CVE-2017-18277

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

When dynamic memory allocation fails, currently the process sleeps for one second and continues with infinite loop without retrying for memory allocation in Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835.

Metrics

CVSS 3.0 5.5/10CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear	MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, QCN5502, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835

References

https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-componentsThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-componentsThird Party Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: Oct 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-182787.8An integer underflow may occur due to lack of check when received data length from font_mgr_qsee_request_service is bigger than the minimal CVE-2017-182797.8Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon CVE-2017-182807.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 4 CVE-2017-182815.5A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android CVE-2017-182827.8Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version M CVE-2017-182836.5Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212 CVE-2017-182847.1The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local u CVE-2017-182857.1The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to CVE-2017-182865.4nZEDb v0.7.3.3 has XSS in the 404 error page.CVE-2017-182879.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter.CVE-2017-182889.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter.CVE-2017-182899.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter.