CVE-2017-18279

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Lack of check of buffer length before copying can lead to buffer overflow in camera module in Small Cell SoC, Snapdragon Mobile, Snapdragon Wear in FSM9055, FSM9955, IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA9531, QCA9558, QCA9563, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 800, SD 810, SD 820, SD 835, SDM630, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-190

Affected software

Vendor	Product	Versions
Qualcomm Technologies, Inc.	Small Cell SoC, Snapdragon Mobile, Snapdragon Wear	FSM9055; FSM9955; IPQ4019; IPQ8064; MDM9206; MDM9607; MDM9640; MDM9650; MSM8909W; MSM8996AU; QCA9531; QCA9558; QCA9563; QCA9880; QCA9886; QCA9980; SD 210/SD 212/SD 205; SD 425; SD 427; SD 430

References

https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: May 6, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-182807.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 4 CVE-2017-182815.5A bool variable in Video function, which gets typecasted to int before being read could result in an out of bound read access in all Android CVE-2017-182827.8Non-secure SW can cause SDCC to generate secure bus accesses, which may expose RPM access in Snapdragon Mobile, Snapdragon Wear in version M CVE-2017-182836.5Possible memory corruption when Read Val Blob Req is received with invalid parameters in Snapdragon Mobile in version QCA9379, SD 210/SD 212 CVE-2017-182847.1The Gentoo app-backup/burp package before 2.1.32 sets the ownership of the PID file directory to the burp account, which might allow local u CVE-2017-182857.1The Gentoo app-backup/burp package before 2.1.32 has incorrect group ownership of the /etc/burp directory, which might allow local users to CVE-2017-182865.4nZEDb v0.7.3.3 has XSS in the 404 error page.CVE-2017-182879.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the POST user_search parameter.CVE-2017-182889.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET game parameter.CVE-2017-182899.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exist in ladder/stats.php via the GET type parameter.CVE-2017-182909.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET sort_direction parameter.CVE-2017-182919.8An issue was discovered in PvPGN Stats 2.4.6. SQL Injection exists in ladder/stats.php via the GET user parameter.