Back to all years

2018

CVE-2017-13230

(json)

• CVE numbers: CVE-2017-13230 [Bulletin-CVE-2017-13230]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In hevc codec, there is an out-of-bounds write due to an incorrect bounds check with the i2_pic_width_in_luma_samples value. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-65483665. [NIST-CVE-2017-13230]
• Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2017-13230] on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-13230]
• Fixed on: 2017-07-06 [A-65483665]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-13230]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(5.1.1)|(6.0.[0-9])|(6.0.1)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13230]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 5.1.1, 6.0, 6.0.1 [Bulletin-CVE-2017-13230]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18067

(json)

• CVE numbers: CVE-2017-18067 [Bulletin-CVE-2017-18067]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, improper input validation while processing an encrypted authentication management frame in lim_send_auth_mgmt_frame() leads to buffer overflow. [NIST-CVE-2017-18067]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-18067]
• Fixed on: 2017-07-27 [2]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-18067]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18067]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-15860

(json)

• CVE numbers: CVE-2017-15860 [Bulletin-CVE-2017-15860]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In all Qualcomm products with Android releases from CAF using the Linux kernel, while processing an encrypted authentication management frame, a stack buffer overflow may potentially occur. [NIST-CVE-2017-15860]
• Discovered by: on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-15860]
• Fixed on: 2017-07-31 [QC-CR#2082544]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-15860]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15860]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13249

(json)

• CVE numbers: CVE-2017-13249 [Bulletin-CVE-2017-13249]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2d_api_set_display_frame of impeg2d_api_main.c, there is an out of bound write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70399408. [NIST-CVE-2017-13249]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13249] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13249]
• Fixed on: 2017-08-09 [A-70399408]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13249]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13249]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13249]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9473

(json)

• CVE numbers: CVE-2018-9473 [Bulletin-CVE-2018-9473]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ihevcd_parse_sei_payload of ihevcd_parse_headers.c, there is a possible out-of-bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android ID: A-65484460 [NIST-CVE-2018-9473]
• Discovered by: Niky1235 (@jiych_guru) [Discovery-CVE-2018-9473] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9473]
• Fixed on: 2017-08-29 [A-65484460]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9473]
• Affected versions: 8.0 [Bulletin-CVE-2018-9473] regex: (8.0.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9473]
• Fixed versions: 8.0 [Bulletin-CVE-2018-9473]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-15815

(json)

• CVE numbers: CVE-2017-15815 [Bulletin-CVE-2017-15815]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, a potential buffer overflow can happen when processing any 802.11 MGMT frames like Auth frame in limProcessAuthFrame. [NIST-CVE-2017-15815]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-15815]
• Fixed on: 2017-08-31 [QC-CR#2093392]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-15815]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15815]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13178

(json)

• CVE numbers: CVE-2017-13178 [Bulletin-CVE-2017-13178]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In the initDecoder function of SoftAVCDec, there is a possible out-of-bounds write to mCodecCtx due to a use after free when buffer allocation fails. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969281. [NIST-CVE-2017-13178]
• Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13178] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13178]
• Fixed on: 2017-10-04 [A-66969281]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13178]
• Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13178]
• Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13178]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13179

(json)

• CVE numbers: CVE-2017-13179 [Bulletin-CVE-2017-13179]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In the ihevcd_allocate_static_bufs and ihevcd_create functions of SoftHEVC, there is a possible out-of-bounds write due to a use after free. Both ps_codec_obj and ps_create_op->s_ivd_create_op_t.pv_handle point to the same memory and ps_codec_obj could be freed without clearing ps_create_op->s_ivd_create_op_t.pv_handle. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-66969193. [NIST-CVE-2017-13179]
• Discovered by: Chi Zhang and Mingjian Zhou (@Mingjian_Zhou) of C0RE Team [Discovery-CVE-2017-13179] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13179]
• Fixed on: 2017-10-04 [A-66969193]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13179]
• Affected versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179] regex: (6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13179]
• Fixed versions: 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13179]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13177

(json)

• CVE numbers: CVE-2017-13177 [Bulletin-CVE-2017-13177]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In several functions of libhevc, NEON registers are not preserved. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68320413. [NIST-CVE-2017-13177]
• Discovered by: on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13177]
• Fixed on: 2017-10-09 [A-68320413]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13177]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13177]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13177]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-15822

(json)

• CVE numbers: CVE-2017-15822 [Bulletin-CVE-2017-15822]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Qualcomm Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel before security patch level 2018-04-05, while processing a 802.11 management frame, a buffer overflow may potentially occur. [NIST-CVE-2017-15822]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-15822]
• Fixed on: 2017-10-12 [QC-CR#2123807]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-15822]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-15822]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13208

(json)

• CVE numbers: CVE-2017-13208 [Bulletin-CVE-2017-13208]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In receive_packet of libnetutils/packet.c, there is a possible out-of-bounds write due to a missing bounds check on the DHCP response. This could lead to remote code execution as a privileged process with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67474440. [NIST-CVE-2017-13208]
• Discovered by: tintinweb [Discovery-CVE-2017-13208] on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-13208]
• Fixed on: 2017-10-13 [A-67474440]
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-13208]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13208] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13208]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13208]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3565

(json)

• CVE numbers: CVE-2018-3565 [Bulletin-CVE-2018-3565]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: While sending a probe request indication in lim_send_sme_probe_req_ind() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel, a buffer overflow can occur. [NIST-CVE-2018-3565]
• Discovered by: on: Unknown
• Reported on: 2018-05-01 [Bulletin-CVE-2018-3565]
• Fixed on: 2017-11-07 [QC-CR#2138555]
• Fix released on: 2018-05-05 [Bulletin-CVE-2018-3565]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3565]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13228

(json)

• CVE numbers: CVE-2017-13228 [Bulletin-CVE-2017-13228]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In function ih264d_ref_idx_reordering of libavc, there is an out-of-bounds write due to modCount being defined as an unsigned character. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478425. [NIST-CVE-2017-13228]
• Discovered by: on: Unknown
• Reported on: 2018-02-01 [Bulletin-CVE-2017-13228]
• Fixed on: 2017-11-28 [A-69478425]
• Fix released on: 2018-02-05 [Bulletin-CVE-2017-13228]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13228]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13228]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3580

(json)

• CVE numbers: CVE-2018-3580 [Bulletin-CVE-2018-3580]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: Stack-based buffer overflow can occur In the WLAN driver if the pmkid_count value is larger than the PMKIDCache size in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel. [NIST-CVE-2018-3580]
• Discovered by: on: Unknown
• Reported on: 2018-05-01 [Bulletin-CVE-2018-3580]
• Fixed on: 2017-11-29 [QC-CR#2149187]
• Fix released on: 2018-05-05 [Bulletin-CVE-2018-3580]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3580]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13248

(json)

• CVE numbers: CVE-2017-13248 [Bulletin-CVE-2017-13248]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2_idct_recon_sse42() of impeg2_idct_recon_sse42_intr.c, there is an out of bound write due to a missing bounds check. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70349612. [NIST-CVE-2017-13248]
• Discovered by: Vasily Vasiliev [Discovery-CVE-2017-13248] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13248]
• Fixed on: 2017-12-18 [A-70349612]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13248]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13248]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13248]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3569

(json)

• CVE numbers: CVE-2018-3569 [Bulletin-CVE-2018-3569]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: A buffer over-read can occur during a fast initial link setup (FILS) connection in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-05. [NIST-CVE-2018-3569]
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-3569]
• Fixed on: 2017-12-20 [QC-CR#2161920]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-3569]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3569]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13250

(json)

• CVE numbers: CVE-2017-13250 [Bulletin-CVE-2017-13250]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ih264d_fmt_conv_420sp_to_420p of ih264d_utils.c, there is an out of bound write due to a missing out of bounds check because of a multiplication error. This could lead to an remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71375536. [NIST-CVE-2017-13250]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13250]
• Fixed on: 2017-12-27 [A-71375536]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13250]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13250]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13250]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13251

(json)

• CVE numbers: CVE-2017-13251 [Bulletin-CVE-2017-13251]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2d_dec_pic_data_thread of impeg2d_dec_hdr.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when running multi threaded with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69269702. [NIST-CVE-2017-13251]
• Discovered by: Zinuo Han from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13251] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13251]
• Fixed on: 2017-12-28 [A-69269702]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13251]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13251]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13251]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-14911

(json)

• CVE numbers: CVE-2017-14911 [Bulletin-CVE-2017-14911]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before 2018-01-05 on Qualcomm Snapdragon IoT, Snapdragon Mobile, Snapdragon Automobile APQ8096AU, MDM9206, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 625, SD 650/52, SD 820, SD 835, it is possible for the XBL loader to skip the authentication of device config. [NIST-CVE-2017-14911]
• Discovered by: on: Unknown
• Reported on: 2018-01-01 [Bulletin-CVE-2017-14911]
• Fixed on: Unknown
• Fix released on: 2018-01-05 [Bulletin-CVE-2017-14911]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-14911]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9498

(json)

• CVE numbers: CVE-2018-9498 [Bulletin-CVE-2018-9498]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In SkSampler::Fill of SkSampler.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-78354855 [NIST-CVE-2018-9498]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9498] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9498]
• Fixed on: 2018-01-05 [A-78354855]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9498]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9498] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9498]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9498]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13255

(json)

• CVE numbers: CVE-2017-13255 [Bulletin-CVE-2017-13255]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In process_service_attr_req of sdp_server.c, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68776054. [NIST-CVE-2017-13255]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13255] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13255]
• Fixed on: 2018-01-09 [A-68776054]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13255]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13255] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13255]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13255]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13256

(json)

• CVE numbers: CVE-2017-13256 [Bulletin-CVE-2017-13256]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-68817966. [NIST-CVE-2017-13256]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13256] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13256]
• Fixed on: 2018-01-09 [A-68817966]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13256]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13256] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13256]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13256]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13266

(json)

• CVE numbers: CVE-2017-13266 [Bulletin-CVE-2017-13266]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69478941. [NIST-CVE-2017-13266]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2017-13266] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13266]
• Fixed on: 2018-01-10 [A-69478941]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13266]
• Affected versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13266] regex: (5.1.1)|(6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13266]
• Fixed versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13266]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13267

(json)

• CVE numbers: CVE-2017-13267 [Bulletin-CVE-2017-13267]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_pars_vendor_cmd of avrc_pars_tg.cc, there is a possible stack corruption due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-69479009. [NIST-CVE-2017-13267]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13267] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13267]
• Fixed on: 2018-01-10 [A-69479009]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13267]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13267] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13267]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13267]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13272

(json)

• CVE numbers: CVE-2017-13272 [Bulletin-CVE-2017-13272]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In alarm_ready_generic of alarm.cc, there is a possible out of bounds write due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-67110137. [NIST-CVE-2017-13272]
• Discovered by: Wish Wu (@wish_wu 吴潍浠 此彼) of Ant-financial Light-Year Security Lab [Discovery-CVE-2017-13272] on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-13272]
• Fixed on: 2018-01-11 [2]
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-13272]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13272] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13272]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13272]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13276

(json)

• CVE numbers: CVE-2017-13276 [Bulletin-CVE-2017-13276]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In CProgramConfig_ReadHeightExt of tpdec_asc.cpp, there is a possible stack buffer overflow due to a missing bounds check. This could lead to a remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70637599. [NIST-CVE-2017-13276]
• Discovered by: Elphet and Gong Guang of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13276] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13276]
• Fixed on: 2018-01-12 [A-70637599]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13276]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13276] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13276]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13276]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13277

(json)

• CVE numbers: CVE-2017-13277 [Bulletin-CVE-2017-13277]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ihevcd_fmt_conv of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-72165027. [NIST-CVE-2017-13277]
• Discovered by: Weichao Sun of Alibaba Inc (@sunblate) [Discovery-CVE-2017-13277] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13277]
• Fixed on: 2018-01-23 [A-72165027]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13277]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13277] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13277]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13277]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13282

(json)

• CVE numbers: CVE-2017-13282 [Bulletin-CVE-2017-13282]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible stack buffer overflow due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71603315. [NIST-CVE-2017-13282]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13282] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13282]
• Fixed on: 2018-02-02 [A-71603315]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13282]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13282] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13282]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13282]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13283

(json)

• CVE numbers: CVE-2017-13283 [Bulletin-CVE-2017-13283]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_ctrl_pars_vendor_rsp of bluetooth avrcp_ctrl, there is a possible out of bounds write on the stack due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71603410. [NIST-CVE-2017-13283]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13283] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13283]
• Fixed on: 2018-02-02 [A-71603410]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13283]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13283] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13283]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13283]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5854

(json)

• CVE numbers: CVE-2018-5854 [Bulletin-CVE-2018-5854]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel. [NIST-CVE-2018-5854]
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-5854]
• Fixed on: 2018-02-02 [QC-CR#2183877]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-5854]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5854]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5872

(json)

• CVE numbers: CVE-2018-5872 [Bulletin-CVE-2018-5872]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: While parsing over-the-air information elements in all Android releases from CAF using the Linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-07-05, the use of an out-of-range pointer offset can occur. [NIST-CVE-2018-5872]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-5872]
• Fixed on: 2018-02-07 [QC-CR#2183014]
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-5872]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5872]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13281

(json)

• CVE numbers: CVE-2017-13281 [Bulletin-CVE-2017-13281]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible stack buffer overflow due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 8.0, 8.1. Android ID: A-71603262. [NIST-CVE-2017-13281]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2017-13281] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13281]
• Fixed on: 2018-02-09 [A-71603262]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13281]
• Affected versions: 8.0, 8.1 [Bulletin-CVE-2017-13281] regex: (8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13281]
• Fixed versions: 8.0, 8.1 [Bulletin-CVE-2017-13281]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13284

(json)

• CVE numbers: CVE-2017-13284 [Bulletin-CVE-2017-13284]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In config_set_string of config.cc, it is possible to pair a second BT keyboard without user approval due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-70808273. [NIST-CVE-2017-13284]
• Discovered by: Jean-Baptiste Cayrou (@jbcayrou) [Discovery-CVE-2017-13284] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13284]
• Fixed on: 2018-02-09 [A-70808273]
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13284]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13284] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2017-13284]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2017-13284]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-17773

(json)

• CVE numbers: CVE-2017-17773 [Bulletin-CVE-2017-17773]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Snapdragon Automobile, Snapdragon Wearable and Snapdragon Mobile MDM9206,MDM9607,MDM9650,SD 210/SD 212/SD 205,SD 400,SD 410/12,SD 425,SD 430,SD 450,SD 600,SD 602A,SD 615/16/SD 415,SD 617,SD 625,SD 650/52,SD 800,SD 808,SD 810,SD 820,SD 820Am,SD 835,SD 845,MSM8909W, improper input validation in video_fmt_mp4r_process_atom_avc1() causes a potential buffer overflow. [NIST-CVE-2017-17773]
• Discovered by: on: Unknown
• Reported on: 2018-03-01 [Bulletin-CVE-2017-17773]
• Fixed on: Unknown
• Fix released on: 2018-03-05 [Bulletin-CVE-2017-17773]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-17773]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9341

(json)

• CVE numbers: CVE-2018-9341 [Bulletin-CVE-2018-9341]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details:
• Discovered by: Stephan Zeisberg of Security Research Labs [Discovery-CVE-2018-9341] on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9341]
• Fixed on: 2018-03-15 [A-74016277]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9341]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9341] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9341]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9341]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9356

(json)

• CVE numbers: CVE-2018-9356 [Bulletin-CVE-2018-9356]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In bnep_data_ind of bnep_main.c, there is a possible remote code execution due to a double free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74950468. [NIST-CVE-2018-9356]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2018-9356] on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9356]
• Fixed on: 2018-03-21 [A-74950468]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9356]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9356] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9356]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9356]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9365

(json)

• CVE numbers: CVE-2018-9365 [Bulletin-CVE-2018-9365]
• Coordinated disclosure?: unknown
• Categories: System
• Details:
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9365] on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-9365]
• Fixed on: 2018-03-30 [A-74121126]
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-9365]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9365] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9365]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9365]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2014-9996

(json)

• CVE numbers: CVE-2014-9996 [Bulletin-CVE-2014-9996]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components 2014-2016 cumulative update
• Details: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, while verifying provisioning, a buffer overflow can occur. [NIST-CVE-2014-9996]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2014-9996]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2014-9996]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2014-9996]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-13292

(json)

• CVE numbers: CVE-2017-13292 [Bulletin-CVE-2017-13292]
• Coordinated disclosure?: unknown
• Categories: Broadcom components
• Details: In wl_get_assoc_ies of wl_cfg80211.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android kernel. Android ID: A-70722061. References: B-V2018010201. [NIST-CVE-2017-13292]
• Discovered by: Daxing Guo of Tencent's Xuanwu Lab [Discovery-CVE-2017-13292] on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-13292]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-13292]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Broadcom [Bulletin-CVE-2017-13292]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18071

(json)

• CVE numbers: CVE-2017-18071 [Bulletin-CVE-2017-18071]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, debug policy can potentially be bypassed. [NIST-CVE-2017-18071]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-18071]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-18071]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18071]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18128

(json)

• CVE numbers: CVE-2017-18128 [Bulletin-CVE-2017-18128]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile SD 845, SD 850, improper access control while configuring MPU protecting error correction registers may potentially lead to exposure of related secured data. [NIST-CVE-2017-18128]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-18128]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-18128]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18128]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18146

(json)

• CVE numbers: CVE-2017-18146 [Bulletin-CVE-2017-18146]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, in some corner cases, ECDSA signature verification can fail. [NIST-CVE-2017-18146]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-18146]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-18146]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18146]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-8274

(json)

• CVE numbers: CVE-2017-8274 [Bulletin-CVE-2017-8274]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, an access control vulnerability exists in Core. [NIST-CVE-2017-8274]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2017-8274]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2017-8274]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-8274]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3591

(json)

• CVE numbers: CVE-2018-3591 [Bulletin-CVE-2018-3591]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build configuration of deviceprogrammer in BOOT.BF.3.0 enables the flag SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM which will open up the peek and poke commands to any memory location on the target. [NIST-CVE-2018-3591]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2018-3591]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2018-3591]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3591]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-3592

(json)

• CVE numbers: CVE-2018-3592 [Bulletin-CVE-2018-3592]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, added a change to check if the pointer has been reset to NULL or not, before writing to the memory pointed by the pointer. [NIST-CVE-2018-3592]
• Discovered by: on: Unknown
• Reported on: 2018-04-01 [Bulletin-CVE-2018-3592]
• Fixed on: Unknown
• Fix released on: 2018-04-05 [Bulletin-CVE-2018-3592]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-3592]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9355

(json)

• CVE numbers: CVE-2018-9355 [Bulletin-CVE-2018-9355]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In bta_dm_sdp_result of bta_dm_act.cc, there is a possible out of bounds stack write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74016921. [NIST-CVE-2018-9355]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2018-9355] on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9355]
• Fixed on: 2018-04-02 [A-74016921]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9355]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9355] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9355]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9355]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11262

(json)

• CVE numbers: CVE-2018-11262 [Bulletin-CVE-2018-11262]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out total number of partition via a non zero check, there could be possibility where the 'TotalPart' could cross 'GptHeader->MaxPtCnt' and which could result in OOB write in patching GPT. [NIST-CVE-2018-11262]
• Discovered by: Xuan Xing of Google [Discovery-CVE-2018-11262] on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2018-11262]
• Fixed on: 2018-04-10 [QC-CR#2221192]
• Fix released on: 2019-02-05 [Bulletin-CVE-2018-11262]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11262]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-9357

(json)

• CVE numbers: CVE-2018-9357 [Bulletin-CVE-2018-9357]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In BNEP_Write of bnep_api.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-74947856. [NIST-CVE-2018-9357]
• Discovered by: Jianjun Dai (@Jioun_dai) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd [Discovery-CVE-2018-9357] on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9357]
• Fixed on: 2018-04-11 [A-74947856]
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9357]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9357] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9357]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9357]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-6289

(json)

• CVE numbers: CVE-2017-6289 [Bulletin-CVE-2017-6289]
• Coordinated disclosure?: unknown
• Categories: NVIDIA components
• Details: In Android before the 2018-05-05 security patch level, NVIDIA Trusted Execution Environment (TEE) contains a memory corruption (due to unusual root cause) vulnerability, which if run within the speculative execution of the TEE, may lead to local escalation of privileges. This issue is rated as critical. Android: A-72830049. Reference: N-CVE-2017-6289. [NIST-CVE-2017-6289]
• Discovered by: on: Unknown
• Reported on: 2018-05-01 [Bulletin-CVE-2017-6289]
• Fixed on: Unknown
• Fix released on: 2018-05-05 [Bulletin-CVE-2017-6289]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: NVIDIA [Bulletin-CVE-2017-6289]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9411

(json)

• CVE numbers: CVE-2018-9411 [Bulletin-CVE-2018-9411]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details:
• Discovered by: Tamir Zahavi-Brunner (@tamir_zb) of Zimperium zLabs Team [Discovery-CVE-2018-9411] on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-9411]
• Fixed on: 2018-05-11 [A-79376389]
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-9411]
• Affected versions: 8.0, 8.1 [Bulletin-CVE-2018-9411] regex: (8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9411]
• Fixed versions: 8.0, 8.1 [Bulletin-CVE-2018-9411]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9427

(json)

• CVE numbers: CVE-2018-9427 [Bulletin-CVE-2018-9427]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In CopyToOMX of OMXNodeInstance.cpp there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-77486542. [NIST-CVE-2018-9427]
• Discovered by: on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2018-9427]
• Fixed on: 2018-05-23 [2]
• Fix released on: 2018-08-05 [Bulletin-CVE-2018-9427]
• Affected versions: 8.0, 8.1 [Bulletin-CVE-2018-9427] regex: (8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9427]
• Fixed versions: 8.0, 8.1 [Bulletin-CVE-2018-9427]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9446

(json)

• CVE numbers: CVE-2018-9446 [Bulletin-CVE-2018-9446]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In smp_br_state_machine_event of smp_br_main.cc, there is a possible out of bounds write due to memory corruption. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-80145946. [NIST-CVE-2018-9446]
• Discovered by: Zinuo Han of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9446] on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2018-9446]
• Fixed on: 2018-05-29 [A-80145946]
• Fix released on: 2018-08-05 [Bulletin-CVE-2018-9446]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9446] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9446]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9446]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18155

(json)

• CVE numbers: CVE-2017-18155 [Bulletin-CVE-2017-18155]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: While playing HEVC content using HD DMB in Snapdragon Automobile and Snapdragon Mobile in version MSM8996AU, SD 450, SD 625, SD 820, SD 820A, SD 835, an uninitialized variable can be used leading to a kernel fault. [NIST-CVE-2017-18155]
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2017-18155]
• Fixed on: Unknown
• Fix released on: 2018-06-05 [Bulletin-CVE-2017-18155]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18155]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5146

(json)

• CVE numbers: CVE-2018-5146 [Bulletin-CVE-2018-5146]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest. This vulnerability affects Firefox < 59.0.1, Firefox ESR < 52.7.2, and Thunderbird < 52.7. [NIST-CVE-2018-5146]
• Discovered by: Jose Martinez [Discovery-CVE-2018-5146] on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-5146]
• Fixed on: Unknown
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-5146]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-5146] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-5146]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-5146]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9364

(json)

• CVE numbers: CVE-2018-9364 [Bulletin-CVE-2018-9364]
• Coordinated disclosure?: unknown
• Categories: LG components
• Details:
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9364]
• Fixed on: Unknown
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9364]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: LG [Bulletin-CVE-2018-9364]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9373

(json)

• CVE numbers: CVE-2018-9373 [Bulletin-CVE-2018-9373]
• Coordinated disclosure?: unknown
• Categories: MediaTek components
• Details:
• Discovered by: on: Unknown
• Reported on: 2018-06-01 [Bulletin-CVE-2018-9373]
• Fixed on: Unknown
• Fix released on: 2018-06-05 [Bulletin-CVE-2018-9373]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: MediaTek [Bulletin-CVE-2018-9373]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9450

(json)

• CVE numbers: CVE-2018-9450 [Bulletin-CVE-2018-9450]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_proc_vendor_command of avrc_api.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android ID: A-79541338. [NIST-CVE-2018-9450]
• Discovered by: Zinuo Han of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9450] on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2018-9450]
• Fixed on: 2018-06-05 [A-79541338]
• Fix released on: 2018-08-05 [Bulletin-CVE-2018-9450]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9450] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9450]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1 [Bulletin-CVE-2018-9450]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11940

(json)

• CVE numbers: CVE-2018-11940 [Bulletin-CVE-2018-11940]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details: Lack of check in length before using memcpy in WLAN function can lead to OOB access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130 [NIST-CVE-2018-11940]
• Discovered by: Pengfei Ding (丁鹏飞) of Huawei [Discovery-CVE-2018-11940] on: Unknown
• Reported on: 2019-04-01 [Bulletin-CVE-2018-11940]
• Fixed on: 2018-06-08 [QC-CR#2254946]
• Fix released on: 2019-04-05 [Bulletin-CVE-2018-11940]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11940]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-9536

(json)

• CVE numbers: CVE-2018-9536 [Bulletin-CVE-2018-9536]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In numerous functions of libFDK, there are possible out of bounds writes due to incorrect bounds checks. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112662184 [NIST-CVE-2018-9536]
• Discovered by: on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2018-9536]
• Fixed on: 2018-06-08 [A-112662184]
• Fix released on: 2018-11-05 [Bulletin-CVE-2018-9536]
• Affected versions: 9 [Bulletin-CVE-2018-9536] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9536]
• Fixed versions: 9 [Bulletin-CVE-2018-9536]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9550

(json)

• CVE numbers: CVE-2018-9550 [Bulletin-CVE-2018-9550]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112660981. [NIST-CVE-2018-9550]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9550]
• Fixed on: 2018-06-08 [A-112660981]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9550]
• Affected versions: 9 [Bulletin-CVE-2018-9550] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9550]
• Fixed versions: 9 [Bulletin-CVE-2018-9550]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9476

(json)

• CVE numbers: CVE-2018-9476 [Bulletin-CVE-2018-9476]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In avrc_pars_browsing_cmd of avrc_pars_tg.cc, there is a possible use-after-free due to improper locking. This could lead to remote escalation of privilege in the Bluetooth service with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android ID: A-109699112 [NIST-CVE-2018-9476]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9476] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9476]
• Fixed on: 2018-06-13 [A-109699112]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9476]
• Affected versions: 8.0, 8.1 [Bulletin-CVE-2018-9476] regex: (8.0.[0-9])|(8.1.[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9476]
• Fixed versions: 8.0, 8.1 [Bulletin-CVE-2018-9476]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9478

(json)

• CVE numbers: CVE-2018-9478 [Bulletin-CVE-2018-9478]
• Coordinated disclosure?: unknown
• Categories: System
• Details:
• Discovered by: Jianjun Dai (@jioun_dai) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9478] on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-9478]
• Fixed on: 2018-06-22 [A-79217522]
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-9478]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9478] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9478]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9478]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9479

(json)

• CVE numbers: CVE-2018-9479 [Bulletin-CVE-2018-9479]
• Coordinated disclosure?: unknown
• Categories: System
• Details:
• Discovered by: Jianjun Dai (@jioun_dai) and Guang Gong (@oldfresher) of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9479] on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-9479]
• Fixed on: 2018-06-22 [A-79217770]
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-9479]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9479] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9479]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9479]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9496

(json)

• CVE numbers: CVE-2018-9496 [Bulletin-CVE-2018-9496]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ixheaacd_real_synth_fft_p3 of ixheaacd_esbr_fft.c there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-9.0 Android ID: A-110769924 [NIST-CVE-2018-9496]
• Discovered by: on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9496]
• Fixed on: 2018-06-25 [A-110769924]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9496]
• Affected versions: 9 [Bulletin-CVE-2018-9496] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9496]
• Fixed versions: 9 [Bulletin-CVE-2018-9496]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9497

(json)

• CVE numbers: CVE-2018-9497 [Bulletin-CVE-2018-9497]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In impeg2_fmt_conv_yuv420p_to_yuv420sp_uv_av8 of impeg2_format_conv.s there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-74078669 [NIST-CVE-2018-9497]
• Discovered by: Stephan Zeisberg of Security Research Labs [Discovery-CVE-2018-9497] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9497]
• Fixed on: 2018-06-25 [A-74078669]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9497]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9497] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9497]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9497]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9475

(json)

• CVE numbers: CVE-2018-9475 [Bulletin-CVE-2018-9475]
• Coordinated disclosure?: unknown
• Categories: System
• Details:
• Discovered by: En He (@heeeeen4x) and Bo Liu of MS509Team (ms509.com) [Discovery-CVE-2018-9475] on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-9475]
• Fixed on: 2018-06-27 [A-79266386]
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-9475]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9475] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9475]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9475]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9531

(json)

• CVE numbers: CVE-2018-9531 [Bulletin-CVE-2018-9531]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In AudioSpecificConfig_Parse of tpdec_asc.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112661641 [NIST-CVE-2018-9531]
• Discovered by: on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2018-9531]
• Fixed on: 2018-06-29 [A-112661641]
• Fix released on: 2018-11-05 [Bulletin-CVE-2018-9531]
• Affected versions: 9 [Bulletin-CVE-2018-9531] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9531]
• Fixed versions: 9 [Bulletin-CVE-2018-9531]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2016-2108

(json)

• CVE numbers: CVE-2016-2108 [Bulletin-CVE-2016-2108]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via an ANY field in crafted serialized data, aka the "negative zero" issue. [NIST-CVE-2016-2108]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2016-2108]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2016-2108]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-2108]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18171

(json)

• CVE numbers: CVE-2017-18171 [Bulletin-CVE-2017-18171]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, SDM630, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016. [NIST-CVE-2017-18171]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2017-18171]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2017-18171]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18171]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11257

(json)

• CVE numbers: CVE-2018-11257 [Bulletin-CVE-2018-11257]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Permissions, Privileges, and Access Controls in TA in Snapdragon Mobile has an options that allows RPMB erase for secure devices in versions SD 210/SD 212/SD 205, SD 845, SD 850. [NIST-CVE-2018-11257]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-11257]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-11257]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11257]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11259

(json)

• CVE numbers: CVE-2018-11259 [Bulletin-CVE-2018-11259]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Due to Improper Access Control of NAND-based EFS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear, From fastboot on a NAND-based device, the EFS partition can be erased. Apps processor then has non-secure world full read/write access to the partition until the modem boots and configures the EFS partition addresses in its MPU partition. [NIST-CVE-2018-11259]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-11259]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-11259]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11259]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5874

(json)

• CVE numbers: CVE-2018-5874 [Bulletin-CVE-2018-5874]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: While parsing an mp4 file, a stack-based buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5874]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-5874]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-5874]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5874]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5875

(json)

• CVE numbers: CVE-2018-5875 [Bulletin-CVE-2018-5875]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: While parsing an mp4 file, an integer overflow leading to a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5875]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-5875]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-5875]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5875]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5876

(json)

• CVE numbers: CVE-2018-5876 [Bulletin-CVE-2018-5876]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear. [NIST-CVE-2018-5876]
• Discovered by: on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-5876]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-5876]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5876]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9433

(json)

• CVE numbers: CVE-2018-9433 [Bulletin-CVE-2018-9433]
• Coordinated disclosure?: unknown
• Categories: Framework
• Details:
• Discovered by: Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9433] on: Unknown
• Reported on: 2018-07-01 [Bulletin-CVE-2018-9433]
• Fixed on: Unknown
• Fix released on: 2018-07-05 [Bulletin-CVE-2018-9433]
• Affected versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2018-9433] regex: (6.0.[0-9])|(6.0.1)|(7.0.[0-9])|(7.1.1)|(7.1.2)
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9433]
• Fixed versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2 [Bulletin-CVE-2018-9433]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2019-2269

(json)

• CVE numbers: CVE-2019-2269 [Bulletin-CVE-2019-2269]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details:
• Discovered by: on: Unknown
• Reported on: 2019-06-01 [Bulletin-CVE-2019-2269]
• Fixed on: 2018-07-11 [QC-CR#2264429]
• Fix released on: 2019-06-05 [Bulletin-CVE-2019-2269]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2019-2269]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-9504

(json)

• CVE numbers: CVE-2018-9504 [Bulletin-CVE-2018-9504]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In sdp_copy_raw_data of sdp_discovery.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution over bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-110216176 [NIST-CVE-2018-9504]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9504] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9504]
• Fixed on: 2018-07-16 [A-110216176]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9504]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9504] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9504]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9504]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11817

(json)

• CVE numbers: CVE-2018-11817 [Bulletin-CVE-2018-11817]
• Coordinated disclosure?: unknown
• Categories: Qualcomm components
• Details:
• Discovered by: on: Unknown
• Reported on: 2019-03-01 [Bulletin-CVE-2018-11817]
• Fixed on: 2018-07-18 [QC-CR#2241830]
• Fix released on: 2019-03-05 [Bulletin-CVE-2018-11817]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11817]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-18296

(json)

• CVE numbers: CVE-2017-18296 [Bulletin-CVE-2017-18296]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Access control on applications is not applied while accessing SafeSwitch services can lead to improper access in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20. [NIST-CVE-2017-18296]
• Discovered by: on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2017-18296]
• Fixed on: Unknown
• Fix released on: 2018-08-05 [Bulletin-CVE-2017-18296]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18296]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18305

(json)

• CVE numbers: CVE-2017-18305 [Bulletin-CVE-2017-18305]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: XBL sec mem dump system call allows complete control of EL3 by unlocking all XPUs if enable fuse is not blown in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835. [NIST-CVE-2017-18305]
• Discovered by: on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2017-18305]
• Fixed on: Unknown
• Fix released on: 2018-08-05 [Bulletin-CVE-2017-18305]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18305]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18310

(json)

• CVE numbers: CVE-2017-18310 [Bulletin-CVE-2017-18310]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: ClientEnv exposes services 0-32 to HLOS in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016 [NIST-CVE-2017-18310]
• Discovered by: on: Unknown
• Reported on: 2018-08-01 [Bulletin-CVE-2017-18310]
• Fixed on: Unknown
• Fix released on: 2018-08-05 [Bulletin-CVE-2017-18310]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18310]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9490

(json)

• CVE numbers: CVE-2018-9490 [Bulletin-CVE-2018-9490]
• Coordinated disclosure?: unknown
• Categories: Framework
• Details: In CollectValuesOrEntriesImpl of elements.cc, there is possible remote code execution due to type confusion. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9.0 Android ID: A-111274046 [NIST-CVE-2018-9490]
• Discovered by: Guang Gong of Alpha Team, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9490] on: Unknown
• Reported on: 2018-10-01 [Bulletin-CVE-2018-9490]
• Fixed on: 2018-08-02 [A-111274046]
• Fix released on: 2018-10-05 [Bulletin-CVE-2018-9490]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9490] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9490]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9490]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9537

(json)

• CVE numbers: CVE-2018-9537 [Bulletin-CVE-2018-9537]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In CAacDecoder_DecodeFrame of aacdecode.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891564 [NIST-CVE-2018-9537]
• Discovered by: on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2018-9537]
• Fixed on: 2018-08-15 [A-112891564]
• Fix released on: 2018-11-05 [Bulletin-CVE-2018-9537]
• Affected versions: 9 [Bulletin-CVE-2018-9537] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9537]
• Fixed versions: 9 [Bulletin-CVE-2018-9537]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9551

(json)

• CVE numbers: CVE-2018-9551 [Bulletin-CVE-2018-9551]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In CAacDecoder_Init of aacdecoder.cpp, there is a possible out-of-bound write due to a missing bounds check. This could lead to remote code execution in the media server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-112891548. [NIST-CVE-2018-9551]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9551]
• Fixed on: 2018-08-15 [A-112891548]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9551]
• Affected versions: 9 [Bulletin-CVE-2018-9551] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9551]
• Fixed versions: 9 [Bulletin-CVE-2018-9551]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9527

(json)

• CVE numbers: CVE-2018-9527 [Bulletin-CVE-2018-9527]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In vorbis_book_decodev_set of codebook.c there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112159345 [NIST-CVE-2018-9527]
• Discovered by: Zinuo Han(weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9527] on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2018-9527]
• Fixed on: 2018-08-16 [A-112159345]
• Fix released on: 2018-11-05 [Bulletin-CVE-2018-9527]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9527] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9527]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9527]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2016-10394

(json)

• CVE numbers: CVE-2016-10394 [Bulletin-CVE-2016-10394]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details:
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2016-10394]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2016-10394]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2016-10394]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18311

(json)

• CVE numbers: CVE-2017-18311 [Bulletin-CVE-2017-18311]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration ports are open in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016. [NIST-CVE-2017-18311]
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2017-18311]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2017-18311]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18311]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18314

(json)

• CVE numbers: CVE-2017-18314 [Bulletin-CVE-2017-18314]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, on TZ cold boot the CNOC_QDSS RG0 locked by xBL_SEC is cleared by TZ. [NIST-CVE-2017-18314]
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2017-18314]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2017-18314]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18314]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11824

(json)

• CVE numbers: CVE-2018-11824 [Bulletin-CVE-2018-11824]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: A stack-based buffer overflow can occur in a firmware routine in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 835, SD 845, SD 850, SDA660 [NIST-CVE-2018-11824]
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-11824]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-11824]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11824]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11950

(json)

• CVE numbers: CVE-2018-11950 [Bulletin-CVE-2018-11950]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Unapproved TrustZone applications can be loaded and executed in Snapdragon Mobile in version SD 845, SD 850 [NIST-CVE-2018-11950]
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-11950]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-11950]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11950]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5866

(json)

• CVE numbers: CVE-2018-5866 [Bulletin-CVE-2018-5866]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: While processing logs, data is copied into a buffer pointed to by an untrusted pointer in Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 835, SD 845, SD 850, SDA660. [NIST-CVE-2018-5866]
• Discovered by: on: Unknown
• Reported on: 2018-09-01 [Bulletin-CVE-2018-5866]
• Fixed on: Unknown
• Fix released on: 2018-09-05 [Bulletin-CVE-2018-5866]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5866]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9549

(json)

• CVE numbers: CVE-2018-9549 [Bulletin-CVE-2018-9549]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In lppTransposer of lpp_tran.cpp there is a possible out of bounds write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112160868. [NIST-CVE-2018-9549]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9549] on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9549]
• Fixed on: 2018-09-10 [A-112160868]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9549]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9549] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9549]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9549]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9552

(json)

• CVE numbers: CVE-2018-9552 [Bulletin-CVE-2018-9552]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ihevcd_sao_shift_ctb of ihevcd_sao.c there is a possible out of bounds write due to missing bounds check. This could lead to information disclosure with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-113260892. [NIST-CVE-2018-9552]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9552] on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9552]
• Fixed on: 2018-09-11 [A-113260892]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9552]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9552] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9552]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9552]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-9555

(json)

• CVE numbers: CVE-2018-9555 [Bulletin-CVE-2018-9555]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112321180. [NIST-CVE-2018-9555]
• Discovered by: Scott Bauer (@ScottyBauer1) [Discovery-CVE-2018-9555] on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9555]
• Fixed on: 2018-09-17 [A-112321180]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9555]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9555] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9555]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9555]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2019-2095

(json)

• CVE numbers: CVE-2019-2095 [Bulletin-CVE-2019-2095]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In callGenIDChangeListeners and related functions of SkPixelRef.cpp, there is a possible use after free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-124232283. [NIST-CVE-2019-2095]
• Discovered by: on: Unknown
• Reported on: 2019-06-01 [Bulletin-CVE-2019-2095]
• Fixed on: 2018-09-17 [A-124232283]
• Fix released on: 2019-06-05 [Bulletin-CVE-2019-2095]
• Affected versions: 9 [Bulletin-CVE-2019-2095] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-2095]
• Fixed versions: 9 [Bulletin-CVE-2019-2095]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-9583

(json)

• CVE numbers: CVE-2018-9583 [Bulletin-CVE-2018-9583]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In bta_ag_parse_cmer of bta_ag_cmd.cc in Android-7.0, Android-7.1.1, Android-7.1.2, Android-8.0, Android-8.1 and Android-9, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution in the bluetooth server with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112860487. [NIST-CVE-2018-9583]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2018-9583] on: Unknown
• Reported on: 2019-01-01 [Bulletin-CVE-2018-9583]
• Fixed on: 2018-09-18 [A-112860487]
• Fix released on: 2019-01-05 [Bulletin-CVE-2018-9583]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9583] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9583]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2018-9583]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2018-9556

(json)

• CVE numbers: CVE-2018-9556 [Bulletin-CVE-2018-9556]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In ParsePayloadHeader of payload_metadata.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113118184. [NIST-CVE-2018-9556]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-9556]
• Fixed on: 2018-09-19 [A-113118184]
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-9556]
• Affected versions: 9 [Bulletin-CVE-2018-9556] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2018-9556]
• Fixed versions: 9 [Bulletin-CVE-2018-9556]
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2019-1988

(json)

• CVE numbers: CVE-2019-1988 [Bulletin-CVE-2019-1988]
• Coordinated disclosure?: unknown
• Categories: Framework
• Details: In sample6 of SkSwizzler.cpp, there is a possible out of bounds write due to improper input validation. This could lead to remote code execution in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-118372692. [NIST-CVE-2019-1988]
• Discovered by: on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2019-1988]
• Fixed on: 2018-10-24 [A-118372692]
• Fix released on: 2019-02-05 [Bulletin-CVE-2019-1988]
• Affected versions: 8.0, 8.1, 9 [Bulletin-CVE-2019-1988] regex: (8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1988]
• Fixed versions: 8.0, 8.1, 9 [Bulletin-CVE-2019-1988]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1989

(json)

• CVE numbers: CVE-2019-1989 [Bulletin-CVE-2019-1989]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ih264d_fmt_conv_420sp_to_420p of ih264d_format_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118399205 [NIST-CVE-2019-1989]
• Discovered by: on: Unknown
• Reported on: 2019-03-01 [Bulletin-CVE-2019-1989]
• Fixed on: 2018-10-24 [A-118399205]
• Fix released on: 2019-03-05 [Bulletin-CVE-2019-1989]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1989] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1989]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1989]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-18317

(json)

• CVE numbers: CVE-2017-18317 [Bulletin-CVE-2017-18317]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Restrictions related to the modem (sim lock, sim kill) can be bypassed by manipulating the system to issue a deactivation flow sequence in Snapdragon Automobile, Snapdragon Mobile in versions MSM8996AU,SD 410/12,SD 820,SD 820A. [NIST-CVE-2017-18317]
• Discovered by: on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2017-18317]
• Fixed on: Unknown
• Fix released on: 2018-11-05 [Bulletin-CVE-2017-18317]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18317]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11264

(json)

• CVE numbers: CVE-2018-11264 [Bulletin-CVE-2018-11264]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Possible buffer overflow in Ontario fingerprint code due to lack of input validation for the parameters coming into TZ from HLOS in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions MDM9206, MDM9607, MDM9650, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660. [NIST-CVE-2018-11264]
• Discovered by: on: Unknown
• Reported on: 2018-11-01 [Bulletin-CVE-2018-11264]
• Fixed on: Unknown
• Fix released on: 2018-11-05 [Bulletin-CVE-2018-11264]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11264]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2019-2028

(json)

• CVE numbers: CVE-2019-2028 [Bulletin-CVE-2019-2028]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In numerous hand-crafted functions in libmpeg2, NEON registers are not preserved. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-120644655. [NIST-CVE-2019-2028]
• Discovered by: Suresh Sivaraman of Ittiam [Discovery-CVE-2019-2028] on: Unknown
• Reported on: 2019-04-01 [Bulletin-CVE-2019-2028]
• Fixed on: 2018-11-07 [A-120644655]
• Fix released on: 2019-04-05 [Bulletin-CVE-2019-2028]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2028] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-2028]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2028]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1986

(json)

• CVE numbers: CVE-2019-1986 [Bulletin-CVE-2019-1986]
• Coordinated disclosure?: unknown
• Categories: Framework
• Details: In SkSwizzler::onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege in system_server with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-117838472. [NIST-CVE-2019-1986]
• Discovered by: Leon Scroggins of Google [Discovery-CVE-2019-1986] on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2019-1986]
• Fixed on: 2018-11-08 [A-117838472]
• Fix released on: 2019-02-05 [Bulletin-CVE-2019-1986]
• Affected versions: 9 [Bulletin-CVE-2019-1986] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1986]
• Fixed versions: 9 [Bulletin-CVE-2019-1986]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1987

(json)

• CVE numbers: CVE-2019-1987 [Bulletin-CVE-2019-1987]
• Coordinated disclosure?: unknown
• Categories: Framework
• Details: In onSetSampleX of SkSwizzler.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-118143775. [NIST-CVE-2019-1987]
• Discovered by: on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2019-1987]
• Fixed on: 2018-11-08 [A-118143775]
• Fix released on: 2019-02-05 [Bulletin-CVE-2019-1987]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1987] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1987]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1987]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1990

(json)

• CVE numbers: CVE-2019-1990 [Bulletin-CVE-2019-1990]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In ihevcd_fmt_conv_420sp_to_420p of ihevcd_fmt_conv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-118453553 [NIST-CVE-2019-1990]
• Discovered by: on: Unknown
• Reported on: 2019-03-01 [Bulletin-CVE-2019-1990]
• Fixed on: 2018-11-12 [A-118453553]
• Fix released on: 2019-03-05 [Bulletin-CVE-2019-1990]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1990] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1990]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1990]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1992

(json)

• CVE numbers: CVE-2019-1992 [Bulletin-CVE-2019-1992]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In bta_hl_sdp_query_results of bta_hl_main.cc, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-116222069. [NIST-CVE-2019-1992]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2019-1992] on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2019-1992]
• Fixed on: 2018-11-20 [A-116222069]
• Fix released on: 2019-02-05 [Bulletin-CVE-2019-1992]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1992] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1992]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1992]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-1991

(json)

• CVE numbers: CVE-2019-1991 [Bulletin-CVE-2019-1991]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In btif_dm_data_copy of btif_core.cc, there is a possible out of bounds write due to a buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-110166268. [NIST-CVE-2019-1991]
• Discovered by: Zinuo Han (weibo.com/ele7enxxh) of Chengdu Security Response Center, Qihoo 360 Technology Co. Ltd. [Discovery-CVE-2019-1991] on: Unknown
• Reported on: 2019-02-01 [Bulletin-CVE-2019-1991]
• Fixed on: 2018-11-27 [A-110166268]
• Fix released on: 2019-02-05 [Bulletin-CVE-2019-1991]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1991] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-1991]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-1991]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2017-11004

(json)

• CVE numbers: CVE-2017-11004 [Bulletin-CVE-2017-11004]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. [NIST-CVE-2017-11004]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2017-11004]
• Fixed on: Unknown
• Fix released on: 2018-12-05 [Bulletin-CVE-2017-11004]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-11004]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-18141

(json)

• CVE numbers: CVE-2017-18141 [Bulletin-CVE-2017-18141]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: When a 3rd party TEE has been loaded it is possible for the non-secure world to create a secure monitor call which will give it access to privileged functions meant to only be accessible from the TEE in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear in versions IPQ8074, MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 625, SD 632, SD 636, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM439, SDM630, SDM660, SDX24, Snapdragon_High_Med_2016. [NIST-CVE-2017-18141]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2017-18141]
• Fixed on: Unknown
• Fix released on: 2018-12-05 [Bulletin-CVE-2017-18141]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-18141]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2017-8248

(json)

• CVE numbers: CVE-2017-8248 [Bulletin-CVE-2017-8248]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation. [NIST-CVE-2017-8248]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2017-8248]
• Fixed on: Unknown
• Fix released on: 2018-12-05 [Bulletin-CVE-2017-8248]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2017-8248]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-11279

(json)

• CVE numbers: CVE-2018-11279 [Bulletin-CVE-2018-11279]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-11279]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-11279]
• Fixed on: Unknown
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-11279]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-11279]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-07-25

CVE-2018-5913

(json)

• CVE numbers: CVE-2018-5913 [Bulletin-CVE-2018-5913]
• Coordinated disclosure?: unknown
• Categories: Qualcomm closed-source components
• Details: A non-time constant function memcmp is used which creates a side channel that could leak information in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, MSM8996AU, QCS405, QCS605, Qualcomm 215, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 632, SD 636, SD 650/52, SD 675, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SD 8CX, SDA660, SDM439, SDM630, SDM660, Snapdragon_High_Med_2016, SXR1130 [NIST-CVE-2018-5913]
• Discovered by: on: Unknown
• Reported on: 2018-12-01 [Bulletin-CVE-2018-5913]
• Fixed on: Unknown
• Fix released on: 2018-12-05 [Bulletin-CVE-2018-5913]
• Affected versions: regex:
• Affected devices:
• Affected manufacturers: Qualcomm [Bulletin-CVE-2018-5913]
• Fixed versions:
• Submission: by: Daniel Carter, on: 2019-08-01

CVE-2019-2009

(json)

• CVE numbers: CVE-2019-2009 [Bulletin-CVE-2019-2009]
• Coordinated disclosure?: unknown
• Categories: System
• Details: In l2c_lcc_proc_pdu of l2c_fcr.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9Android ID: A-120665616 [NIST-CVE-2019-2009]
• Discovered by: Jianjun Dai ( @jioun_dai) and Guang Gong ( @oldfresher) of 360 Alpha Team [Discovery-CVE-2019-2009] on: Unknown
• Reported on: 2019-03-01 [Bulletin-CVE-2019-2009]
• Fixed on: 2018-12-11 [A-120665616]
• Fix released on: 2019-03-05 [Bulletin-CVE-2019-2009]
• Affected versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2009] regex: (7.0.[0-9])|(7.1.1)|(7.1.2)|(8.0.[0-9])|(8.1.[0-9])|(9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-2009]
• Fixed versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1, 9 [Bulletin-CVE-2019-2009]
• Submission: by: Daniel Carter, on: 2019-07-24

CVE-2019-2093

(json)

• CVE numbers: CVE-2019-2093 [Bulletin-CVE-2019-2093]
• Coordinated disclosure?: unknown
• Categories: Media framework
• Details: In huff_dec_1D of nlc_dec.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-119292397. [NIST-CVE-2019-2093]
• Discovered by: on: Unknown
• Reported on: 2019-06-01 [Bulletin-CVE-2019-2093]
• Fixed on: 2018-12-20 [A-119292397]
• Fix released on: 2019-06-05 [Bulletin-CVE-2019-2093]
• Affected versions: 9 [Bulletin-CVE-2019-2093] regex: (9.[0-9].[0-9])
• Affected devices:
• Affected manufacturers: all [Bulletin-CVE-2019-2093]
• Fixed versions: 9 [Bulletin-CVE-2019-2093]
• Submission: by: Daniel Carter, on: 2019-07-24