Improper Bound Vulnerability in Qualcomm Android LTE Products
CVE-2015-9046

9.8CRITICAL

Key Information:

Vendor: Qualcomm
Status: All Qualcomm Products
Vendor: CVE Published:; 18 August 2017

Summary

A vulnerability exists in Qualcomm's LTE implementation within Android releases from the Code Aurora Forum (CAF) using the Linux kernel. The issue arises due to improper bounds on the size of a frequency list, which can lead to an assertion in the system. This flaw can potentially allow attackers to manipulate the frequency list sizes improperly, leading to unintended behaviors in LTE communications.

Affected Version(s)

All Qualcomm products All Android releases from CAF using the Linux kernel

References

https://source.android.com/security/bulletin/2017-07-01

x_refsource_CONFIRM

http://www.securityfocus.com/bid/99467

vdb-entryx_refsource_BID

CVSS V3.1

Score:

9.8

Severity:

CRITICAL

Confidentiality:

High

Integrity:

High

Availability:

High

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Aug 18, 2017
Vulnerability Reserved
Apr 18, 2017