Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOCMSMVPEDEQUEUESTREAMBUFFINFO ioctl call, related to drivers/media/platform/msm/camerav2/pproc/vpe/msmvpe.c, or (2) a crafted VIDIOCMSMCPPDEQUEUESTREAMBUFFINFO ioctl call, related to drivers/media/platform/msm/camerav2/pproc/cpp/msmcpp.c.