CVE-2016-10411

CVE-2016-10411 affects Android devices with Qualcomm Snapdragon SoCs (SD 210/212/205, 400, 410/12, 430, 450, 615/16/415, 617, 625, 650/52, 800, 808, 810, 820, 835). The vulnerability lies in the RTP daemon’s RTCP packet handling; a parser misinterprets an unknown RTCP APP packet, causing the pack...

CVE-2016-10433

CVE-2016-10433 is an Android/Qualcomm TOCTOU vulnerability during SSD image decryption that can cause memory corruption on affected Snapdragon Mobile/Automotive/Wear platforms (various SDP/SD devices). The issue affects Android images prior to the 2018-04-05 security patch level; Android/patched ...

CVE-2016-10456

CVE-2016-10456 affects Android on Qualcomm Snapdragon Mobile and Snapdragon Wear platforms (numerous SoCs listed in the description). The issue arises when the radish component is run with an invalid network interface name, allowing an arbitrary command of up to 15 characters to be executed as a ...

CVE-2017-18136

CVE-2017-18136 concerns a Use After Free condition in the Android omx aac component affecting Qualcomm platforms (Snapdragon Automobile, Mobile, Wear; various SD/MDM chips). The issue is triggered in the omx aac component and may potentially allow a remote attacker to exploit it, with the CVSS in...

CVE-2017-18140

CVE-2017-18140 affects Android on Qualcomm Snapdragon Automotive/Mobile/Wear platforms. The issue occurs when processing a call disconnection; an attempt to print the RIL token-id to the debug log can lead to a Use After Free condition if eMBMS is enabled, potentially enabling a network-initiated...

CVE-2017-18294

CVE-2017-18294 describes a buffer overread when reading the ELF header file class type on Qualcomm closed‑source components (e.g., SoCs in Snapdragon/SD lines). The root cause is a size check mismatch where the ELF file size is less than the ELF64 header, potentially enabling local code execution...

CVE-2017-18295

CVE-2017-18295 describes a possible buffer overflow in the DSP Service module across Snapdragon platforms (Automobile, Mobile, Wear) for various Qualcomm SoCs (MDM9206/9607/9650, MSM8909W/8996AU, SD family up to SD835/SDX20). Root cause: input that is not null terminated may overflow a buffer, po...

CVE-2017-8276

CVE-2017-8276 describes improper authorization involving a fuse in TrustZone affecting Qualcomm Snapdragon automotive, mobile, and wear platforms. Documented affected families include MDM9206, MDM9607, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439/SD 429, SD 4...

CVE-2019-2322

CVE-2019-2322 is a buffer overflow vulnerability in Qualcomm Snapdragon media playback paths affecting a wide range of Snapdragon SoCs and product lines (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon Mobile, Media frameworks). The issue occurs when playing a specific non-standard clip, e...

CVE-2014-9987

The CVE-2014-9987 issue is an Android DRM API buffer over-read affecting Qualcomm Snapdragon platforms (MDM9206/9650 and various SD chips). Root cause is a DRM API buffer over-read in affected builds. Impact is high (CVE is listed as CRITICAL/HIGH in CVE notes) with potential confidentiality, int...

CVE-2015-9127

CVE-2015-9127 affects Android devices with Qualcomm Snapdragon platforms (e.g., MSM8909W, SD 210/212/205, 400/410/12/16, 415, 810) where a large buffer allocation in the Playready App can trigger a null pointer dereference due to memory allocation failure. This is described as a vulnerability in ...

CVE-2015-9141

CVE-2015-9141 impacts Android on Qualcomm Snapdragon platforms (e.g., MDM9206/9607/9635M, MSM8909W, SD 210–SD 810) in HHO scenarios. During the ACQ procedure, the search database can be incorrectly updated, causing memory corruption due to a buffer overflow. NVD references list a high/critical ri...

