vciy

Qualcomm, Inc. Snapdragon Mobile: 28 records in one advisory

28 records announced together, published 2018-04-18, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/2018-04-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

23 of 28 records name something of its own. For the other 5, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Buffer Copy without Checking Size in RIL.

What this page does not cover

This batch is 28 of the 310 records that cite the same advisory. The other 282 are different findings announced alongside it.

183 of them are on the sibling batches linked below. The remaining 99 are grouped with nothing and have only their own record pages.

Other batches under the same advisory: android-2018-04-01-29db7ea287, android-2018-04-01-9c7343c19f, android-2018-04-01-f134353565, android-2018-04-01-ffd03706cf

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2014-10047full disk encryption engineInformation exposure vulnerability in QTEE
CVE-2014-10055leakage doesn't restoration ocmemLeakage of protected contents when security…
CVE-2014-10056opencl clbuildprogram cl_device_type_cpu itsBuffer Overflow vulnerability when using…
CVE-2014-10058no title heldImproper Access Control in Core
CVE-2014-9994subsequentlyInteger Overflow to Buffer Overflow…
CVE-2014-9995drmprov_cmd_verify_key feature_name_length feature_name_len filepathlenInteger Overflow to Buffer Overflow.
CVE-2014-9996verifying provisioningBuffer Copy without Checking Size of Input in…
CVE-2015-9131no title heldUntrusted Pointer Dereference in Core
CVE-2015-9133tz_wv_cmd_decrypt_videoInteger overflow vulnerability in Widevine App
CVE-2015-9134qsee_macc_gen_ecc_privkeyUntrusted Pointer Dereference in Core.
CVE-2015-9162certificate_createwithbuffer case weUse after Free in Core.
CVE-2015-9173memscpyDetection of Error Condition without Action in…
CVE-2015-9174priorBuffer overflow vulnerability in TQS
CVE-2015-9183certificatesInteger overflow to buffer overflow…
CVE-2015-9194load at startup staticallyInformation Exposure in Core.
CVE-2015-9219drmInteger Overflow to Buffer Overflow in TrustZone
CVE-2015-9221appsUntrusted Pointer access in QTEE
CVE-2016-10407no title heldInteger Overflow to Buffer Overflow in Data
CVE-2016-10411rtp crashes terminates rtcpBuffer Over-Read in DataHLOS.
CVE-2016-10440busImproper Access Control in TrustZone
CVE-2016-10454no title heldImproper Validation of Array Index in TrustZone
CVE-2016-10458solutionUse of Uninitialized Variable in Core.
CVE-2016-10460vendor specific opcodes over-readsBuffer over-read vulnerability in vendor…
CVE-2016-10475no title heldInteger overflow to buffer overflow in RIL
CVE-2016-10477smartBuffer Copy without Checking Size in RIL
CVE-2016-10478calculation qcril scwsInteger Overflow to Buffer Cverflow in RIL
CVE-2016-10483scmImproper Input Validation in CORE
CVE-2016-10489qsee_get_tz_app_nameUntrusted pointer dereference in QTEE

28 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.