PT-2018-10934 · Mozilla+2 · Firefox Os+2

Published 2018-12-20 · Updated 2019-01-09 · CVE-2018-11986

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Android for MSM (affected versions not specified) Firefox OS for MSM (affected versions not specified) QRD Android (affected versions not specified)

Description The issue is related to a possible buffer overflow in the TX and RX FIFOs of a microcontroller in the camera subsystem. This microcontroller is used for exchanging commands and messages between Micro FW and CPP driver. The estimated number of potentially affected devices worldwide is not available.

Recommendations For Android for MSM, update to a version that includes a fix for the buffer overflow issue in the camera subsystem. For Firefox OS for MSM, update to a version that includes a fix for the buffer overflow issue in the camera subsystem. For QRD Android, update to a version that includes a fix for the buffer overflow issue in the camera subsystem. As a temporary workaround, consider restricting access to the camera subsystem to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-11986

Affected Products

Android

Firefox Os

Qrd Android

References · 2

• https://codeaurora.org/security-bulletin/2018/12/03/december-2018-code-aurora-security-bulletin · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2018-11986 · Security Note