CVE-2015-9144

CVE-2015-9144 concerns a buffer overflow in Android on Qualcomm Snapdragon Mobile and Snapdragon Wear platforms (e.g., MDM9206/9607/9615/9625/9635M/9640/9645/9650/9655, MSM8909W, SD family up to SDX20) during processing of scheduling message information. Root cause: overflow in a scheduling-messa...

CVE-2015-9188

The CVE-2015-9188 issue concerns Qualcomm/Android devices where, before the 2018-04-05 patch level, the Secure DEMUX command handler may write an error code into a response buffer without validating the buffer length, risking memory corruption. Affected products include various Snapdragon Automot...

CVE-2015-9192

CVE-2015-9192 affects Android devices with Qualcomm Snapdragon components (Automobile, Mobile, Wear; various SD/MDM variants). The issue is an out-of-bounds memory access in the content protection manager caused by improper validation of incoming messages. This is described in the Android 2018-04...

CVE-2016-10414

CVE-2016-10414 affects Android devices using Qualcomm Small Cell SoCs (and related Snapdragon/SD variants) where passing a hash with zero datalength causes the code to return an error, even though zero length is valid. Connected sources confirm the issue and map it to a broad set of Qualcomm/Andr...

CVE-2016-10425

CVE-2016-10425 concerns a buffer overflow in the GPT listener on Qualcomm Snapdragon platforms (Automotive, Mobile, Wear) when a large buffer offset is passed. Affected Android releases include Android builds up to the 2018-04-05 security patch level across Snapdragon 210/212/205, 400, 410/12, 42...

CVE-2016-10477

CVE-2016-10477 corresponds to a buffer overflow in Android devices on Qualcomm Snapdragon mobile platforms when processing smart card requests. Affected devices include Qualcomm chipsets SD 210/212/205, SD 400, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, and SD 82...

CVE-2016-10484

CVE-2016-10484 describes a buffer underflow in RPMB transfer size calculation when a RPMB listener uses a very small buffer, leading to buffer overflow on affected Qualcomm Snapdragon platforms (Android devices with RPMB support). The issue is triggered during read/write operations and is tied to...

CVE-2016-10490

CVE-2016-10490 is a buffer overflow vulnerability in Android devices with Qualcomm Snapdragon SoCs (including Snapdragon Automobile, Mobile, Wear, and various SD/MDM models) triggered when a negative value is passed as the argument max to qurt_qdi_state_local_new_handle_from_obj. The root cause i...

CVE-2016-10496

CVE-2016-10496: A NULL pointer dereference during an SSL handshake can affect Android devices on Qualcomm Snapdragon Mobile platforms (MDM9635M; SD 210/212/205; 410/12; 450; 615/16/415; 625; 650/52; 808; 810). Root cause is a NULL pointer dereference in the SSL handshake path affecting multiple S...

CVE-2017-18144

CVE-2017-18144 affects Android on Qualcomm Snapdragon Mobile/Wear platforms (e.g., MSM8909W, SD 210/212/205, 450, 615/16, 625, 650/52, 820, 835, 845) prior to the 2018-04-05 patch. The issue occurs when processing retransmissions of WPA supplicant command send failures: if transmission fails, a U...

CVE-2017-18157

CVE-2017-18157 is described as a Use After Free condition in the Thermal Engine affecting Snapdragon Automotive, Mobile, and Wear platforms (list includes MDM9206, MDM9607, MDM9650, MSM89xx series, SD 210–835, SDX20, etc.). The connected sources corroborate the presence of a use-after-free in the...

CVE-2017-18275

CVE-2017-18275 is a local, command-injection style vulnerability affecting the simContacts service on Snapdragon-based devices (Automobile, Mobile, Wear) across numerous SD/SoC revisions. Exploitation would enable a new account insertion via the Android command line, with attack vector LOCAL, low...

CVE-2017-18277

CVE-2017-18277 describes a memory allocation failure in Qualcomm closed‑source components (Snapdragon Auto/Mobile/Wear) across multiple SD/SoC generations (e.g., SD 210/212/205, 625, 650, 810, 820, 835; MDM9xxx, QCN5502, etc.). The bug behavior is that when dynamic memory allocation fails, the pr...

