# |
CVE ID
|
CWE ID
|
# of Exploits
|
Vulnerability Type(s)
|
Publish Date
|
Update Date
|
Score
|
Gained Access Level
|
Access
|
Complexity
|
Authentication
|
Conf.
|
Integ.
|
Avail.
|
47201 |
CVE-2015-9040 |
284 |
|
|
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in a GERAN API. |
47202 |
CVE-2015-9039 |
20 |
|
|
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in eMBMS where an assertion can be reached by a sequence of downlink messages. |
47203 |
CVE-2015-9038 |
476 |
|
|
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a NULL pointer may be dereferenced in the front end. |
47204 |
CVE-2015-9037 |
119 |
|
Overflow |
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlink 3G NAS message. |
47205 |
CVE-2015-9036 |
119 |
|
Overflow |
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, an incorrect length is used to clear a memory buffer resulting in adjacent memory getting corrupted. |
47206 |
CVE-2015-9035 |
119 |
|
Overflow |
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needed potentially resulting in memory exhaustion. |
47207 |
CVE-2015-9034 |
119 |
|
Overflow |
2017-08-18 |
2017-08-23 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
In all Qualcomm products with Android releases from CAF using the Linux kernel, a string can fail to be null-terminated in SIP leading to a buffer overflow. |
47208 |
CVE-2015-9033 |
20 |
|
|
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, a QTEE system call fails to validate a pointer. |
47209 |
CVE-2015-9032 |
200 |
|
+Info |
2017-06-13 |
2017-07-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
In all Android releases from CAF using the Linux kernel, a DRM key was exposed to QTEE applications. |
47210 |
CVE-2015-9031 |
200 |
|
+Info |
2017-06-13 |
2017-07-07 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
In all Android releases from CAF using the Linux kernel, a TZ memory address is exposed to HLOS by HDCP. |
47211 |
CVE-2015-9030 |
306 |
|
Bypass |
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, the Hypervisor API could be misused to bypass authentication. |
47212 |
CVE-2015-9029 |
284 |
|
|
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, a vulnerability exists in the access control settings of modem memory. |
47213 |
CVE-2015-9028 |
119 |
|
Overflow |
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a cryptographic routine. |
47214 |
CVE-2015-9027 |
476 |
|
|
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. |
47215 |
CVE-2015-9026 |
476 |
|
|
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in WideVine DRM. |
47216 |
CVE-2015-9025 |
119 |
|
Overflow |
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in a QTEE application. |
47217 |
CVE-2015-9024 |
284 |
|
|
2017-06-13 |
2017-07-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
Partial |
None |
In all Android releases from CAF using the Linux kernel, some interfaces were improperly exposed to QTEE applications. |
47218 |
CVE-2015-9023 |
119 |
|
Overflow |
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in the PlayReady API. |
47219 |
CVE-2015-9022 |
362 |
|
|
2017-06-13 |
2017-07-07 |
7.6 |
None |
Remote |
High |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, time-of-check Time-of-use (TOCTOU) Race Conditions exist in several TZ APIs. |
47220 |
CVE-2015-9021 |
284 |
|
|
2017-06-13 |
2017-07-07 |
4.3 |
None |
Remote |
Medium |
Not required |
None |
None |
Partial |
In all Android releases from CAF using the Linux kernel, access control to SMEM memory was not enabled. |
47221 |
CVE-2015-9020 |
476 |
|
|
2017-06-13 |
2017-07-07 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In all Android releases from CAF using the Linux kernel, an untrusted pointer dereference vulnerability exists in the unlocking of memory. |
47222 |
CVE-2015-9019 |
330 |
|
|
2017-04-05 |
2017-04-11 |
5.0 |
None |
Remote |
Low |
Not required |
Partial |
None |
None |
In libxslt 1.1.29 and earlier, the EXSLT math.random function was not initialized with a random seed during startup, which could cause usage of this function to produce predictable outputs. |
47223 |
CVE-2015-9016 |
362 |
|
|
2018-04-05 |
2018-05-02 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
In blk_mq_tag_to_rq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blk_mq_complete_request. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046. |
47224 |
CVE-2015-9015 |
264 |
|
|
2018-04-04 |
2018-05-04 |
7.2 |
None |
Local |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714120. |
47225 |
CVE-2015-9014 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393750. |
47226 |
CVE-2015-9013 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393251. |
47227 |
CVE-2015-9012 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384691. |
47228 |
CVE-2015-9011 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36714882. |
47229 |
CVE-2015-9010 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393101. |
47230 |
CVE-2015-9009 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36393600. |
47231 |
CVE-2015-9008 |
264 |
|
|
2018-04-04 |
2018-05-08 |
10.0 |
None |
Remote |
Low |
Not required |
Complete |
Complete |
Complete |
An elevation of privilege vulnerability in Qualcomm closed source components. Product: Android. Versions: Android kernel. Android ID: A-36384689. |
47232 |
CVE-2015-9007 |
415 |
|
|
2017-06-06 |
2017-06-08 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. |
47233 |
CVE-2015-9006 |
284 |
|
|
2017-06-06 |
