← Back

CVE-2019-10606

nvd nist
Published: Jan 21, 2020Modified: Nov 21, 2024

JSON object

Loading...
7.8
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Exploitability: 1.8 / Impact: 5.9
Source: NVD

Description

Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, QCS605, SDX24

Affected (8)

Qualcomm
8 products
Mdm9607 Firmware
Msm8909w Firmware
Msm8917 Firmware
Msm8920 Firmware
Msm8937 Firmware
Msm8940 Firmware
Qcs605 Firmware
Sdx24 Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Mdm9607 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Mdm9607
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msm8909w Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Msm8909w
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msm8917 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Msm8917
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msm8920 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Msm8920
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msm8937 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Msm8937
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Msm8940 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Msm8940
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Qcs605 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Qcs605
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Sdx24 Firmware
All versions
Running on/withPlatform Versions
Qualcomm
Sdx24
All versions

Related CWEs

CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.

References (2)

Source: product-security@qualcomm.com
PatchVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchVendor Advisory

Timeline

No history available yet.