Qualcomm, Inc. Snapdragon Mobile, Snapdragon Wear: 74 records in one advisory

74 records announced together, published 2018-04-18, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/2018-04-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

Every CVE we hold for Android

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

40 of 74 records name something of its own. For the other 34, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Untrusted Pointer Dereference in TrustZone.

What this page does not cover

This batch is 74 of the 310 records that cite the same advisory. The other 236 are different findings announced alongside it.

137 of them are on the sibling batches linked below. The remaining 99 are grouped with nothing and have only their own record pages.

Other batches under the same advisory: android-2018-04-01-29db7ea287, android-2018-04-01-a47b4c7c8c, android-2018-04-01-f134353565, android-2018-04-01-ffd03706cf

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2014-10043rights rights exposingBuffer Over-Read in Core.

CVE-2014-10045exist saharaBuffer Copy without Checking Size of Program…

CVE-2014-10048no title heldImproper validation of Array Index in Services.

CVE-2014-10051loading dynamically loaded i-cacheCache side-channel vulnerability in Core

CVE-2014-10062locationserviceInformation Exposure in GPS

CVE-2014-9989endpoint directionOut-of-bounds array access may occur in the USB…

CVE-2014-9990no title heldPossible array out of bounds access in Core

CVE-2014-9991sends 16k mass storageBuffer Copy without Checking Size of Input…

CVE-2014-9997prdiagmaintenancehandlerBuffer Over Read in Core

CVE-2015-9119no title heldBuffer overread vulnerability in Core.

CVE-2015-9122no title heldInteger overflow to buffer overflow while…

CVE-2015-9126circuitInteger overflow when processing 1X circuit…

CVE-2015-9127no title heldNULL pointer dereference in Playready App

CVE-2015-9130no title heldNULL Pointer Dereference in TrustZone

CVE-2015-9132helperUntrusted pointer dereference may cause…

CVE-2015-9135no title heldUntrusted Pointer Dereference in TrustZone

CVE-2015-9136pre-auth ft iesPossible buffer overflow when processing FT IEs

CVE-2015-9137no title heldImproper access control in EFS Diag handlers

CVE-2015-9139negotiatingImproper Input Validation in Modem

CVE-2015-9141hho scenarios acq instancesBuffer overflow in ACQ HHO scenarios without…

CVE-2015-9143cdt emmc meta cdt-arrayBuffer Copy without Checking Size of Input…

CVE-2015-9144no title heldBuffer Over Read in MMCP

CVE-2015-9156making high speed dualBuffer overflow vulnerability in Modem

CVE-2015-9157widevine_dash_cmd_handler rsp off commandsTime-of-check Time-of-use (TOCTOU) Race…

CVE-2015-9161playready_reader_bindTOCTOU vulnerability in QTEE

CVE-2015-9165doubleDouble free vulnerability in QTEE

CVE-2015-9169confidential leakedBuffer overread vulnerability in content…

CVE-2015-9189tz_app_cmd_handler contentInformation Leak vulnerability in QTEE

CVE-2015-9190start_addr boot_clobber_check_local_address_range clobberInteger Overflow or Wraparound in Boot.

CVE-2015-9191no title heldUntrusted Pointer Dereference in TrustZone

CVE-2015-9196tzbsp_ocmemImproper Access Control in Core

CVE-2015-9197enabling xpus smem partitionsBuffer overflow vulnerability while enabling…

CVE-2015-9200trustzone functions dereferencedUntrusted Pointer Dereference in TrustZone

CVE-2015-9204cchfriendlyname tz_pr_max_name_len playready_leavedomain_generate_challengeBuffer Over-Read in Core.

CVE-2015-9205no title heldBuffer Over-read in TrustZone

CVE-2015-9206xml encodingBuffer overread vulnerability in Playready

CVE-2015-9207playready_getadditional_responsedataBuffer overread vulnerability in QTEE

CVE-2015-9208tzbsp_pil_verify_sig does strictly elfUntrusted Pointer Dereference in Core

CVE-2015-9209no title heldImproper Access Control in Core

CVE-2015-9212tz_pr_cmd_save_keyBuffer overread vulnerability in QTEE

CVE-2015-9213no title heldImproper Access Contorl in Storage.

CVE-2015-9216simultaneous interrupt epLack of non-specification compliance error…

CVE-2015-9217certain malformed hvec clipsReachable assertion during video playback

CVE-2015-9218bad hevcReachable Assertion in Video.

CVE-2015-9220incorrectlyInteger overflow vulnerability when loading…

CVE-2015-9222erroneous bitstreamsLoop with Unreachable Exit Condition ('Infinite…

CVE-2016-10410no title heldBuffer Overread vulnerability in Modem

CVE-2016-10415no title heldImproper input validation in GPS

CVE-2016-10416no title heldUncontrolled Resource Consumption ('Resource…

CVE-2016-10420backBuffer Over-Read in Video.

CVE-2016-10421no title heldCryptographic Issues in LTE

CVE-2016-10427no title heldReachable Assertion in LTE

CVE-2016-10441no title heldBuffer Overread in Video

CVE-2016-10447ui link list entryPossible Denial of service in QTEE

CVE-2016-10448no title heldTime-of-check Time-of-use (TOCTOU) Race…

CVE-2016-10449gnssNULL Pointer Dereference in GNSS

CVE-2016-10451no title heldArbitrary command execution due to privilege…

CVE-2016-10455no title heldUse of Uninitialized Variable in SEC

CVE-2016-10456no title heldImproper input validation in radish results in…

CVE-2016-10457requestingSecurity vulnerability due to improper…

CVE-2016-10459no title heldUncontrolled Resource Consumption in Modem

CVE-2016-10464hci h4 uartReachable Assertion in BTSOC

CVE-2016-10466no title heldUse of insufficiently random values in Modem

CVE-2016-10472no title heldUntrusted Pointer Dereference in Core.

CVE-2016-10473supplementaryBuffer Copy without Checking Size in RIL

CVE-2016-10476no title heldImproper Validation of Array Index in RIL.

CVE-2016-10480no title heldInteger overflow to buffer overflow in Camera

CVE-2016-10481fwReachable Assertion in WLAN.

CVE-2016-10482no title heldReachable Assertion in LTE

CVE-2016-10485no title heldBuffer overflow vulnerability in Core

CVE-2016-10491no title heldInteger Overflow to Buffer Overflow in Core

CVE-2016-10492no title heldImproper Input Validation in MODEM

CVE-2016-10497no title heldReachable Assertion in MODEM

CVE-2016-10499no title heldPotential Memory leak in Modem

74 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.