2.7, NPort 5130 Version 3.7 and prior, and NPort 5150 Version 3.7 and prior. An attacker may be able to inject packets that could potentially disrupt the availability of the device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-74, CWE-74
References: http://www.securityfocus.com/bid/101885; https://ics-cert.us-cert.gov/advisories/ICSA-17-320-01; http://www.securityfocus.com/bid/101885
CVE: CVE-2017-16843
Published: 2017-11-16
Description: Vonage VDV-23 115 3.2.11-0.9.40 devices have stored XSS via the NewKeyword or NewDomain field to /goform/RgParentalBasic.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: https://gh0s7.net/vonage/; https://www.exploit-db.com/exploits/43150/; https://gh0s7.net/vonage/
CVE: CVE-2017-16866
Published: 2017-11-16
Description: dayrui FineCms 5.2.0 before 2017.11.16 has Cross Site Scripting (XSS) in core/M_Controller.php via the DR_URI field.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79
References: https://gitee.com/dayrui/finecms/commit/09d4f3c1a1b8598ce8967e158b16b9fe44936c50; https://gitee.com/dayrui/finecms/commit/09d4f3c1a1b8598ce8967e158b16b9fe44936c50
CVE: CVE-2017-16867
Published: 2017-11-16
Description: Amazon Key through 2017-11-16 mishandles Cloud Cam 802.11 deauthentication frames during the delivery process, which makes it easier for (1) delivery drivers to freeze a camera and re-enter a house for unfilmed activities or (2) attackers to freeze a camera and enter a house if a delivery driver failed to ensure a locked door before leaving.
CVSS Score: 6.5 (MEDIUM)
References: http://www.securityfocus.com/bid/101899; https://www.engadget.com/2017/11/16/amazon-key-hack-cloud-cam/; https://www.theverge.com/2017/11/16/16665064/amazon-key-camera-disable
CVE: CVE-2017-4930
Published: 2017-11-16
Description: VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add a malicious URL to an enrolled device's 'Links' page. Successful exploitation of this issue could result in an unsuspecting AWC user being redirected to a malicious URL.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79
References: http://www.securityfocus.com/bid/101772; http://www.securitytracker.com/id/1039750; https://www.vmware.com/us/security/advisories/VMSA-2017-0016.html
CVE: CVE-2017-4931
Published: 2017-11-16
Description: VMware AirWatch Console 9.x prior to 9.2.0 contains a vulnerability that could allow an authenticated AWC user to add malicious data to an enrolled device's log files. Successful exploitation of this issue could result in an unsuspecting AWC user opening a CSV file which contains malicious content.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: http://www.securityfocus.com/bid/101772; http://www.securitytracker.com/id/1039750; https://www.vmware.com/us/security/advisories/VMSA-2017-0016.html
CVE: CVE-2017-4932
Published: 2017-11-16
Description: VMware AirWatch Launcher for Android prior to 3.2.2 contains a vulnerability that could allow an escalation of privilege from the launcher UI context menu to native UI functionality and privilege. Successful exploitation of this issue could result in an escalation of privilege.
CVSS Score: 7.8 (HIGH)
References: http://www.securityfocus.com/bid/101771; http://www.securitytracker.com/id/1039750; https://www.vmware.com/us/security/advisories/VMSA-2017-0016.html
CVE: CVE-2017-0866
Published: 2017-11-16
Description: An elevation of privilege vulnerability in the Direct rendering infrastructure of the NVIDIA Tegra X1 where an unchecked input from userspace is passed as a pointer to kfree. This could lead to kernel memory corruption and possible code execution. This issue is rated as moderate. Product: Pixel. Version: N/A. Android ID: A-38415808. References: N-CVE-2017-0866.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01#announcements; https://source.android.com/security/bulletin/pixel/2017-11-01#announcements
CVE: CVE-2017-0909
Published: 2017-11-16
Description: The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-184
References: https://github.com/jtdowney/private_address_check/pull/3; https://hackerone.com/reports/288950; https://github.com/jtdowney/private_address_check/pull/3
CVE: CVE-2017-11012
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a specially crafted QCA_NL80211_VENDOR_SUBCMD_ENCRYPTION_TEST cfg80211 vendor command a stack-based buffer overflow can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11013
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, countOffset (in function UnpackCore) is increased for each loop, while there is no boundary check against "pIe->arraybound".
