CVE-2017-15856

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-362CWE-415

Affected software

No affected versions have been published.

Timeline

Published
Jul 6, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-158577.8In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all Android releases froCVE-2017-158597.5While processing the QCA_NL80211_VENDOR_SUBCMD_SET_TXPOWER_SCALE_DECR_DB vendor command, in which attribute QCA_WLAN_VENDOR_ATTR_TXPOWER_SCACVE-2017-158607.8In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management framCVE-2017-158617.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in the function wma_roam_synch_event_handler, vdev_id is recCVE-2017-158627.8In all Qualcomm products with Android releases from CAF using the Linux kernel, in wma_unified_link_radio_stats_event_handler(), the number CVE-2017-158636.1Cross Site Scripting (XSS) exists in the wp-noexternallinks plugin before 3.5.19 for WordPress via the date1 or date2 parameter to wp-admin/CVE-2017-158648.8In the Agent Frontend in Open Ticket Request System (OTRS) 3.3.x through 3.3.18, with a crafted URL it is possible to gain information like CVE-2017-158657.5bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3 and other products, allows remote attackersCVE-2017-158676.1Multiple cross-site scripting (XSS) vulnerabilities in the user-login-history plugin through 1.5.2 for WordPress allow remote attackers to iCVE-2017-158687.8The bnep_add_connection function in net/bluetooth/bnep/core.c in the Linux kernel before 3.19 does not ensure that an l2cap socket is availaCVE-2017-158696.1Cross-site scripting (XSS) vulnerability in knowledgebase.php in LiveZilla before 7.0.8.9 allows remote attackers to inject arbitrary web scCVE-2017-158706.7Palo Alto Networks GlobalProtect Agent before 4.0.3 allows attackers with administration rights on the local station to gain SYSTEM privileg
CVE-2017-15856: High severity, CVSS 7.0 | Vulnix