CVE-2015-9166

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 820A, SD 835, SD 845, and SD 850, DRM provisioning mechanisms used in QSEE applications have a feature to prevent further provisioning. This is done by creating an SFS file called 'finalize_prov_flag.data' at the end of provisioning. When this feature is enabled, provisioning calls check for the existence of the file in order to decide whether to do provisioning or not. Current implementation allows provisioning without sufficient checks.

• CWE-19

• http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
• https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
• http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
• https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Published

Apr 18, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2015-9160In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9161In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9162In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9163In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9164In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9165In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9167In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9168Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2015-9169In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9170In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9171In Android before 2018-04-05 or earlier security patch level…
• CVE-2015-9172In Android before 2018-04-05 or earlier security patch level…