Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2016-10415: Qualcomm Snapdragon firmware can cause device crash

CVE-2016-10415 · published 8 years ago

Summary

Certain Qualcomm Snapdragon mobile and wear‑able firmware versions may stop working if they receive bad data. This can make the device become unresponsive, requiring a restart. Update the firmware to a version released after April 5 2018 to prevent the issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
qualcomm	mdm9206_firmware	All versions `cpe:2.3:o:qualcomm:mdm9206_firmware:-:::::::*`
qualcomm	mdm9607_firmware	All versions `cpe:2.3:o:qualcomm:mdm9607_firmware:-:::::::*`
qualcomm	mdm9640_firmware	All versions `cpe:2.3:o:qualcomm:mdm9640_firmware:-:::::::*`
qualcomm	mdm9650_firmware	All versions `cpe:2.3:o:qualcomm:mdm9650_firmware:-:::::::*`
qualcomm	msm8909w_firmware	All versions `cpe:2.3:o:qualcomm:msm8909w_firmware:-:::::::*`
qualcomm	sd_210_firmware	All versions `cpe:2.3:o:qualcomm:sd_210_firmware:-:::::::*`
qualcomm	sd_212_firmware	All versions `cpe:2.3:o:qualcomm:sd_212_firmware:-:::::::*`
qualcomm	sd_205_firmware	All versions `cpe:2.3:o:qualcomm:sd_205_firmware:-:::::::*`
qualcomm	sd_400_firmware	All versions `cpe:2.3:o:qualcomm:sd_400_firmware:-:::::::*`
qualcomm	sd_410_firmware	All versions `cpe:2.3:o:qualcomm:sd_410_firmware:-:::::::*`
qualcomm	sd_412_firmware	All versions `cpe:2.3:o:qualcomm:sd_412_firmware:-:::::::*`
qualcomm	sd_425_firmware	All versions `cpe:2.3:o:qualcomm:sd_425_firmware:-:::::::*`
qualcomm	sd_430_firmware	All versions `cpe:2.3:o:qualcomm:sd_430_firmware:-:::::::*`
qualcomm	sd_450_firmware	All versions `cpe:2.3:o:qualcomm:sd_450_firmware:-:::::::*`
qualcomm	sd_615_firmware	All versions `cpe:2.3:o:qualcomm:sd_615_firmware:-:::::::*`
qualcomm	sd_616_firmware	All versions `cpe:2.3:o:qualcomm:sd_616_firmware:-:::::::*`
qualcomm	sd_415_firmware	All versions `cpe:2.3:o:qualcomm:sd_415_firmware:-:::::::*`
qualcomm	sd_617_firmware	All versions `cpe:2.3:o:qualcomm:sd_617_firmware:-:::::::*`
qualcomm	sd_625_firmware	All versions `cpe:2.3:o:qualcomm:sd_625_firmware:-:::::::*`
qualcomm	sd_650_firmware	All versions `cpe:2.3:o:qualcomm:sd_650_firmware:-:::::::*`
qualcomm	sd_652_firmware	All versions `cpe:2.3:o:qualcomm:sd_652_firmware:-:::::::*`
qualcomm	sd_800_firmware	All versions `cpe:2.3:o:qualcomm:sd_800_firmware:-:::::::*`
qualcomm	sd_808_firmware	All versions `cpe:2.3:o:qualcomm:sd_808_firmware:-:::::::*`
qualcomm	sd_810_firmware	All versions `cpe:2.3:o:qualcomm:sd_810_firmware:-:::::::*`
qualcomm	sd_820_firmware	All versions `cpe:2.3:o:qualcomm:sd_820_firmware:-:::::::*`
qualcomm	sd_835_firmware	All versions `cpe:2.3:o:qualcomm:sd_835_firmware:-:::::::*`
qualcomm	sd_600_firmware	All versions `cpe:2.3:o:qualcomm:sd_600_firmware:-:::::::*`
qualcomm	sdx20_firmware	All versions `cpe:2.3:o:qualcomm:sdx20_firmware:-:::::::*`

Original advisory text

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, dereference of an invalid input parameter could cause a denial of service.

References

http://www.securityfocus.com/bid/103671 Third Party Advisory VDB Entry
https://source.android.com/security/bulletin/2018-04-01 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published18 Apr 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2016-10415 · NVD

Track software like this

Free during beta