CVE-2014-10045

Technical details about CVE-2014-10045 are not publicly provided in the supplied documents. Monitor for updates and additional disclosures in connected sources as they become available.

CVE-2015-9159

CVE-2015-9159 affects Android devices with Qualcomm Snapdragon/mobile/wear chipsets prior to the 2018-04 patch, where the input validation gap in OEMCrypto_GetRandom can cause a potential buffer overflow. The CVE entry describes the issue as present on a wide range of Snapdragon platforms (Automo...

CVE-2015-9175

CVE-2015-9175 involves an untrusted pointer dereference in wv_dash_core_generic_verify() caused by insufficient input validation on a wide range of Qualcomm/Android components (Android devices with Snapdragon Automotive/Mobile/Wear). Public details confirm the affected families (e.g., various Sna...

CVE-2015-9176

CVE-2015-9176 affects Android devices using Qualcomm Snapdragon chipsets (e.g., automobile, mobile, wearables) where Input_address is registered as a shared buffer and not properly checked before use in OEMCrypto_Generic_Sign(). This can allow access to addresses in secure/CP memory. The vulnerab...

CVE-2015-9193

CVE-2015-9193 affects Android devices with Qualcomm Snapdragon platforms (Automobile, Mobile, Wear) across multiple SDM/SDC/SDM series. The issue is improper input validation that can cause memory overread, leading to application crashes. Public details indicate impact up to Android patch level 2...

CVE-2015-9201

CVE-2015-9201 describes an integer overflow in tzbsp that can lead to privilege escalation on multiple Qualcomm Snapdragon/Android platforms (Automotive, Mobile, Wear, and related SoCs). The affected components and devices span Qualcomm’s tzbsp-related code paths used in Snapdragon lines (e.g., I...

CVE-2016-10475

CVE-2016-10475 affects Android prior to the 2018-04-05 patch on Qualcomm Snapdragon Mobile devices (SD 210/212/205, SD 400/430, SD 615/16/ SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820). The issue is lack of input validation that may cause an integer overflow leading to a buff...

CVE-2018-3593

CVE-2018-3593 describes a double-free condition in Android prior to the 2018-04-05 security patch level on Qualcomm Snapdragon platforms (Automotive, Mobile, Wear) including MDM9206/9607/9650, MSM8909W, SD 210/212/205, SD 400/425/430/450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808/810, S...

CVE-2018-5884

The CVE-2018-5884 entry concerns Snapdragon Multimedia on Qualcomm-based devices (Snapdragon Mobile and Snapdragon Wear). It describes an improper access-control vulnerability where non-standard applications, without permission, may acquire permission to Qualcomm-specific proprietary intents with...

CVE-2018-5892

CVE-2018-5892 concerns Touch Pal on Snapdragon Mobile and Snapdragon Wear where the app can collect user behavior data without user awareness. The NVD entry lists a NETWORK attack vector with low attack complexity and no user interaction required, and indicates partial confidentiality impact alon...

CVE-2015-9178

CVE-2015-9178 is a memory-corruption issue affecting Android devices with Qualcomm Snapdragon SoCs (incl. Snapdragon Automobile, Mobile, Wear families and related SD ranges up to SD 850) when processing the rmp secure command. The vulnerability allows memory corruption if the response buffer is s...

CVE-2015-9187

CVE-2015-9187 affects Android devices with Qualcomm Snapdragon SoCs (e.g., Snapdragon Automobile, Mobile, Wear lines) prior to the 2018-04-05 patch level. The issue is a lack of buffer length validation in the pvr_cmd_handler, which can lead to unauthorized access to secure memory. The NVD/Androi...

CVE-2015-9204

CVE-2015-9204 describes a buffer overread in Android on Qualcomm Snapdragon mobile/wear platforms (various SD series) when cchFriendlyName exceeds TZ_PR_MAX_NAME_LEN in playready_leavedomain_generate_challenge(). The issue is triggered in affected Android versions prior to the 2018-04-05 security...

