CVE-2016-5862

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

When a control related to codec is issued from userspace in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, the type casting is done to the container structure instead of the codec's individual structure, resulting in a device restart after kernel crash occurs.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	All Qualcomm products	Android for MSM, Firefox OS for MSM, QRD Android

References

http://www.securityfocus.com/bid/98194Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2017-05-01Patch, Vendor Advisory
https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=4199451e83729a3add781eeafaee32994ff65b04Issue Tracking, Patch, Third Party Advisory
http://www.securityfocus.com/bid/98194Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2017-05-01Patch, Vendor Advisory
https://source.codeaurora.org/quic/la//kernel/msm-4.4/commit/?id=4199451e83729a3add781eeafaee32994ff65b04Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Aug 16, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-58637.8In an ioctl handler in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing whi CVE-2016-58647.8In an audio driver function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, some parameters are from user CVE-2016-58677.0In a sound driver in Android for MSM, Firefox OS for MSM, QRD Android, some variables are from userspace and values can be chosen that could CVE-2016-58687.0drivers/net/ethernet/msm/rndis_ipa.c in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a cr CVE-2016-58707.8The msm_ipc_router_close function in net/ipc_router/ipc_router_socket.c in the ipc_router component for the Linux kernel 3.x, as used in Qua CVE-2016-58719.8In all Qualcomm products with Android releases from CAF using the Linux kernel, an integer overflow to buffer overflow vulnerability exists CVE-2016-58729.8In all Qualcomm products with Android releases from CAF using the Linux kernel, arguments to several QTEE syscalls are not properly validate CVE-2016-58739.8Buffer overflow in the HTTP URL parsing functions in pecl_http before 3.0.1 might allow remote attackers to execute arbitrary code via non-p CVE-2016-58747.5Siemens SIMATIC NET PC-Software before 13 SP2 allows remote attackers to cause a denial of service (OPC UA service outage) via crafted TCP p CVE-2016-58765.9ownCloud server before 8.2.6 and 9.x before 9.0.3, when the gallery app is enabled, allows remote attackers to download arbitrary images via CVE-2016-58786.8Open redirect vulnerability in IBM FileNet Workplace 4.0.2 before 4.0.2.14 allows remote authenticated users to redirect users to arbitrary CVE-2016-58798.8MQCLI on IBM MQ Appliance M2000 and M2001 devices allows local users to execute arbitrary shell commands via a crafted (1) Disaster Recovery