Lucene search

QualcommCVE-2019-14030

HistoryMar 05, 2020 - 9:15 a.m.

CVE-2019-14030

2020-03-0509:15:16

CWE-120

qualcomm

web.nvd.nist.gov

cve-2019-14030

buffer overflow

snapdragon

security vulnerability

nvd

size overflow

bound check

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

12.6%

JSON

The size of a buffer is determined by addition and multiplications operations that have the potential to overflow due to lack of bound check in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, Rennell, SC8180X, SDM845, SDM850, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130

Affected configurations

Nvd

Node

qualcommmdm9205_firmwareMatch-

AND

qualcommmdm9205Match-

Node

qualcommqcs404_firmwareMatch-

AND

qualcommqcs404Match-

Node

qualcommrennell_firmwareMatch-

AND

qualcommrennellMatch-

Node

qualcommsc8180x_firmwareMatch-

AND

qualcommsc8180xMatch-

Node

qualcommsdm845_firmwareMatch-

AND

qualcommsdm845Match-

Node

qualcommsdm850_firmwareMatch-

AND

qualcommsdm850Match-

Node

qualcommsdx55_firmwareMatch-

AND

qualcommsdx55Match-

Node

qualcommsm6150_firmwareMatch-

AND

qualcommsm6150Match-

Node

qualcommsm7150_firmwareMatch-

AND

qualcommsm7150Match-

Node

qualcommsm8150_firmwareMatch-

AND

qualcommsm8150Match-

Node

qualcommsm8250_firmwareMatch-

AND

qualcommsm8250Match-

Node

qualcommsxr2130_firmwareMatch-

AND

qualcommsxr2130Match-

VendorProductVersionCPE
qualcommmdm9205_firmware-cpe:2.3:o:qualcomm:mdm9205_firmware:-:*:*:*:*:*:*:*
qualcommmdm9205-cpe:2.3:h:qualcomm:mdm9205:-:*:*:*:*:*:*:*
qualcommqcs404_firmware-cpe:2.3:o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:*
qualcommqcs404-cpe:2.3:h:qualcomm:qcs404:-:*:*:*:*:*:*:*
qualcommrennell_firmware-cpe:2.3:o:qualcomm:rennell_firmware:-:*:*:*:*:*:*:*
qualcommrennell-cpe:2.3:h:qualcomm:rennell:-:*:*:*:*:*:*:*
qualcommsc8180x_firmware-cpe:2.3:o:qualcomm:sc8180x_firmware:-:*:*:*:*:*:*:*
qualcommsc8180x-cpe:2.3:h:qualcomm:sc8180x:-:*:*:*:*:*:*:*
qualcommsdm845_firmware-cpe:2.3:o:qualcomm:sdm845_firmware:-:*:*:*:*:*:*:*
qualcommsdm845-cpe:2.3:h:qualcomm:sdm845:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	mdm9205_firmware	-	cpe:2.3:o:qualcomm:mdm9205_firmware:-:::::::*
qualcomm	mdm9205	-	cpe:2.3:h:qualcomm:mdm9205:-:::::::*
qualcomm	qcs404_firmware	-	cpe:2.3:o:qualcomm:qcs404_firmware:-:::::::*
qualcomm	qcs404	-	cpe:2.3:h:qualcomm:qcs404:-:::::::*
qualcomm	rennell_firmware	-	cpe:2.3:o:qualcomm:rennell_firmware:-:::::::*
qualcomm	rennell	-	cpe:2.3:h:qualcomm:rennell:-:::::::*
qualcomm	sc8180x_firmware	-	cpe:2.3:o:qualcomm:sc8180x_firmware:-:::::::*
qualcomm	sc8180x	-	cpe:2.3:h:qualcomm:sc8180x:-:::::::*
qualcomm	sdm845_firmware	-	cpe:2.3:o:qualcomm:sdm845_firmware:-:::::::*
qualcomm	sdm845	-	cpe:2.3:h:qualcomm:sdm845:-:::::::*

Rows per page:

1-10 of 241

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "MDM9205, QCS404, Rennell, SC8180X, SDM845, SDM850, SDX55, SM6150, SM7150, SM8150, SM8250, SXR2130"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin

CVSS2

7.2

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

7.9

Confidence

High

EPSS

Percentile

12.6%

JSON

Related for CVE-2019-14030