CVE-2015-9209

CVE-2015-9209 targets Android devices with Qualcomm Snapdragon/mdm platforms, where there is improper access control in a file storage API. The issue affects a wide range of Qualcomm/SDP SKUs (e.g., MDM9xxx, MSM89xx, SD 210–850, SDX20) and is described in the Android vulnerability bulletin as req...

CVE-2015-9208

CVE-2015-9208 affects Android on Qualcomm Snapdragon devices (various SoCs listed). The vulnerability arises because tzbsp_pil_verify_sig() does not strictly constrain the ELF/program headers and hash segment pointers to secure memory; it only ensures addresses are not in non-secure memory, allow...

CVE-2015-9207

CVE-2015-9207 describes a buffer overread in playready_getadditional_responsedata due to insufficient input validation, affecting Android devices on Qualcomm Snapdragon Mobile and Snapdragon Wear (MSM8909W) and a range of Qualcomm SoCs (SD 210/212/205, 400, 410/12, 615/16/415, 617, 650/52, 800, 8...

CVE-2015-9206

Technical details about CVE-2015-9206 are not publicly provided in the connected documents. The materials available here reiterate the issue description but do not specify affected products, root cause, impact, or remediation. Monitor for updates.

CVE-2015-9205

In CVE-2015-9205, a buffer over-read can occur in a PlayReady API function on Android devices with Qualcomm SD series (MSM8909W, SD210/SD212/SD205, SD410/12, SD615/16/SD415, SD808, SD810). The issue affects Android before 2018-04-05 or earlier patch levels; CVSS indicates a critical impact (high ...

CVE-2015-9204

CVE-2015-9204 describes a buffer overread in Android on Qualcomm Snapdragon mobile/wear platforms (various SD series) when cchFriendlyName exceeds TZ_PR_MAX_NAME_LEN in playready_leavedomain_generate_challenge(). The issue is triggered in affected Android versions prior to the 2018-04-05 security...

CVE-2015-9203

CVE-2015-9203 describes a buffer overread caused by missing input validation in playready_set_domainid on a wide range of Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) and various Snapdragon SoCs. This affects Android versions up to the 2018-04-05 security patch level; the issue is doc...

CVE-2015-9199

CVE-2015-9199 describes a vulnerability in Android on Qualcomm Snapdragon platforms (Automobile and Mobile) affecting multiple SoCs including IPQ4019 and various SDx devices. The root cause is a non-secure region check performed during QSEE buffer address registration (passed by the HLOS) but not...

CVE-2015-9184

CVE-2015-9184 describes a buffer overflow in the Qualcomm WV dash core: lack of length checking in wv_dash_core_load_keys_v8() affects Android devices on Snapdragon Automotive, Snapdragon Mobile, and Snapdragon Wear MSM8909W, plus multiple SD platforms (e.g., 210/212/205, 400, 410/12, 425, 430, 4...

CVE-2015-9175

CVE-2015-9175 involves an untrusted pointer dereference in wv_dash_core_generic_verify() caused by insufficient input validation on a wide range of Qualcomm/Android components (Android devices with Snapdragon Automotive/Mobile/Wear). Public details confirm the affected families (e.g., various Sna...

CVE-2015-9173

CVE-2015-9173 affects Android devices with Qualcomm Snapdragon Mobile chips (SD410/12, SD617, SD650/52, SD800, SD808, SD810). The issue is a missing return-value check in memscpy, leading to memory corruption in the TQS App. The vulnerability is tied to patches applied for the 2018-04-01/2018-04-...

CVE-2015-9172

The CVE-2015-9172 issue affects Android platforms with WideVine API on Qualcomm Snapdragon families (Automotive, Mobile, Wear) including devices using SD 210/212/205, 400, 410/12, 425, 430, 450, 615/16/415, 617, 625, 650/52, 800, 808, 810, 820/820A, 835, 845, 850. In a WideVine API function, a bu...

CVE-2015-9169

CVE-2015-9169 describes a buffer over-read in the QSEE app on Android devices with Qualcomm Snapdragon Mobil/Wear platforms (various SD generations listed). The issue could lead to leakage of confidential information. The entry is publicly cataloged in NVD and CVE records, and is addressed by And...

CVE-2015-9165

CVE-2015-9165 affects Android devices with Qualcomm Snapdragon/related SoCs (IPQ4019, MDM9206, MDM9607, MSM8909W, SD 210/212/205, SD 400/410/12/615/16/ SD 415/617/650/52/ SD 808/810) where a flaw in the QTEE file service API allows a double-free due to incorrect error handling. The vulnerability ...

CVE-2015-9160

CVE-2015-9160 affects Qualcomm‑based Android devices (Snapdragon) prior to 2018-04-05 SPLs, where an integer overflow may occur in TZBSP_GFX_DCVS_UPDATE_ID when HLOS graphics driver busy time and total time values are very large. The issue is documented in NVD with a CVSS v3.0 base score of 9.8 (...

CVE-2015-9157

CVE-2015-9157 describes a race-condition in Android Qualcomm widevine support where rsp buffers passed to widevine commands in widevine_dash_cmd_handler() can be read or overflowed due to memory not being locked during time-of-check/time-of-use. Affected are Android devices with Qualcomm Snapdrag...

CVE-2015-9149

CVE-2015-9149 affects Android devices with Qualcomm Snapdragon chipsets (Automotive/Mobile/Wear families). In a DIAG ioctl handler , an untrusted pointer dereference could occur, enabling high-severity impact per CVSS (network, 3.0: 9.8). Provider details show a critical, remote-executable risk, ...

CVE-2015-9142

CVE-2015-9142 describes a bounds-check omission for a vtable index in the DAL-TO-QDI conversion framework affecting multiple Qualcomm/Snapdragon mobile platforms (Android before 2018-04-05 SPL or earlier patch level). Affected products include a broad set of Snapdragon/SDM devices listed in the d...

CVE-2015-9139

CVE-2015-9139 describes an input-validation issue during SSL handshake negotiation on Android devices with Qualcomm Snapdragon chipsets (various models) prior to the April 5, 2018 patch level. The vulnerability path is not elaborated beyond “improper input validation” during SSL negotiation, and ...

CVE-2015-9138

CVE-2015-9138 affects Android devices with Qualcomm-based SoCs. The issue arises when performing RSA encryption: the ce_util_to_unsigned_bin function uses the input address (c) instead of the buffer size, which can cause a logic overrun and potentially a buffer overflow. The vulnerability is desc...