Qualcomm closed-source components

CVE-2014-9953

(json)

CVE numbers: CVE-2014-9953 [Bulletin-CVE-2014-9953]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714770. [NIST-CVE-2014-9953]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2014-9953]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9953]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9960

(json)

CVE numbers: CVE-2014-9960 [Bulletin-CVE-2014-9960]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API. [NIST-CVE-2014-9960]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2014-9960]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9960]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9961

(json)

CVE numbers: CVE-2014-9961 [Bulletin-CVE-2014-9961]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, a vulnerability in eMMC write protection exists that can be used to bypass power-on write protection. [NIST-CVE-2014-9961]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2014-9961]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9961]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2014-9967

(json)

CVE numbers: CVE-2014-9967 [Bulletin-CVE-2014-9967]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2014-9967]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2014-9967]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9967]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9008

(json)

CVE numbers: CVE-2015-9008 [Bulletin-CVE-2015-9008]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689. [NIST-CVE-2015-9008]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9008]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9008]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9009

(json)

CVE numbers: CVE-2015-9009 [Bulletin-CVE-2015-9009]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393600. [NIST-CVE-2015-9009]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9009]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9009]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9010

(json)

CVE numbers: CVE-2015-9010 [Bulletin-CVE-2015-9010]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101. [NIST-CVE-2015-9010]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9010]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9010]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9011

(json)

CVE numbers: CVE-2015-9011 [Bulletin-CVE-2015-9011]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882. [NIST-CVE-2015-9011]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9011]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9011]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9012

(json)

CVE numbers: CVE-2015-9012 [Bulletin-CVE-2015-9012]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691. [NIST-CVE-2015-9012]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9012]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9012]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9013

(json)

CVE numbers: CVE-2015-9013 [Bulletin-CVE-2015-9013]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251. [NIST-CVE-2015-9013]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9013]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9013]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9014

(json)

CVE numbers: CVE-2015-9014 [Bulletin-CVE-2015-9014]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750. [NIST-CVE-2015-9014]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9014]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9014]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9015

(json)

CVE numbers: CVE-2015-9015 [Bulletin-CVE-2015-9015]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120. [NIST-CVE-2015-9015]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9015]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9015]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9024

(json)

CVE numbers: CVE-2015-9024 [Bulletin-CVE-2015-9024]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. [NIST-CVE-2015-9024]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9024]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9024]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9026

(json)

CVE numbers: CVE-2015-9026 [Bulletin-CVE-2015-9026]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2015-9026]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9026]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9026]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9027

(json)

CVE numbers: CVE-2015-9027 [Bulletin-CVE-2015-9027]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. [NIST-CVE-2015-9027]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9027]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9027]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2015-9029

(json)

CVE numbers: CVE-2015-9029 [Bulletin-CVE-2015-9029]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. [NIST-CVE-2015-9029]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2015-9029]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2015-9029]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10298

(json)

CVE numbers: CVE-2016-10298 [Bulletin-CVE-2016-10298]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393252. [NIST-CVE-2016-10298]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10298]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10298]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10299

(json)

CVE numbers: CVE-2016-10299 [Bulletin-CVE-2016-10299]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-32577244. [NIST-CVE-2016-10299]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10299]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10299]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10333

(json)

CVE numbers: CVE-2016-10333 [Bulletin-CVE-2016-10333]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, a sensitive system call was allowed to be called by HLOS. [NIST-CVE-2016-10333]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10333]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10333]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10334

(json)

CVE numbers: CVE-2016-10334 [Bulletin-CVE-2016-10334]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, a dynamically-protected DDR region could potentially get overwritten. [NIST-CVE-2016-10334]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10334]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10334]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10335

(json)

CVE numbers: CVE-2016-10335 [Bulletin-CVE-2016-10335]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, libtomcrypt was updated. [NIST-CVE-2016-10335]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10335]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10335]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10336

(json)

CVE numbers: CVE-2016-10336 [Bulletin-CVE-2016-10336]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, some regions of memory were not protected during boot. [NIST-CVE-2016-10336]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10336]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10336]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10338

(json)

CVE numbers: CVE-2016-10338 [Bulletin-CVE-2016-10338]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, there was an issue related to RPMB processing. [NIST-CVE-2016-10338]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10338]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10338]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10339

(json)