CVE-2016-10416

CVE-2016-10416 affects Android devices prior to the 2018-04-05 security patch level (and earlier patches) on Qualcomm Snapdragon Mobile and Snapdragon Wear platforms. The issue causes a UE crash due to IPCMem exhaustion when UDP data is pumped to the UE’s ULP UDP port 7275. The vulnerability impa...

CVE-2016-10427

CVE-2016-10427 affects Qualcomm Snapdragon/RLC AM module in Android devices, causing denial of service via improper boundary check and triggering an assertion. Public details indicate impact on multiple Snapdragon generations (e.g., MDM92xx, MSM89xx, SD 210–SDX20) with exploitation requiring no u...

CVE-2016-10429

CVE-2016-10429 concerns Android devices (Qualcomm Small Cell SoC, Snapdragon variants, and listed SD/X platforms) where, prior to the 2018-04-05 security patch level, three image types are loaded in the same manner without distinguishing them. The connected documents confirm the vulnerability des...

CVE-2017-18074

CVE-2017-18074 affects Android on Qualcomm Snapdragon devices (mobile and Wear) before the 2018-04-05 security patch level. When playing a .wma file with a modified media header that has a non-standard bytes-per-second value, a reachable assert may occur in affected media components. According to...

CVE-2018-5891

CVE-2018-5891 affects Snapdragon Mobile and Snapdragon Wear. After IMS is registered and IMS data daemon restarts, the ipc_dataHandle is not kept in sync with the freed dataDHandle, causing a Use-After-Free in the DPL thread and memory corruption risk. The description specifies local access (loca...

CVE-2015-9119

Technical details about CVE-2015-9119 are not publicly provided in the connected documents. Affected products, exploitation, and fixes are not specified here. Monitor for updates from the sources in the Initial document (Android bulletin, NVD) for remediation.

CVE-2015-9139

CVE-2015-9139 describes an input-validation issue during SSL handshake negotiation on Android devices with Qualcomm Snapdragon chipsets (various models) prior to the April 5, 2018 patch level. The vulnerability path is not elaborated beyond “improper input validation” during SSL negotiation, and ...

CVE-2016-10415

CVE-2016-10415 is a DoS vulnerability described as: in Android on Qualcomm Snapdragon Mobile and Snapdragon Wear devices (list includes MDM9206/9607/9640/9650, MSM8909W, SD 210–212/205, 400/410/12, 425, 430, 450, 600, 615/16/415, 617, 625, 650/52, 800, 808, 810, 820, 835, SDX20) a dereference of ...

CVE-2016-10441

CVE-2016-10441: In Android on Qualcomm Snapdragon platforms (various SD/MDM and X series) before the 2018-04-05 patch level, improper offset validation in the video parser can cause a buffer overflow. CVSS indicates high to critical impact across confidentiality, integrity, and availability; expl...

CVE-2016-10443

CVE-2016-10443 affects Android devices with Qualcomm Snapdragon Automotive, Mobile, and Wear platforms (e.g., MDM9xxx, SD 210/212/205 to SD 850 families). The issue, described as possible packet replay, is tied to affected Qualcomm/Snapdragon components and is fixed by Android patch levels of 201...

CVE-2016-10455

The CVE-2016-10455 issue affects Android devices prior to the 2018-04-05 patch level and some Qualcomm Snapdragon platforms. The root cause is improper initialization of ike_sa_handle_ptr in IPSEC, which can trigger a denial of service. The affected devices include a wide range of Qualcomm-based ...

CVE-2017-18292

CVE-2017-18292 affects Qualcomm Snapdragon devices (MSM8909W, MSM8996AU, SD 210/212/205, 410/12, 425, 430, 450, 615/16/SD 415, 617, 625, 650/52, 800, 810, 820, 820A) across Snapdragon Automotive, Mobile and Wear. Description: a secure application running in a non-secure space can restart TrustZon...