CVE-2017-15855

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, the camera application triggers "user-memory-access" issue as the Camera CPP module Linux driver directly accesses the application provided buffer, which resides in user space. An unchecked userspace value (ioctl_ptr->len) is used to copy contents to a kernel buffer which can lead to kernel buffer overflow.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119 CWE-129

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Android for MSM, Firefox OS for MSM, QRD Android	All Android releases from CAF using the Linux kernel

References

https://source.android.com/security/bulletin/pixel/2018-04-01Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/03/29/march-2018-code-aurora-security-bulletinPatch, Third Party Advisory
https://source.android.com/security/bulletin/pixel/2018-04-01Third Party Advisory
https://www.codeaurora.org/security-bulletin/2018/03/29/march-2018-code-aurora-security-bulletinPatch, Third Party Advisory

Timeline

Published: May 17, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-158567.0Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases fr CVE-2017-158577.8In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases fro CVE-2017-158597.5While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCA CVE-2017-158607.8In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management fram CVE-2017-158617.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is rec CVE-2017-158627.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in wma_unified_link_radio_stats_event_handler(), the number CVE-2017-158636.1Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/CVE-2017-158648.8In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like CVE-2017-158657.5bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackers CVE-2017-158676.1Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to i CVE-2017-158687.8The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is availa CVE-2017-158696.1Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to inject arbitrary web sc