CVE-2014-10057

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, and Snapdragon_High_Med_2016, binary Calibration files under data/misc/audio have 777 permissions.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Mobile	MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 400, SD 425, SD 430, SD 435, SD 617, SD 625, Snapdragon_High_Med_2016

References

http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Timeline

Published: Apr 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-100587.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 425, SD 427, SD CVE-2014-100599.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, SD 210/SD 212/SD 205, SD 400, a CVE-2014-100627.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MD CVE-2014-100637.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown CVE-2014-100647.5The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply ne CVE-2014-100656.1Certain input when passed into remarkable before 1.4.1 will bypass the bad protocol check that disallows the javascript: scheme allowing for CVE-2014-100667.5Versions less than 0.1.4 of the static file server module fancy-server are vulnerable to directory traversal. An attacker can provide input CVE-2014-100675.9paypal-ipn before 3.0.0 uses the `test_ipn` parameter (which is set by the PayPal IPN simulator) to determine if it should use the productio CVE-2014-100687.5The inert directory handler in inert node module before 1.1.1 always allows files in hidden directories to be served, even when `showHidden`CVE-2014-100697.5Hitron CVE-30360 devices use a 578A958E3DD933FC DES key that is shared across different customers' installations, which makes it easier for CVE-2014-100707.8zsh before 5.0.7 allows evaluation of the initial values of integer variables imported from the environment (instead of treating them as lit CVE-2014-100719.8In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax.