Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-9150: Qualcomm Snapdragon firmware may cause memory overflow

CVE-2015-9150 · published 8 years ago

Summary

Certain Qualcomm Snapdragon firmware versions for mobile devices can miscalculate the size of a memory buffer, leading to an overflow. This could let malicious code write outside intended memory areas, potentially compromising the device. Update the firmware to a version released after April 5 2018 to fix the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
qualcomm	mdm9625_firmware	All versions `cpe:2.3:o:qualcomm:mdm9625_firmware:-:::::::*`
qualcomm	mdm9635m_firmware	All versions `cpe:2.3:o:qualcomm:mdm9635m_firmware:-:::::::*`
qualcomm	sd_400_firmware	All versions `cpe:2.3:o:qualcomm:sd_400_firmware:-:::::::*`
qualcomm	sd_800_firmware	All versions `cpe:2.3:o:qualcomm:sd_800_firmware:-:::::::*`

Original advisory text

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625, MDM9635M, SD 400, and SD 800, while computing the length of memory allocated for a Diag event, if the buffer length is very small or greater than the maximum, an integer overflow may occur, which later results in a buffer overflow.

References

http://www.securityfocus.com/bid/103671 Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2018-04-01 Vendor Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-119Buffer Overflow

CWE-190Integer Overflow

Timeline

Published18 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-9150 · NVD

Track software like this

Free during beta