CVE-2017-18160

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

AGPS session failure in GNSS module due to cyphersuites are hardcoded and needed manual update everytime in snapdragon mobile and snapdragon wear in versions MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850

Metrics

CVSS 3.0 9.8/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Mobile, Snapdragon Wear	MDM9635M, MDM9645, MDM9650, MDM9655, MSM8909W, SD 835, SD 845, SD 850

References

http://www.securityfocus.com/bid/106128Third Party Advisory, VDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
http://www.securityfocus.com/bid/106128Third Party Advisory, VDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: Jan 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-181695.5User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android for MSM, Firefox OS CVE-2017-181708.8Improper input validation in Bluetooth Controller function can lead to possible memory corruption in Snapdragon Mobile in version QCA9379, S CVE-2017-181718.8Improper input validation for GATT data packet received in Bluetooth Controller function can lead to possible memory corruption in Snapdrago CVE-2017-181727.8In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer Overflo CVE-2017-181737.8In case of using an invalid android verified boot signature with very large length, an integer underflow occurs in Snapdragon Mobile in SD 4 CVE-2017-181749.8In the Linux kernel before 4.7, the amd_gpio_remove function in drivers/pinctrl/pinctrl-amd.c calls the pinctrl_unregister function, leading CVE-2017-181755.4Progress Sitefinity 9.1 has XSS via the Content Management Template Configuration (aka Templateconfiguration), as demonstrated by the src at CVE-2017-181765.4Progress Sitefinity 9.1 has XSS via file upload, because JavaScript code in an HTML file has the same origin as the application's own code. CVE-2017-181775.4Progress Sitefinity 9.1 has XSS via the Last name, First name, and About fields on the New User Creation Page. This is fixed in 10.1.CVE-2017-181786.1Authenticate/SWT in Progress Sitefinity 9.1 has an open redirect issue in which an authentication token is sent to the redirection target, i CVE-2017-181798.8Progress Sitefinity 9.1 uses wrap_access_token as a non-expiring authentication token that remains valid after a password change or a sessio CVE-2017-181835.5An issue was discovered in QPDF before 7.0.0. There is an infinite loop in the QPDFWriter::enqueueObject() function in libqpdf/QPDFWriter.cc