CVE numbers: CVE-2016-10339 [Bulletin-CVE-2016-10339]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, HLOS can overwite secure memory or read contents of the keystore. [NIST-CVE-2016-10339]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10339]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10339]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10340

(json)

CVE numbers: CVE-2016-10340 [Bulletin-CVE-2016-10340]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, an integer underflow leading to buffer overflow vulnerability exists in a syscall handler. [NIST-CVE-2016-10340]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10340]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10340]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2016-10341

(json)

CVE numbers: CVE-2016-10341 [Bulletin-CVE-2016-10341]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In all Android releases from CAF using the Linux kernel, 3rd party TEEs have more privilege than intended. [NIST-CVE-2016-10341]
Discovered by: on: Unknown
Reported on: 2017-06-01 [Bulletin-CVE-2016-10341]
Fixed on: Unknown
Fix released on: Unknown
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10341]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-6211

(json)

CVE numbers: CVE-2017-6211 [Bulletin-CVE-2017-6211]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, in the processing of a downlink supplementary services message, a buffer overflow can occur. [NIST-CVE-2017-6211]
Discovered by: on: Unknown
Reported on: 2017-12-01 [Bulletin-CVE-2017-6211]
Fixed on: Unknown
Fix released on: 2017-12-05 [Bulletin-CVE-2017-6211]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-6211]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-26

CVE-2017-14911

(json)

CVE numbers: CVE-2017-14911 [Bulletin-CVE-2017-14911]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 625, SD 650/52, SD 820, SD 835, it is possible for the XBL loader to skip the authentication of device config. [NIST-CVE-2017-14911]
Discovered by: on: Unknown
Reported on: 2018-01-01 [Bulletin-CVE-2017-14911]
Fixed on: Unknown
Fix released on: 2018-01-05 [Bulletin-CVE-2017-14911]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-14911]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-17773

(json)

CVE numbers: CVE-2017-17773 [Bulletin-CVE-2017-17773]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Snapdragon Automobile, Snapdragon Wearable and Snapdragon Mobile MDM9206,MDM9607,MDM9650,SD 210/SD 212/SD 205,SD 400,SD 410/12,SD 425,SD 430,SD 450,SD 600,SD 602A,SD 615/16/SD 415,SD 617,SD 625,SD 650/52,SD 800,SD 808,SD 810,SD 820,SD 820Am,SD 835,SD 845,MSM8909W, improper input validation in video_fmt_mp4r_process_atom_avc1() causes a potential buffer overflow. [NIST-CVE-2017-17773]
Discovered by: on: Unknown
Reported on: 2018-03-01 [Bulletin-CVE-2017-17773]
Fixed on: Unknown
Fix released on: 2018-03-05 [Bulletin-CVE-2017-17773]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-17773]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18071

(json)

CVE numbers: CVE-2017-18071 [Bulletin-CVE-2017-18071]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, debug policy can potentially be bypassed. [NIST-CVE-2017-18071]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-18071]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2017-18071]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18071]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18128

(json)

CVE numbers: CVE-2017-18128 [Bulletin-CVE-2017-18128]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MPU protecting error correction registers may potentially lead to exposure of related secured data. [NIST-CVE-2017-18128]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-18128]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2017-18128]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18128]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18146

(json)

CVE numbers: CVE-2017-18146 [Bulletin-CVE-2017-18146]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, in some corner cases, ECDSA signature verification can fail. [NIST-CVE-2017-18146]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-18146]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2017-18146]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18146]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-8274

(json)

CVE numbers: CVE-2017-8274 [Bulletin-CVE-2017-8274]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, an access control vulnerability exists in Core. [NIST-CVE-2017-8274]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2017-8274]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2017-8274]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-8274]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3591

(json)

CVE numbers: CVE-2018-3591 [Bulletin-CVE-2018-3591]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build configuration of deviceprogrammer in BOOT.BF.3.0 enables the flag SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM which will open up the peek and poke commands to any memory location on the target. [NIST-CVE-2018-3591]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2018-3591]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2018-3591]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3591]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3592

(json)

CVE numbers: CVE-2018-3592 [Bulletin-CVE-2018-3592]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, added a change to check if the pointer has been reset to NULL or not, before writing to the memory pointed by the pointer. [NIST-CVE-2018-3592]
Discovered by: on: Unknown
Reported on: 2018-04-01 [Bulletin-CVE-2018-3592]
Fixed on: Unknown
Fix released on: 2018-04-05 [Bulletin-CVE-2018-3592]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3592]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2016-2108

(json)

CVE numbers: CVE-2016-2108 [Bulletin-CVE-2016-2108]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. [NIST-CVE-2016-2108]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2016-2108]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2016-2108]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-2108]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18171

(json)

CVE numbers: CVE-2017-18171 [Bulletin-CVE-2017-18171]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, SDM630, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016. [NIST-CVE-2017-18171]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2017-18171]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2017-18171]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18171]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11257

(json)

CVE numbers: CVE-2018-11257 [Bulletin-CVE-2018-11257]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850. [NIST-CVE-2018-11257]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-11257]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2018-11257]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11257]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11259

(json)

CVE numbers: CVE-2018-11259 [Bulletin-CVE-2018-11259]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and configures the EFS partition addresses in its MPU partition. [NIST-CVE-2018-11259]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-11259]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2018-11259]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11259]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5874

(json)

CVE numbers: CVE-2018-5874 [Bulletin-CVE-2018-5874]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: While parsing an mp4 file, a stack-based buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5874]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-5874]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2018-5874]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5874]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5875

(json)

CVE numbers: CVE-2018-5875 [Bulletin-CVE-2018-5875]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: While parsing an mp4 file, an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5875]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-5875]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2018-5875]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5875]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5876

(json)

CVE numbers: CVE-2018-5876 [Bulletin-CVE-2018-5876]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5876]
Discovered by: on: Unknown
Reported on: 2018-07-01 [Bulletin-CVE-2018-5876]
Fixed on: Unknown
Fix released on: 2018-07-05 [Bulletin-CVE-2018-5876]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5876]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18296

(json)

CVE numbers: CVE-2017-18296 [Bulletin-CVE-2017-18296]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20. [NIST-CVE-2017-18296]
Discovered by: on: Unknown
Reported on: 2018-08-01 [Bulletin-CVE-2017-18296]
Fixed on: Unknown
Fix released on: 2018-08-05 [Bulletin-CVE-2017-18296]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18296]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18305

(json)

CVE numbers: CVE-2017-18305 [Bulletin-CVE-2017-18305]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835. [NIST-CVE-2017-18305]
Discovered by: on: Unknown
Reported on: 2018-08-01 [Bulletin-CVE-2017-18305]
Fixed on: Unknown
Fix released on: 2018-08-05 [Bulletin-CVE-2017-18305]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18305]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18310

(json)

CVE numbers: CVE-2017-18310 [Bulletin-CVE-2017-18310]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: ClientEnv exposes services 0-32 to HLOS in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016 [NIST-CVE-2017-18310]
Discovered by: on: Unknown
Reported on: 2018-08-01 [Bulletin-CVE-2017-18310]
Fixed on: Unknown
Fix released on: 2018-08-05 [Bulletin-CVE-2017-18310]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18310]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2016-10394

(json)

CVE numbers: CVE-2016-10394 [Bulletin-CVE-2016-10394]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2016-10394]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2016-10394]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10394]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18311

(json)

CVE numbers: CVE-2017-18311 [Bulletin-CVE-2017-18311]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration ports are open in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016. [NIST-CVE-2017-18311]
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2017-18311]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2017-18311]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18311]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18314

(json)

CVE numbers: CVE-2017-18314 [Bulletin-CVE-2017-18314]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, on TZ cold boot the CNOC_QDSS RG0 locked by xBL_SEC is cleared by TZ. [NIST-CVE-2017-18314]
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2017-18314]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2017-18314]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18314]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11824

(json)

CVE numbers: CVE-2018-11824 [Bulletin-CVE-2018-11824]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: A stack-based buffer overflow can occur in a firmware routine in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, SDA660 [NIST-CVE-2018-11824]
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2018-11824]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2018-11824]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11824]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11950

(json)

CVE numbers: CVE-2018-11950 [Bulletin-CVE-2018-11950]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850 [NIST-CVE-2018-11950]
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2018-11950]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2018-11950]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11950]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5866

(json)

CVE numbers: CVE-2018-5866 [Bulletin-CVE-2018-5866]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: While processing logs, data is copied into a buffer pointed to by an untrusted pointer in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660. [NIST-CVE-2018-5866]
Discovered by: on: Unknown
Reported on: 2018-09-01 [Bulletin-CVE-2018-5866]
Fixed on: Unknown
Fix released on: 2018-09-05 [Bulletin-CVE-2018-5866]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5866]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18317

(json)

CVE numbers: CVE-2017-18317 [Bulletin-CVE-2017-18317]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU,SD 410/12,SD 820,SD 820A. [NIST-CVE-2017-18317]
Discovered by: on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2017-18317]
Fixed on: Unknown
Fix released on: 2018-11-05 [Bulletin-CVE-2017-18317]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18317]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11264

(json)

CVE numbers: CVE-2018-11264 [Bulletin-CVE-2018-11264]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660. [NIST-CVE-2018-11264]
Discovered by: on: Unknown
Reported on: 2018-11-01 [Bulletin-CVE-2018-11264]
Fixed on: Unknown
Fix released on: 2018-11-05 [Bulletin-CVE-2018-11264]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11264]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-11004

(json)

CVE numbers: CVE-2017-11004 [Bulletin-CVE-2017-11004]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. [NIST-CVE-2017-11004]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2017-11004]
Fixed on: Unknown
Fix released on: 2018-12-05 [Bulletin-CVE-2017-11004]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11004]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18141

(json)

CVE numbers: CVE-2017-18141 [Bulletin-CVE-2017-18141]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. [NIST-CVE-2017-18141]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2017-18141]
Fixed on: Unknown
Fix released on: 2018-12-05 [Bulletin-CVE-2017-18141]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18141]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-8248

(json)

CVE numbers: CVE-2017-8248 [Bulletin-CVE-2017-8248]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation. [NIST-CVE-2017-8248]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2017-8248]
Fixed on: Unknown
Fix released on: 2018-12-05 [Bulletin-CVE-2017-8248]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-8248]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11279

(json)

CVE numbers: CVE-2018-11279 [Bulletin-CVE-2018-11279]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-11279]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-11279]
Fixed on: Unknown
Fix released on: 2018-12-05 [Bulletin-CVE-2018-11279]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11279]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5913

(json)

CVE numbers: CVE-2018-5913 [Bulletin-CVE-2018-5913]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: A non-time constant function memcmp is used which creates a side channel that could leak information in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-5913]
Discovered by: on: Unknown
Reported on: 2018-12-01 [Bulletin-CVE-2018-5913]
Fixed on: Unknown
Fix released on: 2018-12-05 [Bulletin-CVE-2018-5913]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5913]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-08-01

CVE-2018-11847

(json)

CVE numbers: CVE-2018-11847 [Bulletin-CVE-2018-11847]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Malicious TA can tag QSEE kernel memory and map to EL0, there by corrupting the physical memory as well it can be used to corrupt the QSEE kernel and compromise the whole TEE in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables and Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 650/52, SD 820, SD 820A, SD 835, SD 8CX, SDM439 and Snapdragon_High_Med_2016 [NIST-CVE-2018-11847]
Discovered by: on: Unknown
Reported on: 2019-01-01 [Bulletin-CVE-2018-11847]
Fixed on: Unknown
Fix released on: 2019-01-05 [Bulletin-CVE-2018-11847]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11847]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11289

(json)

CVE numbers: CVE-2018-11289 [Bulletin-CVE-2018-11289]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130. [NIST-CVE-2018-11289]
Discovered by: derrek (@derrekr6) [Discovery-CVE-2018-11289] on: Unknown
Reported on: 2019-02-01 [Bulletin-CVE-2018-11289]
Fixed on: Unknown
Fix released on: 2019-02-05 [Bulletin-CVE-2018-11289]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11289]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11820

(json)

CVE numbers: CVE-2018-11820 [Bulletin-CVE-2018-11820]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Use of non-time constant memcmp function creates side channel that leaks information and leads to cryptographic issues in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MDM9655, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 800, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130. [NIST-CVE-2018-11820]
Discovered by: derrek (@derrekr6) [Discovery-CVE-2018-11820] on: Unknown
Reported on: 2019-02-01 [Bulletin-CVE-2018-11820]
Fixed on: Unknown
Fix released on: 2019-02-05 [Bulletin-CVE-2018-11820]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11820]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11938

(json)

