CVE-2017-14913

CVE-2017-14913 concerns a Qualcomm-closed source component vulnerability in Android prior to the 2018-01-05 patch level. The issue involves DDR address input validation that is allegedly truncated, potentially enabling remote impact over the network with no user interaction. The CVE is listed und...

CVE-2017-9681

In Android before 2017-08-05 on Qualcomm MSM, Firefox OS for MSM, QRD Android, and all Android releases from CAF using the Linux kernel, if kernel memory address is passed from userspace through irisvidiocsextctrls ioctl, it will print kernel address data. A user could set it to an arbitrary kern...

CVE-2017-14911

CVE-2017-14911 describes a critical elevation/remote-privilege issue in Qualcomm components where the XBL loader could skip authentication of device config on several Snapdragon platforms (IoT, Mobile, Auto, and various SD/SoCs). Public records identify the affected elements as Qualcomm closed‑so...

CVE-2017-11010

CVE-2017-11010 affects Qualcomm closed-source components in Android (devices using Snapdragon IoT and listed SD/mobiles). Description from the CVE: leaving a configuration space unprotected due to faulty access control. Impact as per CVSS: Critical/HIGH on confidentiality, integrity, and availabi...

CVE-2017-11010

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 625, SD 650/52, SD 835, access control left a configuration space unprotected...

CVE-2017-14906

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, PKCS7 padding is not supported by the crypto storage APIs...

CVE-2017-9681

In CVE-2017-9681, the issue affects Android devices using the Linux kernel in Qualcomm MSM/CAF builds (including Firefox OS for MSM and QRD Android). The vulnerability arises when a user-supplied kernel memory address is passed from userspace through the iris_vidioc_s_ext_ctrls ioctl, causing the...

CVE-2017-14915

CVE-2017-14915 describes a critical vulnerability in Android prior to 2018-01-05 affecting Qualcomm Snapdragon Mobile (SD 625, 650/52, 835). The issue arises when accessing SPCOM functions with a compromised client structure, leading to a Use-After-Free condition. The documented CVSSv3 base score...

CVE-2017-14915

In Android before 2018-01-05 on Qualcomm Snapdragon Mobile SD 625, SD 650/52, SD 835, accessing SPCOM functions with a compromised client structure can result in a Use After Free condition...

CVE-2017-14912

In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile VERSION: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 835, the attributes of buffers in Secure Display were n...

CVE-2017-14906

CVE-2017-14906 affects Android on Qualcomm Snapdragon IoT devices (including Snapdragon Mobile MDM9206/MDM9607/MSM8909W, SD 210/212/205, SD 410/12) where PKCS7 padding is not supported by the crypto storage APIs. According to NVD, the issue is rated CVSS v3.0/9.8 (CRITICAL) with network attack ve...

CVE-2017-14912

CVE-2017-14912 describes an issue on Android before 2018-01-05 running on Qualcomm Snapdragon IoT and Snapdragon Mobile (devices listed: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200/210/212/205, SD 400/410/12, SD 425, 430, 615/16/SD 415, 617, 625, 650/52, 800, 835). The vulnerability stems from th...

Google Android Qualcomm WLAN elevation of privilege vulnerability (CNVD-2018-07759)

Android on Google Pixel and Nexus is a Linux-based open source operating system for the Google Pixel and Nexus smartphones developed by Google Inc. and the Open Handset Alliance OHA, with Qualcomm WLAN being one of the components used. Qualcomm WLAN is a wireless LAN component developed by Qualco...

CVE-2017-5947

An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download EDL mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as...

Code injection

An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download EDL mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as...

CVE-2017-5947

An issue was discovered in OnePlus One, X, 2, 3, 3T, and 5 devices with OxygenOS 5.0 and earlier. The attacker can reboot the device into the Qualcomm Emergency Download EDL mode through ADB or by using Volume-Up when connected to USB, which in turn could allow for downgrading partitions such as...

CVE-2017-5947

The CVE-2017-5947 issue affects OnePlus devices (OnePlus One, X, 2, 3, 3T, 5) running OxygenOS 5.0 and earlier. The root cause is the ability to force a reboot into Qualcomm Emergency Download (EDL) mode via ADB or Volume-Up when USB is connected, which can enable downgrading critical partitions ...

Google Android Qualcomm Closed Source Component Buffer Overflow Vulnerability

Android is a Linux-based open-source operating system developed by Google and the Open Handheld Alliance OHA, and Qualcomm closed-source components are among the closed-source components developed by Qualcomm. A buffer overflow vulnerability exists in the Qualcomm closed-source component in...

The vulnerability of the Bootloader component of Android operating systems from the CAF repository allows a hacker to trigger buffer overflows.

The vulnerability of the bootloader component of Android operating systems from the CAF repository arises from an operation that occurs outside the buffer in memory. Exploiting this vulnerability allows a malicious actor, operating remotely, to trigger buffer overflows by manipulating data relate...

Unspecified Vulnerability in Google Android Qualcomm Closed Source Component (CNVD-2018-07479)

Android is a Linux-based open-source operating system developed by Google and the Open Handheld Alliance OHA, and Qualcomm closed-source components are among the closed-source components developed by Qualcomm. A security vulnerability exists in the Qualcomm closed-source component in Android. No...