CVE-2014-9863: Integer Overflow
Integer underflow in the diag driver in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices allows attackers to gain privileges or obtain sensitive information via a crafted application, aka Android internal bug 28768146 and Qualcomm internal bug CR549470.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The issue is identified on Nexus 5 and Nexus 7 (2013) devices running affected Android builds before 2016-08-05.
What does an attacker need to exploit this issue?
An attacker needs to get a crafted application executed on the device. The vulnerability is locally exploitable and does not require prior privileges, but it requires user interaction.
What could successful exploitation allow?
Successful exploitation may allow an attacker to gain privileges or obtain sensitive information. The CVSS vector also indicates potential high impact to confidentiality, integrity, and availability.
What should affected users do?
Apply the available patch for this issue. The referenced Android security bulletin is dated 2016-08-01.