CVE-2015-9183
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in TQS QSEE application, while parsing "Set Certificates" command an integer overflow may result in…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.01%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in TQS QSEE application, while parsing "Set Certificates" command an integer overflow may result in buffer overflow.
- CVSS 3.0
- 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119, CWE-190
- Affected
- qualcomm/sd 410 firmware · qualcomm/sd 412 firmware · qualcomm/sd 617 firmware · qualcomm/sd 652 firmware · qualcomm/sd 800 firmware · qualcomm/sd 808 firmware · qualcomm/sd 810 firmware · qualcomm/sd 650 firmware
- Source
- product-security@qualcomm.com
References
- http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
- http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
- https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.