VulnerabilityModified

CVE-2015-9220

CRITICAL 9.8EPSS 1.27%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.27%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.27% probability · 68th percentile
CISA KEV: Not listed
Weakness: CWE-190
Affected: qualcomm/mdm9206 firmware · qualcomm/mdm9607 firmware · qualcomm/ipq4019 firmware · qualcomm/ipq8064 firmware · qualcomm/qca4531 firmware · qualcomm/mdm9640 firmware · qualcomm/qca6174a firmware · qualcomm/mdm9650 firmware · qualcomm/qca6574au firmware · qualcomm/qca6584 firmware · qualcomm/sd 210 firmware · qualcomm/sd 212 firmware · qualcomm/sd 205 firmware · qualcomm/qca6584au firmware · qualcomm/qca9377 firmware · qualcomm/qca9378 firmware · qualcomm/sd 425 firmware · qualcomm/qca9379 firmware · qualcomm/qca9558 firmware · qualcomm/qca9880 firmware · +6 more
Source: product-security@qualcomm.com

References

http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.