CVE-2016-9279

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Use-after-free vulnerability in the Samsung Exynos fimg2d driver for Android with Exynos 5433, 54xx, or 7420 chipsets allows attackers to obtain sensitive information via unspecified vectors. The Samsung ID is SVE-2016-6853.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/11/09/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/11/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94283Third Party Advisory, VDB Entry
http://security.samsungmobile.com/smrupdate.html#SMR-NOV-2016Vendor Advisory
http://www.openwall.com/lists/oss-security/2016/11/09/3Mailing List, Third Party Advisory
http://www.openwall.com/lists/oss-security/2016/11/11/11Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/94283Third Party Advisory, VDB Entry

Timeline

Published: Jan 18, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-92827.5SQL Injection in framework/modules/search/controllers/searchController.php in Exponent CMS v2.4.0 allows remote attackers to read database i CVE-2016-92837.5SQL Injection in framework/core/subsystems/expRouter.php in Exponent CMS v2.4.0 allows remote attackers to read database information via add CVE-2016-92845.3getUsersByJSON in framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0 allows remote attackers to read user inform CVE-2016-92855.3framework/modules/addressbook/controllers/addressController.php in Exponent CMS v2.4.0 allows remote attackers to read user information via CVE-2016-92865.3framework/modules/users/controllers/usersController.php in Exponent CMS v2.4.0patch1 does not properly restrict access to user records, whic CVE-2016-92879.8In /framework/modules/notfound/controllers/notfoundController.php of Exponent CMS 2.4.0 patch1, untrusted input is passed into getSearchResu CVE-2016-92889.8In framework/modules/navigation/controllers/navigationController.php in Exponent CMS v2.4.0 or older, the parameter "target" of function "Dr CVE-2016-92947.5Artifex Software, Inc. MuJS before 5008105780c0b0182ea6eda83ad5598f225be3ee allows context-dependent attackers to conduct "denial of service CVE-2016-92967.5A null pointer dereference bug affects the 16.02 and many old versions of p7zip. A lack of null pointer check for the variable folders.PackP CVE-2016-92977.5The TIFFFetchNormalTag function in LibTiff 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via crafted TIFF_CVE-2016-92985.5Heap overflow in the WaveletDenoiseImage function in MagickCore/fx.c in ImageMagick before 6.9.6-4 and 7.x before 7.0.3-6 allows remote atta CVE-2016-92999.8The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized