deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2014-10039
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, SD 400, and SD 800, calling qsee_app_entry_return() without first calling qsee_app_entry() will cause the stack to be restored to an older state resulting in a return to an unexpected location.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-19
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10043
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SD 800, while reading PlayReady rights string information from command buffer (which is sent from non-secure side), if length of rights string is very large, a buffer over read occurs, exposing TZ App memory to non-secure side.
CVSS Score: 7.5 (HIGH)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10044
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 617, SD 800, and SD 820, in the time daemon, unauthorized users can potentially modify system time and cause an array index to be out-of-bound.
CVSS Score: 7.5 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10045
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 820, and SDX20, buffer overflow vulnerability exist in Sahara boot when program header are parsing.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10046
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, use after free vulnerability when the PDN throttle info block is freed without clearing the corresponding active timer.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-416
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10047
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, when writing the Full Disk Encryption key to crypto engine, information leak could occur.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10048
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, while setting the offsets, time-services allows the user to set bases greater than valid base value which will lead to array index out-of-bound.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10050
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when accessing the replay protected memory block.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10051
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, and SDX20, after loading a dynamically loaded code section, I-Cache is not invalidated, which could lead to executing code from stale cache lines.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10052
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile, Snapdragon Wear, and Small Cell SoC FSM9055, IPQ4019, MDM9206, MDM9607, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, SD 810, SD 835, and SDX20, the reserved memory of TZ subsystem (like TZ apps and some PIL image subsystem) is not cleared after being used.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10053
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, data access is not properly validated in the Widevine secure application.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10054
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, MSM8909W, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 400, SD 450, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SDX20, lack of input validation on BT HCI commands processing allows privilege escalation.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10055
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, there could be leakage of protected contents if HLOS doesn't request for security restoration for OCMEM xPU's.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10056
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, A buffer overflow can potentially occur in any OpenCL application that calls clBuildProgram() with a device of type CL_DEVICE_TYPE_CPU in its device_list argument.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10057
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, and Snapdragon_High_Med_2016, binary Calibration files under data/misc/audio have 777 permissions.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-264
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10058
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 800, SD 845, and Snapdragon_High_Med_2016, unauthorized users can potentially modify system time.
CVSS Score: 7.5 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10059
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, and SD 800, improper access control on ATCMD service allows third party services to access without user knowledge.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-284
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10062
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, LocationService is being exported, which is a way for a service to expose its methods to other services. This makes it possible for any other services to import LocationService and call into the exposed method for bringing up a data connection.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-10063
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown on a secure device.
CVSS Score: 7.5 (HIGH)
CWE: CWE-254
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9985
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 400, and SD 800, TOCTOU condition may result in bypassing error condition checks, leading to undefined behavior.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-388
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9986
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 820A, in playready_licacq_process_response(), 'cbResponse' value is controlled by HLOS, and there is no validation on this length. If 'cbResponse' is too large, memory overread occurs.
CVSS Score: 7.5 (HIGH)
CWE: CWE-20, CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9987
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, a buffer over-read can occur in a DRM API.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9988
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear SD 820A, IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SD 450, and SD 850, lack of input validation for message length causes buffer over read in drm_app_encapsulate_save_keys.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9989
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, and SD 450, if an incorrect endpoint number or direction is passed, an out of bounds array access may occur in the USB management module.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9990
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 430, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, and SD 450, lack of input validation could lead to an out of bound array access.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-129
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9991
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, SD 810, and SD 450, if a client or host sends more than 16k bytes of USB mass storage transfer, a buffer overflow occurs.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9993
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 450, and SD 850, buffer overread vulnerability may occur while provisioning a content with a large message.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9994
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, lack of validation of input could cause a integer overflow that could subsequently lead to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-190
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9995
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, in drmprov_cmd_verify_key(), the variable feature_name_length is not validated. There is a check for feature_name_len + filePathLen but there might be an integer wrap when checking feature_name_len + filePathLen. This leads to a buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9996
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, while verifying provisioning, a buffer overflow can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9997
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 450, SD 625, SD 650/52, SD 808, and SD 810, lack of input validation in PRDiagMaintenanceHandler can leads to buffer over read.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2014-9998
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 808, SD 810, SD 820, and SDX20, while processing firmware image signature, the internal buffer may overflow if the firmware signature size is large.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9108
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation performed on calls to a QSEE syscall may lead to arbitrary read/write or NULL Pointer exception when calling a downstream function.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9109
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation inqsee_fuse_write could lead to untrusted pointer dereference.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9110
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation is performed on calls to the qsee_get_secure_state syscall.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9111
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9112
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 400, SD 800, SD 820, and SD 820A, lack of input validation in QSEE can cause potential buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9113
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, untrusted pointer dereference in QSEE Syscall without proper validation can lead to access of blacklisted memory.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9114
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 820, and SD 820A, lack of address argument validation in qsee_query_counter syscall could lead to untrusted pointer dereference.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-476
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9115
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, and SD 820A, no address argument validation is performed on calls to the qsee_prng_getdata syscall.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9116
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9625, SD 425, SD 430, SD 450, SD 625, SD 650/52, SD 810, SD 820, and SD 820A, in a QTEE syscall handler, an untrusted pointer dereference can occur.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671
CVE: CVE-2015-9118
Published: 2018-04-18
Description: In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, SD 808, and SD 810, in ADSP's QDI Root-PD driver, untrusted arguments from User PD may cause integer overflow resulting in buffer overflow.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119
References: http://www.securityfocus.com/bid/103671; https://source.android.com/security/bulletin/2018-04-01; http://www.securityfocus.com/bid/103671