vciy

Qualcomm, Inc. Snapdragon Automobile, Snapdragon Mobile: 27 records in one advisory

27 records announced together, published 2018-04-18, every one of them citing the same advisory.

The advisory

Every record in this batch cites https://source.android.com/security/bulletin/2018-04-01. That is the CNA's own reference, held in the index, and it is why these records are on one page.

What the records offer

No record in this batch publishes a fixed version in held sources.

No record in this batch is listed by CISA in held sources.

23 of 27 records name something of its own. For the other 4, held sources say the same thing about each.

Most commonly mapped weakness across the batch: Improper Input Validation in TrustZone.

What this page does not cover

This batch is 27 of the 310 records that cite the same advisory. The other 283 are different findings announced alongside it.

184 of them are on the sibling batches linked below. The remaining 99 are grouped with nothing and have only their own record pages.

Other batches under the same advisory: android-2018-04-01-29db7ea287, android-2018-04-01-9c7343c19f, android-2018-04-01-a47b4c7c8c, android-2018-04-01-ffd03706cf

The batch is what one advisory announced. It is not every record sharing this weakness, this product or this mechanism, and nothing here is scoped to any estate.

Listed for shared announcement, not shared vulnerability. Each record here is its own finding with its own page, and fixing one does not address another.

CVE-2015-9108read/write exception downstreamUntrusted pointer dereference in QSEE syscall
CVE-2015-9109inqsee_fuse_writePotential Untrusted pointer dereference in QTEE
CVE-2015-9110qsee_get_secure_stateUntrusted pointer dereference in…
CVE-2015-9111no title heldUntrusted Pointer Dereference in TrustZone
CVE-2015-9112no title heldUntrusted Pointer Dereference in Core
CVE-2015-9113blacklistedUntrusted pointer dereference in QSEE syscall
CVE-2015-9114qsee_query_counterPotential Untrusted pointer dereference in QTEE
CVE-2015-9115qsee_prng_getdataUntrusted Pointer Dereference in Core.
CVE-2015-9116no title heldUntrusted Pointer Dereference in TrustZone
CVE-2015-9148user-pdInteger Overflow to Buffer Overflow in Services.
CVE-2015-9152modem accessibleImproper Access Control in Core.
CVE-2015-9167emm underflowInteger Underflow (Wrap or Wraparound) in…
CVE-2015-9199region done registeringTime-of-check Time-of-use (TOCTOU) Race…
CVE-2016-10409composingTOCTOU vulnerability in secure write protect…
CVE-2016-10423trusted opened spi particularImproper access control with SPI bus
CVE-2016-10426safeswitchImproper Input Validation in TrustZone
CVE-2016-10428verification counter insecure memcmpTiming attack vulnerability leads to counters…
CVE-2016-10430granted cpvc mink classImproper Authorization in Core
CVE-2016-10432vulnerabilities sanitizing userspace tqseeTOCTOU while processing keystore requests
CVE-2016-10434needs authenticated then processedImproper Authentication in Storage.
CVE-2016-10439bulletin_board_read promising hasn't changedTime-of-check Time-of-use (TOCTOU) Race…
CVE-2016-10445no title heldImproper Input Validation in TrustZone
CVE-2016-10452happens invoking termination orderPossible Denial of service in QTEE
CVE-2016-10462slimbusConfiguration in Core.
CVE-2016-10467ce_pkcs1_pss_padding_verify_auto_recover_saltlen assumes encoded equalCryptographic Issues in Core.
CVE-2016-10471unsigned rtic health susceptibleSecurity vulnerability due to improper…
CVE-2016-10486reason directly root soBuffer Over-Read in Debugtools.

27 records, read from the index as it stood on 2026-10-18. Every row opens the record it names, and every value on that record opens its own receipt.

Everything on this page is free. Public data. Withholding it protects nothing.