CVE-2014-9869: Critical severity Google Android vulnerability
drivers/media/platform/msm/camerav2/isp/msmispstatsutil.c in the Qualcomm components in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices does not validate certain index values, which allows attackers to gain privileges via a crafted application, aka Android internal bug 28749728 and Qualcomm internal bug CR514711.
Affected Software
Remediation
Event History
Frequently Asked Questions
Which devices are identified as affected?
The issue is identified in Qualcomm components on Nexus 5 and Nexus 7 (2013) devices running Android versions before 2016-08-05.
What does an attacker need to exploit this issue?
An attacker needs to get a crafted application executed on the device. The CVSS vector indicates local access, no privileges required, and user interaction is required.
What is the impact if exploitation succeeds?
A successful exploit can allow an attacker to gain privileges, with high impact to confidentiality, integrity, and availability.
Is a fix available?
Yes. A patch is available; affected devices should be updated to an Android version that includes the fix.