var-201804-0118
Vulnerability from variot
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 615/16/SD 415, and SD 810, while processing QSEE Syscall 'qsee_macc_gen_ecc_privkey', untrusted pointer dereference occurs, which could result in arbitrary write. plural Qualcomm Run on product Android Is NULL A vulnerability related to pointer dereference exists.Information may be tampered with. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm SD 410, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm). A security vulnerability exists in Qualcomm closed-source components in Android versions prior to 2018-04-05. A remote attacker could exploit this vulnerability to perform arbitrary write operations (null pointer backreferences). The following products (for mobile devices) are affected: Qualcomm SD 410/12; SD 615/16; SD 415; SD 810
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201804-0118", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "sd 615", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 410", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 810", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 616", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 412", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 415", "scope": "eq", "trust": 1.6, "vendor": "qualcomm", "version": null }, { "model": "sd 410", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "sd 412", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "sd 415", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "sd 615", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "sd 616", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "sd 810", "scope": null, "trust": 0.8, "vendor": "qualcomm", "version": null }, { "model": "pixel xl", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "0" }, { "model": "pixel c", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "0" }, { "model": "pixel xl", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "20" }, { "model": "pixel", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "20" }, { "model": "pixel", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "0" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "9" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "7" }, { "model": "nexus 6p", "scope": null, "trust": 0.3, "vendor": "google", "version": null }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "6" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "5x" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "5" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "4" }, { "model": "nexus", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "10" }, { "model": "android", "scope": "eq", "trust": 0.3, "vendor": "google", "version": "0" } ], "sources": [ { "db": "BID", "id": "103671" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_410_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_410:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_412_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_412:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_615_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_615:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_616_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_616:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_415_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_415:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" }, { "children": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:qualcomm:sd_810_firmware:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:h:qualcomm:sd_810:-:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": false } ], "operator": "OR" } ], "cpe_match": [], "operator": "AND" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2015-9134" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "The vendor reported these issues.", "sources": [ { "db": "BID", "id": "103671" } ], "trust": 0.3 }, "cve": "CVE-2015-9134", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": true, "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "impactScore": 2.9, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Low", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "None", "baseScore": 5.0, "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2015-9134", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "exploitabilityScore": 10.0, "id": "VHN-87095", "impactScore": 2.9, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:L/AU:N/C:N/I:P/A:N", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "exploitabilityScore": 3.9, "impactScore": 3.6, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "None", "baseScore": 7.5, "baseSeverity": "High", "confidentialityImpact": "None", "exploitabilityScore": null, "id": "CVE-2015-9134", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2015-9134", "trust": 1.8, "value": "HIGH" }, { "author": "CNNVD", "id": "CNNVD-201804-1016", "trust": 0.6, "value": "MEDIUM" }, { "author": "VULHUB", "id": "VHN-87095", "trust": 0.1, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2015-9134", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-87095" }, { "db": "VULMON", "id": "CVE-2015-9134" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 410/12, SD 615/16/SD 415, and SD 810, while processing QSEE Syscall \u0027qsee_macc_gen_ecc_privkey\u0027, untrusted pointer dereference occurs, which could result in arbitrary write. plural Qualcomm Run on product Android Is NULL A vulnerability related to pointer dereference exists.Information may be tampered with. Google Android is prone to multiple unspecified security vulnerabilities. \nLittle is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm SD 410, etc. are the central processing unit (CPU) products of Qualcomm (Qualcomm). A security vulnerability exists in Qualcomm closed-source components in Android versions prior to 2018-04-05. A remote attacker could exploit this vulnerability to perform arbitrary write operations (null pointer backreferences). The following products (for mobile devices) are affected: Qualcomm SD 410/12; SD 615/16; SD 415; SD 810", "sources": [ { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "BID", "id": "103671" }, { "db": "VULHUB", "id": "VHN-87095" }, { "db": "VULMON", "id": "CVE-2015-9134" } ], "trust": 2.07 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2015-9134", "trust": 2.9 }, { "db": "BID", "id": "103671", "trust": 1.5 }, { "db": "JVNDB", "id": "JVNDB-2018-003828", "trust": 0.8 }, { "db": "CNNVD", "id": "CNNVD-201804-1016", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-87095", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2015-9134", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-87095" }, { "db": "VULMON", "id": "CVE-2015-9134" }, { "db": "BID", "id": "103671" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "id": "VAR-201804-0118", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-87095" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T12:02:14.003000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "Android \u306e\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u306b\u95a2\u3059\u308b\u516c\u958b\u60c5\u5831 - 2018 \u5e74 4 \u6708", "trust": 0.8, "url": "https://source.android.com/security/bulletin/2018-04-01" }, { "title": "Android Qualcomm Repair measures for closed source component security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=80372" }, { "title": "Android Security Bulletins: Android Security Bulletin\u2014April 2018", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins\u0026qid=068d787c35ce8cea494780f9a47b5827" } ], "sources": [ { "db": "VULMON", "id": "CVE-2015-9134" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-476", "trust": 1.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-87095" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.1, "url": "https://source.android.com/security/bulletin/2018-04-01" }, { "trust": 1.3, "url": "http://www.securityfocus.com/bid/103671" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-9134" }, { "trust": 0.8, "url": "https://nvd.nist.gov/vuln/detail/cve-2015-9134" }, { "trust": 0.3, "url": "http://code.google.com/android/" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/476.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://source.android.com/security/bulletin/2018-04-01.html" } ], "sources": [ { "db": "VULHUB", "id": "VHN-87095" }, { "db": "VULMON", "id": "CVE-2015-9134" }, { "db": "BID", "id": "103671" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-87095" }, { "db": "VULMON", "id": "CVE-2015-9134" }, { "db": "BID", "id": "103671" }, { "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "db": "NVD", "id": "CVE-2015-9134" }, { "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-04-18T00:00:00", "db": "VULHUB", "id": "VHN-87095" }, { "date": "2018-04-18T00:00:00", "db": "VULMON", "id": "CVE-2015-9134" }, { "date": "2018-04-05T00:00:00", "db": "BID", "id": "103671" }, { "date": "2018-06-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "date": "2018-04-18T14:29:04.247000", "db": "NVD", "id": "CVE-2015-9134" }, { "date": "2018-04-18T00:00:00", "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2018-05-09T00:00:00", "db": "VULHUB", "id": "VHN-87095" }, { "date": "2018-05-09T00:00:00", "db": "VULMON", "id": "CVE-2015-9134" }, { "date": "2018-04-05T00:00:00", "db": "BID", "id": "103671" }, { "date": "2018-06-05T00:00:00", "db": "JVNDB", "id": "JVNDB-2018-003828" }, { "date": "2018-05-09T21:06:58.387000", "db": "NVD", "id": "CVE-2015-9134" }, { "date": "2018-05-29T00:00:00", "db": "CNNVD", "id": "CNNVD-201804-1016" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1016" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "plural Qualcomm Run on product Android In NULL Pointer dereference vulnerability", "sources": [ { "db": "JVNDB", "id": "JVNDB-2018-003828" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "lack of information", "sources": [ { "db": "CNNVD", "id": "CNNVD-201804-1016" } ], "trust": 0.6 } }
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.