CVE numbers: CVE-2018-11938 [Bulletin-CVE-2018-11938]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Improper input validation for argument received from HLOS can lead to buffer overflows and unexpected behavior in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in versions IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCA8081, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130. [NIST-CVE-2018-11938]
Discovered by: derrek (@derrekr6) [Discovery-CVE-2018-11938] on: Unknown
Reported on: 2019-02-01 [Bulletin-CVE-2018-11938]
Fixed on: Unknown
Fix released on: 2019-02-05 [Bulletin-CVE-2018-11938]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11938]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11945

(json)

CVE numbers: CVE-2018-11945 [Bulletin-CVE-2018-11945]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Improper input validation in wireless service messaging module for data received from broadcast messages can lead to heap overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in versions MDM9150, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130. [NIST-CVE-2018-11945]
Discovered by: on: Unknown
Reported on: 2019-02-01 [Bulletin-CVE-2018-11945]
Fixed on: Unknown
Fix released on: 2019-02-05 [Bulletin-CVE-2018-11945]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11945]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-8252

(json)

CVE numbers: CVE-2017-8252 [Bulletin-CVE-2017-8252]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Kernel can inject faults in computations during the execution of TrustZone leading to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8074, MDM9150, MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX20, SDX24, SM7150, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2017-8252]
Discovered by: Adrian Tang of Columbia University (CLKSCREW paper) [Discovery-CVE-2017-8252] on: Unknown
Reported on: 2019-03-01 [Bulletin-CVE-2017-8252]
Fixed on: Unknown
Fix released on: 2019-03-05 [Bulletin-CVE-2017-8252]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2017-8252]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11958

(json)

CVE numbers: CVE-2018-11958 [Bulletin-CVE-2018-11958]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Insufficient protection of keys in keypad can lead HLOS to gain access to confidential keypad input data in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9206, MDM9607, MDM9650, MDM9655, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016 [NIST-CVE-2018-11958]
Discovered by: on: Unknown
Reported on: 2019-03-01 [Bulletin-CVE-2018-11958]
Fixed on: Unknown
Fix released on: 2019-03-05 [Bulletin-CVE-2018-11958]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11958]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11271

(json)

CVE numbers: CVE-2018-11271 [Bulletin-CVE-2018-11271]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Improper authentication can happen on Remote command handling due to inappropriate handling of events in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM439, SDM630, SDM660, SM7150, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-11271]
Discovered by: on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2018-11271]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2018-11271]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11271]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-11976

(json)

CVE numbers: CVE-2018-11976 [Bulletin-CVE-2018-11976]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: ECDSA signature code leaks private keys from secure world to non-secure world in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in IPQ8074, MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCA8081, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-11976]
Discovered by: NCC Group [Discovery-CVE-2018-11976] on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2018-11976]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2018-11976]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11976]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-12004

(json)

CVE numbers: CVE-2018-12004 [Bulletin-CVE-2018-12004]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Secure keypad is unlocked with secure display still intact in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 636, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130 [NIST-CVE-2018-12004]
Discovered by: on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2018-12004]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2018-12004]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-12004]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-13886

(json)

CVE numbers: CVE-2018-13886 [Bulletin-CVE-2018-13886]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Unchecked OTA field in GNSS XTRA3 lead to integer overflow and then buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9615, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-13886]
Discovered by: on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2018-13886]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2018-13886]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-13886]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-13887

(json)

CVE numbers: CVE-2018-13887 [Bulletin-CVE-2018-13887]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Untrusted header fields in GNSS XTRA3 function can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8909W, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 600, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, SM7150, SXR1130 [NIST-CVE-2018-13887]
Discovered by: on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2018-13887]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2018-13887]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-13887]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2250

(json)

CVE numbers: CVE-2019-2250 [Bulletin-CVE-2019-2250]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Kernel can write to arbitrary memory address passed by user while freeing/stopping a thread in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCS605, SD 675, SD 712 / SD 710 / SD 670, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SM7150, SXR1130 [NIST-CVE-2019-2250]
Discovered by: on: Unknown
Reported on: 2019-04-01 [Bulletin-CVE-2019-2250]
Fixed on: Unknown
Fix released on: 2019-04-05 [Bulletin-CVE-2019-2250]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2250]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-13898

(json)

CVE numbers: CVE-2018-13898 [Bulletin-CVE-2018-13898]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Out-of-Bounds write due to incorrect array index check in PMIC in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9650, MDM9655, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-13898]
Discovered by: derrek (@derrekr6) [Discovery-CVE-2018-13898] on: Unknown
Reported on: 2019-05-01 [Bulletin-CVE-2018-13898]
Fixed on: Unknown
Fix released on: 2019-05-05 [Bulletin-CVE-2018-13898]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-13898]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-5912

(json)

CVE numbers: CVE-2018-5912 [Bulletin-CVE-2018-5912]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: Potential buffer overflow in Video due to lack of input validation in input and output values in Snapdragon Automobile, Snapdragon Mobile in MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660 [NIST-CVE-2018-5912]
Discovered by: Xiling Gong of Tencent Blade Team [Discovery-CVE-2018-5912] on: Unknown
Reported on: 2019-05-01 [Bulletin-CVE-2018-5912]
Fixed on: Unknown
Fix released on: 2019-05-05 [Bulletin-CVE-2018-5912]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5912]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2255

(json)

CVE numbers: CVE-2019-2255 [Bulletin-CVE-2019-2255]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2019-2255]
Discovered by: on: Unknown
Reported on: 2019-05-01 [Bulletin-CVE-2019-2255]
Fixed on: Unknown
Fix released on: 2019-05-05 [Bulletin-CVE-2019-2255]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2255]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2256

(json)

CVE numbers: CVE-2019-2256 [Bulletin-CVE-2019-2256]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details: An unprivileged user can craft a bitstream such that the payload encoded in the bitstream gains code execution in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9650, MSM8909W, MSM8996AU, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 675, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2019-2256]
Discovered by: Xiling Gong of Tencent Blade Team [Discovery-CVE-2019-2256] on: Unknown
Reported on: 2019-05-01 [Bulletin-CVE-2019-2256]
Fixed on: Unknown
Fix released on: 2019-05-05 [Bulletin-CVE-2019-2256]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2256]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-13924

(json)

CVE numbers: CVE-2018-13924 [Bulletin-CVE-2018-13924]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2019-06-01 [Bulletin-CVE-2018-13924]
Fixed on: Unknown
Fix released on: 2019-06-05 [Bulletin-CVE-2018-13924]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-13924]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-13927

(json)

CVE numbers: CVE-2018-13927 [Bulletin-CVE-2018-13927]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2019-06-01 [Bulletin-CVE-2018-13927]
Fixed on: Unknown
Fix released on: 2019-06-05 [Bulletin-CVE-2018-13927]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2018-13927]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2254

(json)

CVE numbers: CVE-2019-2254 [Bulletin-CVE-2019-2254]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2254]
Fixed on: Unknown
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2254]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2254]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2322

(json)

CVE numbers: CVE-2019-2322 [Bulletin-CVE-2019-2322]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2322]
Fixed on: Unknown
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2322]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2322]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2327

(json)

CVE numbers: CVE-2019-2327 [Bulletin-CVE-2019-2327]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: on: Unknown
Reported on: 2019-07-01 [Bulletin-CVE-2019-2327]
Fixed on: Unknown
Fix released on: 2019-07-05 [Bulletin-CVE-2019-2327]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2327]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-10539

(json)

CVE numbers: CVE-2019-10539 [Bulletin-CVE-2019-10539]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: Xiling Gong of Tencent Blade Team [Discovery-CVE-2019-10539] on: Unknown
Reported on: 2019-08-01 [Bulletin-CVE-2019-10539]
Fixed on: Unknown
Fix released on: 2019-08-05 [Bulletin-CVE-2019-10539]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-10539]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-08-12

CVE-2019-10540

(json)

CVE numbers: CVE-2019-10540 [Bulletin-CVE-2019-10540]
Coordinated disclosure?: unknown
Categories: Qualcomm closed-source components
Details:
Discovered by: Xiling Gong of Tencent Blade Team [Discovery-CVE-2019-10540] on: Unknown
Reported on: 2019-08-01 [Bulletin-CVE-2019-10540]
Fixed on: Unknown
Fix released on: 2019-08-05 [Bulletin-CVE-2019-10540]
Affected versions: regex:
Affected devices:
Affected manufacturers: Qualcomm [Bulletin-CVE-2019-10540]
Fixed versions:
Submission: by: Daniel Carter, on: 2019-08-12