Lucene search

[email protected]CVE-2020-11184

HistoryNov 12, 2020 - 10:15 a.m.

CVE-2020-11184

2020-11-1210:15:12

CWE-190

[email protected]

web.nvd.nist.gov

cve-2020-11184

buffer overflow

video parsing

mp4

esds atom

snapdragon auto

snapdragon compute

snapdragon industrial iot

snapdragon mobile

nvd

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.5%

JSON

u’Possible buffer overflow will occur in video while parsing mp4 clip with crafted esds atom size.’ in Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile in QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P

Affected configurations

NVD

Node

qualcommqcm4290_firmwareMatch-

AND

qualcommqcm4290Match-

Node

qualcommqcs4290_firmwareMatch-

AND

qualcommqcs4290Match-

Node

qualcommqm215_firmwareMatch-

AND

qualcommqm215Match-

Node

qualcommqsm8350_firmwareMatch-

AND

qualcommqsm8350Match-

Node

qualcommsa6145p_firmwareMatch-

AND

qualcommsa6145pMatch-

Node

qualcommsa6155_firmwareMatch-

AND

qualcommsa6155Match-

Node

qualcommsa6155p_firmwareMatch-

AND

qualcommsa6155pMatch-

Node

qualcommsa8155_firmwareMatch-

AND

qualcommsa8155Match-

Node

qualcommsa8155p_firmwareMatch-

AND

qualcommsa8155pMatch-

Node

qualcommsdx55_firmwareMatch-

AND

qualcommsdx55Match-

Node

qualcommsdx55m_firmwareMatch-

AND

qualcommsdx55mMatch-

Node

qualcommsm4250_firmwareMatch-

AND

qualcommsm4250Match-

Node

qualcommsm4250p_firmwareMatch-

AND

qualcommsm4250pMatch-

Node

qualcommsm6115_firmwareMatch-

AND

qualcommsm6115Match-

Node

qualcommsm6115p_firmwareMatch-

AND

qualcommsm6115pMatch-

Node

qualcommsm6125_firmwareMatch-

AND

qualcommsm6125Match-

Node

qualcommsm6250_firmwareMatch-

AND

qualcommsm6250Match-

Node

qualcommsm6350_firmwareMatch-

AND

qualcommsm6350Match-

Node

qualcommsm7125_firmwareMatch-

AND

qualcommsm7125Match-

Node

qualcommsm7225_firmwareMatch-

AND

qualcommsm7225Match-

Node

qualcommsm7250_firmwareMatch-

AND

qualcommsm7250Match-

Node

qualcommsm7250p_firmwareMatch-

AND

qualcommsm7250pMatch-

Node

qualcommsm8150_firmwareMatch-

AND

qualcommsm8150Match-

Node

qualcommsm8150p_firmwareMatch-

AND

qualcommsm8150pMatch-

Node

qualcommsm8250_firmwareMatch-

AND

qualcommsm8250Match-

Node

qualcommsm8350_firmwareMatch-

AND

qualcommsm8350Match-

Node

qualcommsm8350p_firmwareMatch-

AND

qualcommsm8350pMatch-

Node

qualcommsxr2130_firmwareMatch-

AND

qualcommsxr2130Match-

Node

qualcommsxr2130p_firmwareMatch-

AND

qualcommsxr2130pMatch-

CPENameOperatorVersion
qualcomm:qcm4290_firmwarequalcomm qcm4290 firmwareeq-

CPE	Name	Operator	Version
qualcomm:qcm4290_firmware	qualcomm qcm4290 firmware	eq	-

CNA Affected

[
  {
    "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mobile",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins/november-2020-bulletin

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.6 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

59.5%

JSON

Related for CVE-2020-11184

prion1 cvelist1 nvd1