CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...

CVE-2019-2332

CVE-2019-2332 : A memory corruption issue in Qualcomm Snapdragon families (numerous SDMs/SDX/SDA/SM models) arises when payload size is not validated before memory access. CVSSv3.1 base score 9.8 (CRITICAL; Network, Low, None) per NVD; exploitation could occur remotely without user interaction. C...

CVE-2014-10062

The CVE-2014-10062 issue concerns Android on Qualcomm Snapdragon mobile/wear devices where LocationService is exported, enabling other services to import and call its methods to bring up a data connection. This could allow a nearby or malicious service to trigger data-connection initiation if it ...

CVE-2015-9142

CVE-2015-9142 describes a bounds-check omission for a vtable index in the DAL-TO-QDI conversion framework affecting multiple Qualcomm/Snapdragon mobile platforms (Android before 2018-04-05 SPL or earlier patch level). Affected products include a broad set of Snapdragon/SDM devices listed in the d...

CVE-2015-9161

CVE-2015-9161 describes a TOCTOU-induced buffer overflow in playready_reader_bind() affecting Android on Qualcomm Snapdragon platforms (MSM8909W; SD 210/212/205; SD 400; SD 410/12; SD 615/16/SD 415; SD 617; SD 650/52; SD 800; SD 808; SD 810). Affected Android versions are before the 2018-04-05 se...

CVE-2015-9181

CVE-2015-9181 is a buffer over-read in a crypto API function affecting multiple Qualcomm Snapdragon platforms (Automobile, Mobile, Wear; SD 210/212/205, 400, 410/12, 425, 430, 450, 615/16/ SD 415, 617, 625, 650/52, 800, 808, 810, 820/820A, 835). Root cause is a memory over-read in the crypto API ...

CVE-2015-9195

CVE-2015-9195 affects Android (pre-2018-04-05 patch level) on Qualcomm Snapdragon platforms (MDM9625/9635M/9650/9655; SD 400/410–12/615/16/415/617/650/52/808/810; SDX20) where a QTEE syscall handler can trigger a buffer overflow in the High-Level OS (HLOS). The issue is rooted in the QTEE syscall...

CVE-2015-9209

CVE-2015-9209 targets Android devices with Qualcomm Snapdragon/mdm platforms, where there is improper access control in a file storage API. The issue affects a wide range of Qualcomm/SDP SKUs (e.g., MDM9xxx, MSM89xx, SD 210–850, SDX20) and is described in the Android vulnerability bulletin as req...

CVE-2016-10417

The CVE-2016-10417 entry describes a TOCTOU vulnerability in QTEE across numerous Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) including IPQ4019, MDM9xxx, SD-series chips. The issue arises from improper access control, enabling timing-based races that could compromise confidentiality,...

CVE-2016-10435

CVE-2016-10435 is a TOCTOU vulnerability in some Qualcomm QTEE syscall handlers affecting Android versions prior to the 2018-04-05 security patch level (and prior to patches included in the 2018-04-01/05 Android bulletins). The issue is documented as enabling potential compromises in confidential...

CVE-2016-10449

CVE-2016-10449 affects Android on Qualcomm Snapdragon devices (GNSS API) where, prior to the 2018-04-05 patch level, a NULL pointer dereference in GNSS API functions could occur. The issue is associated with Snapdragon Mobile and Wear platforms (e.g., MDM9206/9607/9640/9650, MSM8909W, SD 210–835 ...

CVE-2016-10476

CVE-2016-10476 affects Android on Qualcomm Snapdragon/mobile platforms (e.g., MSM/SD family). The issue is missing array index checks on the app index in function qcril_uim_clear_encrypted_pin, causing out-of-bounds reads when the app index is too large. Documented in multiple sources as a vulner...

CVE-2017-14912

CVE-2017-14912 describes an issue on Android before 2018-01-05 running on Qualcomm Snapdragon IoT and Snapdragon Mobile (devices listed: MDM9206, MDM9607, MDM9650, MSM8909W, SD 200/210/212/205, SD 400/410/12, SD 425, 430, 615/16/SD 415, 617, 625, 650/52, 800, 835). The vulnerability stems from th...

CVE-2017-18130

CVE-2017-18130 is a buffer over-read vulnerability in Android media handling (ASF playback) affecting Qualcomm Snapdragon Mobile/Automobile/Wear platforms and a range of Snapdragon SoCs. Root cause: potential over-read during ASF file processing could lead to arbitrary code execution or crashes w...

CVE-2017-18145

CVE-2017-18145 describes a Use-After-Free condition in the DPM native process while handling Android framework events on Qualcomm Snapdragon platforms. The underlying issue is that an iterator pointer is deleted after an event is processed, which can cause a Use After Condition during processing ...

CVE-2017-18279

CVE-2017-18279 involves a buffer length check omission that can cause a buffer overflow in the camera module across a range of Qualcomm/Snapdragon platforms (Small Cell SoC, Snapdragon Mobile/Wear and related SoCs such as FSM9055/ FSM9955, IPQ4019/8064, MDM/multiple, QCA/SD series). The provided ...

CVE-2017-18319

CVE-2017-18319 corresponds to an information disclosure in the UIM API debug messages affecting Snapdragon/mobile devices listed (MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415,...

CVE-2018-5874

The CVE-2018-5874 issue is a stack-based buffer overflow occurring in the MP4 parser of Qualcomm Snapdragon components: Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. The root cause is a parsing-time overflow in the MP4 handling, with the impact described as potential arbitrary cod...

CVE-2019-10488

CVE-2019-10488 describes a Null pointer dereference in the Qualcomm Snapdragon media parsing when handling nonstandard clips; the issue affects a broad range of Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.) across many SD/SoC families listed in the description. Root cause is ...

CVE-2019-10505

CVE-2019-10505 describes an out-of-bounds access issue when processing a non-standard IE measurement request whose length crosses the frame boundary in Qualcomm Snapdragon platforms. Affected are a wide range of Snapdragon devices and families, including Snapdragon Auto, Snapdragon Consumer Elect...

CVE-2019-2331

CVE-2019-2331 describes a possible integer overflow caused by subtracting two integers without overflow checks in Qualcomm/Xiaomi Snapdragon family devices (e.g., Snapdragon Auto/Compute/IoT/Mobile and related SSDs listed in the description). The issue affects a broad set of Qualcomm/Snapdragon c...

CVE-2015-9182

Technical details about CVE-2015-9182 (affected Qualcomm Android components, exact versions, exploit conditions) are not publicly provided in the connected documents. Monitor for updates from NVD/Android bulletins for concrete impact and remediation.

CVE-2015-9189

The CVE-2015-9189 issue affects Android devices with Qualcomm Snapdragon SoCs (e.g., IPQ4019, MDM9xxx, SD 210/212/205, SD 400/410/12, SD 600/615/16/SD 415, SD 808, SD 810) prior to the 2018-04-05 patch level. The root cause is a vulnerability in the TZ application command handling (tz_app_cmd_han...

CVE-2015-9213

CVE-2015-9213 affects Android devices with Qualcomm Snapdragon/mobile platforms. The issue arises from the DIAG-EFS EFS2_DIAG_DELTREE command, handled by fs_diag_deltree_handler(), which is documented to delete files and directories only inside the /public folder. According to NVD, the vulnerabil...

CVE-2016-10407

CVE-2016-10407 affects Android platforms prior to the 2018-04-05 patch level, involving an integer overflow that can trigger a buffer overflow during a VT call on Qualcomm Snapdragon Mobile SoCs (SD 210/212/205, 400, 410/12, 430, 450, 615/16/ SD 415, 617, 625, 650/52, 800, 808, 810, 820, 835). Af...

CVE-2016-10445

CVE-2016-10445 describes improper input validation in a Qualcomm QTEE API function affecting Android devices with Snapdragon Automotive and Snapdragon Mobile platforms (SD 410/12, 425, 427, 430, 435, 450, 615/16/SD 415, 625, 820, 820A, 835, 845, 850, SDM630/636/660, Snapdragon_High_Med_2016). The...

CVE-2016-10451

CVE-2016-10451 affects Android devices with Qualcomm-based Snapdragon Mobile and Snapdragon Wear platforms (various SDM/MDM/SD series listed in the description). The issue is privilege escalation caused by inherently insecure handling of local files, exploitable on devices prior to the 2018-04-05...

CVE-2016-10456

CVE-2016-10456 affects Android on Qualcomm Snapdragon Mobile and Snapdragon Wear platforms (numerous SoCs listed in the description). The issue arises when the radish component is run with an invalid network interface name, allowing an arbitrary command of up to 15 characters to be executed as a ...

CVE-2016-10466

CVE-2016-10466 affects Android devices with Qualcomm Snapdragon mobile platforms (various Snapdragon families listed in the description). The vulnerability arises during SSL/TLS handshakes: if the RNG function (crypto API) returns an error, the SSL implementation uses a hard-coded random value, p...

CVE-2016-10484

CVE-2016-10484 describes a buffer underflow in RPMB transfer size calculation when a RPMB listener uses a very small buffer, leading to buffer overflow on affected Qualcomm Snapdragon platforms (Android devices with RPMB support). The issue is triggered during read/write operations and is tied to...

CVE-2016-10491

CVE-2016-10491 is an Android vulnerability affecting devices with Qualcomm Snapdragon Mobile and related SoCs. The issue arises from an integer overflow that can overflow a buffer in a QuRT API function, potentially enabling further impact on affected devices. Public references describe impact ac...

CVE-2017-18303

CVE-2017-18303 describes a buffer overflow in Qualcomm Snapdragon components (including Snapdragon Automobile, Mobile, and Wear families across listed SD/x chips) caused by unvalidated inputs while processing the sensors registry configuration file. The root cause is input validation failure lead...

CVE-2017-18326

CVE-2017-18326 affects Qualcomm Snapdragon mobile and Snapdragon Wear modem components (e.g., MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/212/205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 800, ...

CVE-2017-8276

CVE-2017-8276 describes improper authorization involving a fuse in TrustZone affecting Qualcomm Snapdragon automotive, mobile, and wear platforms. Documented affected families include MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439/SD 429, SD 4...

CVE-2018-11258

CVE-2018-11258 is a Use-After-Free vulnerability in the ADSP RPC component affecting Snapdragon devices (including Snapdragon Automotive, Mobile, and Wear platforms) with affected generations such as MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, and various SDx and SoCs (e.g., SD 210/212/205, 4...

CVE-2018-11888

CVE-2018-11888 targets Qualcomm Snapdragon platforms, where the SCP11 Crypto Services Trust Application can be commanded by other TAs. Affects numerous Snapdragon SoCs (e.g., SD 210/212/205 through SD 835, 820/820A, 650/52, 625, 615/16, and others) across MDM9607/9650/9655, MSM8996AU, and related...

CVE-2019-2322

CVE-2019-2322 is a buffer overflow vulnerability in Qualcomm Snapdragon media playback paths affecting a wide range of Snapdragon SoCs and product lines (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon Mobile, Media frameworks). The issue occurs when playing a specific non-standard clip, e...

CVE-2014-10053

CVE-2014-10053 relates to a Widevine-related data access validation issue in Android on Qualcomm Snapdragon platforms (automotive, mobile, wearables) prior to the 2018-04-05 security patch level. The description specifies that data access was not properly validated within the Widevine secure appl...

CVE-2014-9990

CVE-2014-9990 pertains to Android devices using Qualcomm Snapdragon platforms (e.g., MDM92xx, MSM89xx, SD 210/212/205, 410/12, 425, 430, 600, 615/16/415, 625, 650/52, 808, 810, 450, etc.). Description: lack of input validation could cause an out-of-bounds array access. The involved advisories ind...

CVE-2015-9123

CVE-2015-9123 affects many Qualcomm/Android components where code to zeroize the AES key could be optimized away by the compiler, potentially causing information disclosure. The issue is described as an information disclosure vulnerability that could occur on Android devices with affected Snapdra...

CVE-2015-9124

CVE-2015-9124 affects Android devices with Qualcomm Snapdragon SoCs (MDM9625/9635M/9640/9645 and SD families 210/212/205, 400, 410/12, 615/16/415, 800, 808, 810). The issue can cause a crash or expose otherwise inaccessible memory contents when accessing an invalid pointer. The Android bulletin c...

CVE-2015-9130

CVE-2015-9130 describes a NULL pointer dereference in a PlayReady function on Android running on Qualcomm Snapdragon Mobile and Snapdragon Wear (e.g., MSM8909W; SD 210/212/205; 400; 410/12; 615/16/SD 415; 617; 650/52; 808; 810) prior to the 2018-04-05 security patch level. The issue is exploitabl...

CVE-2015-9149

CVE-2015-9149 affects Android devices with Qualcomm Snapdragon chipsets (Automotive/Mobile/Wear families). In a DIAG ioctl handler , an untrusted pointer dereference could occur, enabling high-severity impact per CVSS (network, 3.0: 9.8). Provider details show a critical, remote-executable risk, ...

CVE-2015-9166

CVE-2015-9166 concerns DRM provisioning in QSEE-based components on Qualcomm Snapdragon platforms. The issue arises because the finalize_prov_flag.data mechanism, intended to prevent further provisioning after initial provisioning, is not sufficiently checked, allowing provisioning to proceed eve...

CVE-2015-9169

CVE-2015-9169 describes a buffer over-read in the QSEE app on Android devices with Qualcomm Snapdragon Mobil/Wear platforms (various SD generations listed). The issue could lead to leakage of confidential information. The entry is publicly cataloged in NVD and CVE records, and is addressed by And...

CVE-2015-9171

CVE-2015-9171 describes a buffer over-read in OEMCrypto_Dash_InstallEncapKeybox() when keyBoxLength exceeds TZ_WV_MAX_DATA_LEN (20k) on various Qualcomm/Android components. Affected: Android devices with Qualcomm Snapdragon Automotive/Mobile/Wear stack listed in the description (multiple SoCs). R...

CVE-2015-9176

CVE-2015-9176 affects Android devices using Qualcomm Snapdragon chipsets (e.g., automobile, mobile, wearables) where Input_address is registered as a shared buffer and not properly checked before use in OEMCrypto_Generic_Sign(). This can allow access to addresses in secure/CP memory. The vulnerab...

CVE-2015-9185

Technical details such as affected products, component, root cause, impact, and fixes are not publicly provided in the supplied documents; monitor for updates.

CVE-2015-9188

The CVE-2015-9188 issue concerns Qualcomm/Android devices where, before the 2018-04-05 patch level, the Secure DEMUX command handler may write an error code into a response buffer without validating the buffer length, risking memory corruption. Affected products include various Snapdragon Automot...

CVE-2015-9201

CVE-2015-9201 describes an integer overflow in tzbsp that can lead to privilege escalation on multiple Qualcomm Snapdragon/Android platforms (Automotive, Mobile, Wear, and related SoCs). The affected components and devices span Qualcomm’s tzbsp-related code paths used in Snapdragon lines (e.g., I...