CVE-2016-10389

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In all Qualcomm products with Android releases from CAF using the Linux kernel, there is no size check for the images being flashed onto the NAND memory in their respective partitions, so there is a possibility of writing beyond the intended partition.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published: Aug 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-10399.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin CVE-2016-103909.8In all Qualcomm products with Android releases from CAF using the Linux kernel, when downloading a file, an excessive amount of memory may b CVE-2016-103919.8In all Qualcomm products with Android releases from CAF using the Linux kernel, the length in an HCI command is not properly checked for val CVE-2016-103929.8In all Qualcomm products with Android releases from CAF using the Linux kernel, a driver can potentially leak kernel memory.CVE-2016-103939.8In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, when processing a clip with CVE-2016-103947.8Initial xbl_sec revision does not have all the debug policy features and critical checks.CVE-2016-103957.8In FlexNet Publisher versions before Luton SP1 (11.14.1.1) running FlexNet Publisher Licensing Service on Windows platform, a boundary error CVE-2016-103967.5The racoon daemon in IPsec-Tools 0.8.2 contains a remotely exploitable computational-complexity attack when parsing and storing ISAKMP fragm CVE-2016-103977.5In PHP before 5.6.28 and 7.x before 7.0.13, incorrect handling of various URI components in the URL parser could be used by attackers to byp CVE-2016-103986.2Android 6.0 has an authentication bypass for attackers with root and physical access. Cryptographic authentication tokens (AuthTokens) used CVE-2016-103997.5Sendio versions before 8.2.1 were affected by a Local File Inclusion vulnerability that allowed an unauthenticated, remote attacker to read CVE-2016-10409.8Adobe Reader and Acrobat before 11.0.16, Acrobat and Acrobat Reader DC Classic before 15.006.30172, and Acrobat and Acrobat Reader DC Contin