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11014
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while parsing a Measurement Request IE in a Roam Neighbor Action Report, a buffer overflow can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11015
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, currently, the value of SIR_MAC_AUTH_CHALLENGE_LENGTH is set to 128 which may result in buffer overflow since the frame parser allows challenge text of length up to 253 bytes, but the driver can not handle challenge text larger than 128 bytes.
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11017
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing a specially crafted UBI image, it is possible to corrupt memory, or access uninitialized memory.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11018
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, array access out of bounds may occur in the camera driver in the kernel
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11022
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the probe requests originated from user's phone contains the information elements which specifies the supported wifi features. This shall impact the user's privacy if someone sniffs the probe requests originated by this DUT. Hence, control the presence of information elements using ini file.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-200
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11023
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of out-of-bound buffer accesses due to no synchronization in accessing global variables by multiple threads.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11024
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a race condition in the rmnet USB control driver can potentially lead to a Use After Free condition.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11025
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, due to a race condition in the function audio_effects_shared_ioctl(), memory corruption can occur.
CVSS Score: 7.0 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11026
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing FRP partition using reference FRP unlock, authentication method can be compromised for static keys.
CVSS Score: 7.8 (HIGH)
CWE: CWE-798
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11027
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while flashing UBI image, size is not validated for being smaller than minimum header size causing unintialized data access vulnerability.
CVSS Score: 7.8 (HIGH)
CWE: CWE-20
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11028
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the ISP Camera driver, the contents of an arbitrary kernel address can be leaked to userspace by the function msm_isp_get_stream_common_data().
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11029
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11032
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a double free can occur when kmalloc fails to allocate memory for pointers resp/req in the service-locator driver function service_locator_send_msg().
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11035
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, possible buffer overflow or information leak in the functions "sme_set_ft_ies" and "csr_roam_issue_ft_preauth_req" due to incorrect initialization of WEXT callbacks and lack of the checks for buffer size.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2018-01-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11038
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing the boot image header, range checks can be bypassed by supplying different versions of the header at the time of check and use.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11058
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing a specially crafted cfg80211 vendor command, a buffer over-read can occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11073
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, the qcacld pktlog allows mapping memory via /proc/ath_pktlog/cld to user space.
CVSS Score: 7.8 (HIGH)
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11085
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, an integer overflow leading to a buffer overflow due to improper bound checking in msm_audio_effects_virtualizer_handler, file msm-audio-effects-q6-v2.c
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11089
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in nl80211_set_station when user space application sends attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE with data of size less than 4 bytes
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://usn.ubuntu.com/3620-1/; https://usn.ubuntu.com/3620-2/
CVE: CVE-2017-11090
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a buffer overread is observed in __wlan_hdd_cfg80211_set_pmksa when user space application sends PMKID of size less than WLAN_PMKID_LEN bytes.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11091
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the function mdss_rotator_ioctl in the driver /dev/mdss_rotator, a Use-After-Free condition can potentially occur due to a fence being installed too early.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-11092
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the KGSL driver function kgsl_ioctl_gpu_command, a Use After Free condition can potentially occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-11093
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer Over-read in Display due to the lack of an upper-bound validation when reading "num_of_cea_blocks" from the untrusted source (EDID), kernel memory can be exposed.
CVSS Score: 7.5 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-15516
Published: 2017-11-16
Description: NetApp SnapCenter Server versions 1.1 through 2.x are susceptible to a Cross-Site Request Forgery (CSRF) vulnerability which could be used to cause an unintended authenticated action in the user interface.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2017-8279
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, missing race condition protection while updating msg mask table can lead to buffer over-read. Also access to freed memory can happen while updating msg_mask information.
CVSS Score: 7.5 (HIGH)
CWE: CWE-362
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01
CVE: CVE-2017-9690
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in a qbt1000 ioctl handler, an incorrect buffer size check has an integer overflow vulnerability potentially leading to a buffer overflow.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190
References: http://www.securityfocus.com/bid/101774; https://source.android.com/security/bulletin/2017-11-01; http://www.securityfocus.com/bid/101774
CVE: CVE-2017-9696
Published: 2017-11-16
Description: In android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer over-read is possible in camera driver function msm_isp_stop_stats_stream. Variable stream_cfg_cmd->num_streams is from userspace, and it is not checked against "MSM_ISP_STATS_MAX".
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: https://source.android.com/security/bulletin/pixel/2017-11-01; https://source.android.com/security/bulletin/pixel/2017-11-01