CVE-2016-10341

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	All Qualcomm products	All Android releases from CAF using the Linux kernel

References

http://www.securityfocus.com/bid/98874Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038623
https://source.android.com/security/bulletin/2017-06-01Vendor Advisory
http://www.securityfocus.com/bid/98874Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1038623
https://source.android.com/security/bulletin/2017-06-01Vendor Advisory

Timeline

Published: Jun 13, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-103427.8In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a syscall handler.CVE-2016-103439.8In all Qualcomm products with Android releases from CAF using the Linux kernel, sSL handshake failure with ClientHello rejection results in CVE-2016-103449.8In all Qualcomm products with Android releases from CAF using the Linux kernel, the use of an out-of-range pointer offset is potentially pos CVE-2016-103457.8In Phusion Passenger before 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local a CVE-2016-103469.8In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow vulnerability exists in the hypervisor.CVE-2016-103479.8In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a hypervisor function is not properly validat CVE-2016-103495.5The archive_le32dec function in archive_endian.h in libarchive 3.2.2 allows remote attackers to cause a denial of service (heap-based buffer CVE-2016-10357.5Adobe RoboHelp Server 9 before 9.0.1 mishandles SQL queries, which allows attackers to obtain sensitive information via unspecified vectors.CVE-2016-103505.5The archive_read_format_cab_read_header function in archive_read_support_format_cab.c in libarchive 3.2.2 allows remote attackers to cause a CVE-2016-103515.5Telegram Desktop 0.10.19 uses 0755 permissions for $HOME/.TelegramDesktop, which allows local users to obtain sensitive authentication infor CVE-2016-10366.1Cross-site scripting (XSS) vulnerability in Adobe Analytics AppMeasurement for Flash Library before 4.0.1, when debugTracking is enabled, al CVE-2016-103626.5Prior to Logstash version 5.0.1, Elasticsearch Output plugin when updating connections after sniffing, would log to file HTTP basic auth cre