CVE-2014-9867: Critical severity Google Android vulnerability
drivers/media/platform/msm/camerav2/isp/msmispaxiutil.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not validate the number of streams, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28749629 and Qualcomm internal bug CR514702.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The affected devices named in the available information are Nexus 5 and Nexus 7 (2013) devices running Android builds before 2016-08-05.
What does an attacker need to exploit this issue?
An attacker needs to get a crafted application run on the device. The CVSS vector indicates no privileges are required before exploitation, but user interaction is required.
What is the impact if exploitation succeeds?
A successful exploit can allow an attacker to gain privileges, with high impact to confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available, and the issue is addressed in the Android security information dated 2016-08-05.