Vulnerability Details : CVE-2014-9932
In TrustZone, an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel due to an improper address range computation.
Published
2017-05-16 14:29:00
Updated
2017-07-11 01:33:21
Vulnerability category: Overflow
Exploit prediction scoring system (EPSS) score for CVE-2014-9932
Probability of exploitation activity in the next 30 days: 0.10%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 41 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-9932
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
7.8
|
HIGH | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.8
|
5.9
|
NIST |
CWE ids for CVE-2014-9932
-
The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9932
-
http://www.securityfocus.com/bid/97329
Google Android Qualcomm components Multiple Unspecified Security VulnerabilitiesThird Party Advisory;VDB Entry
-
https://source.android.com/security/bulletin/2017-04-01
Android Security Bulletin—April 2017 | Android Open Source ProjectPatch;Vendor Advisory
-
http://www.securitytracker.com/id/1038201
Google Android Multiple Flaws Let Users Deny Service, Obtain Potentially Sensitive Information, and Gain Elevated Privileges and Let Remote Users Execute Arbitrary Code - SecurityTracker
Products affected by CVE-2014-9932
- cpe:2.3:o:google:android:-:*:*:*:*:*:*:*