Critical severity · published Apr 18, 2018
CVE-2015-9220
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531,…
9.8
CVSS
1.2%
EPSS
No
On KEV
Description
In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 810, SD 820, and SDX20, integer overflow occurs when the size of the firmware section is incorrectly encoded in the firmware image.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.2% · higher than 69% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IF
Ipq4019 Firmware · Qualcomm
All versions, or not specified · source: NVD
IF
Ipq8064 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9206 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9607 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9640 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca4531 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6174a Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6574au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6584 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca6584au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qca9377 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-9220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-9220
Third Party Advisory
http://www.securityfocus.com/bid/103671
Vendor Advisory
https://source.android.com/security/bulletin/2018-04-01
More from Ipq4019 Firmware
7.8
CVE-2023-33063
Use After Free in DSP Services
9.8
CVE-2024-21473
Memory corruption while redirecting log file to any file location with any file name
9.8
CVE-2023-33083
Memory corruption in WLAN Host while processing RRM beacon on the AP
9.8
CVE-2023-33082
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE
9.8
CVE-2022-33279
Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length