2017-06-09 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could potentially exist. |
47234 |
CVE-2015-9005 |
190 |
|
Overflow |
2017-06-06 |
2017-06-08 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially exist. |
47235 |
CVE-2015-9004 |
264 |
|
+Priv |
2017-05-02 |
2017-05-12 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted application, related to the perf_pmu_register and perf_event_open functions. |
47236 |
CVE-2015-9003 |
310 |
|
|
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone a cryptographic issue can potentially occur in all Android releases from CAF using the Linux kernel. |
47237 |
CVE-2015-9002 |
189 |
|
|
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone an out-of-range pointer offset vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. |
47238 |
CVE-2015-9001 |
200 |
|
+Info |
2017-05-16 |
2017-07-10 |
4.3 |
None |
Remote |
Medium |
Not required |
Partial |
None |
None |
In TrustZone an information exposure vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
47239 |
CVE-2015-9000 |
476 |
|
|
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone an untrusted pointer dereference vulnerability can potentially occur in a DRM routine in all Android releases from CAF using the Linux kernel. |
47240 |
CVE-2015-8999 |
119 |
|
Overflow |
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone a buffer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel while loading an ELF file. |
47241 |
CVE-2015-8998 |
190 |
|
Overflow |
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
47242 |
CVE-2015-8997 |
362 |
|
|
2017-05-16 |
2017-07-10 |
7.6 |
None |
Remote |
High |
Not required |
Complete |
Complete |
Complete |
In TrustZone a time-of-check time-of-use race condition could potentially exist in a listener routine in all Android releases from CAF using the Linux kernel. |
47243 |
CVE-2015-8996 |
362 |
|
|
2017-05-16 |
2017-07-10 |
7.6 |
None |
Remote |
High |
Not required |
Complete |
Complete |
Complete |
In TrustZone a time-of-check time-of-use race condition could potentially exist in a QFPROM routine in all Android releases from CAF using the Linux kernel. |
47244 |
CVE-2015-8995 |
190 |
|
Overflow |
2017-05-16 |
2017-07-10 |
9.3 |
None |
Remote |
Medium |
Not required |
Complete |
Complete |
Complete |
In TrustZone an integer overflow vulnerability can potentially occur in all Android releases from CAF using the Linux kernel. |
47245 |
CVE-2015-8994 |
264 |
|
+Priv |
2017-03-02 |
2017-03-16 |
6.8 |
None |
Remote |
Medium |
Not required |
Partial |
Partial |
Partial |
An issue was discovered in PHP 5.x and 7.x, when the configuration uses apache2handler/mod_php or php-fpm with OpCache enabled. With 5.x after 5.6.28 or 7.x after 7.0.13, the issue is resolved in a non-default configuration with the opcache.validate_permission=1 setting. The vulnerability details are as follows. In PHP SAPIs where PHP interpreters share a common parent process, Zend OpCache creates a shared memory object owned by the common parent during initialization. Child PHP processes inherit the SHM descriptor, using it to cache and retrieve compiled script bytecode ("opcode" in PHP jargon). Cache keys vary depending on configuration, but filename is a central key component, and compiled opcode can generally be run if a script's filename is known or can be guessed. Many common shared-hosting configurations change EUID in child processes to enforce privilege separation among hosted users (for example using mod_ruid2 for the Apache HTTP Server, or php-fpm user settings). In these scenarios, the default Zend OpCache behavior defeats script file permissions by sharing a single SHM cache among all child PHP processes. PHP scripts often contain sensitive information: Think of CMS configurations where reading or running another user's script usually means gaining privileges to the CMS database. |
47246 |
CVE-2015-8993 |
264 |
|
|
2017-03-14 |
2017-03-28 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
Malicious file execution vulnerability in Intel Security CloudAV (Beta) before 0.5.0.151.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation. |
47247 |
CVE-2015-8992 |
264 |
|
|
2017-03-14 |
2017-03-23 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
Malicious file execution vulnerability in Intel Security WebAdvisor before 4.0.2, 4.0.1 and 3.7.2 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation. |
47248 |
CVE-2015-8991 |
264 |
|
|
2017-03-14 |
2017-03-28 |
6.9 |
None |
Local |
Medium |
Not required |
Complete |
Complete |
Complete |
Malicious file execution vulnerability in Intel Security McAfee Security Scan+ (MSS+) before 3.11.266.3 allows attackers to make the product momentarily vulnerable via executing preexisting specifically crafted malware during installation or uninstallation, but not during normal operation. |
47249 |
CVE-2015-8990 |
254 |
|
Bypass |
2017-03-14 |
2017-03-23 |
5.0 |
None |
Remote |
Low |
Not required |
None |
Partial |
None |
Detection bypass vulnerability in Intel Security Advanced Threat Defense (ATD) 3.4.6 and earlier allows malware samples to bypass ATD detection via renaming the malware. |
47250 |
CVE-2015-8989 |
310 |
|
|
2017-03-14 |
2017-03-22 |
4.0 |
None |
Remote |
Low |
Single system |
Partial |
None |
None |
Unsalted password vulnerability in the Enterprise Manager (web portal) component in Intel Security McAfee Vulnerability Manager (MVM) 7.5.8 and earlier allows attackers to more easily decrypt user passwords via brute force attacks against the database. |