CVE-2014-10055

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, there could be leakage of protected contents if HLOS doesn't request for security restoration for OCMEM xPU's.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Mobile	SD 400, SD 800

References

http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Timeline

Published: Apr 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-100569.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, A buffer overflow can poten CVE-2014-100579.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD CVE-2014-100587.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD CVE-2014-100599.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, a CVE-2014-100627.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MD CVE-2014-100637.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown CVE-2014-100647.5The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply ne CVE-2014-100656.1Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for CVE-2014-100667.5Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input CVE-2014-100675.9paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productio CVE-2014-100687.5The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`CVE-2014-100697.5Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for