CVE-2015-9221

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, SD 800, and SD 810, lack of validation of pointers passed by secure apps could lead to an untrusted pointer dereference.

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Mobile	SD 400, SD 800, SD 810

References

http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Timeline

Published: Apr 18, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-92227.5In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 20 CVE-2015-92239.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9615, MDM9625, MDM9635M, SD 400, SD 600, and S CVE-2015-92249.8In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear, and Smal CVE-2015-92267.2Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download pa CVE-2015-92277.2PHP remote file inclusion vulnerability in the get_file function in upload/admin2/controller/report_logs.php in AlegroCart 1.2.8 allows remo CVE-2015-92288.8In post-new.php in the Photocrati NextGEN Gallery plugin 2.1.10 for WordPress, unrestricted file upload is available via the name parameter,CVE-2015-92294.8In the nggallery-manage-gallery page in the Photocrati NextGEN Gallery plugin 2.1.15 for WordPress, XSS is possible for remote authenticated CVE-2015-92304.8In the admin/db-backup-security/db-backup-security.php page in the BulletProof Security plugin before .52.5 for WordPress, XSS is possible f CVE-2015-92317.5iTerm2 3.x before 3.1.1 allows remote attackers to discover passwords by reading DNS queries. A new (default) feature was added to iTerm2 ve CVE-2015-92325.3The Good for Enterprise application 3.0.0.415 for Android does not use signature protection for its Authentication Delegation API intent. Al CVE-2015-92338.8The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to CVE-2015-92347.2The cp-contact-form-with-paypal (aka CP Contact Form with PayPal) plugin before 1.1.6 for WordPress has SQL injection via the cp_contactform