PT-2020-12589 · Qualcomm · Snapdragon Industrial Iot+3

Published 2020-11-12 · Updated 2020-11-19 · CVE-2020-11184

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon versions QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P

Description A possible buffer overflow issue occurs when parsing a crafted mp4 clip with a specifically designed esds atom size in video. This issue affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Industrial IOT, and Snapdragon Mobile.

Recommendations For Qualcomm Snapdragon versions QCM4290, QCS4290, QM215, QSM8350, SA6145P, SA6155, SA6155P, SA8155, SA8155P, SDX55, SDX55M, SM4250, SM4250P, SM6115, SM6115P, SM6125, SM6250, SM6350, SM7125, SM7225, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

CVE-2020-11184

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Industrial Iot

Snapdragon Mobile

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2020-11184 · Security Note
• https://qualcomm.com/company/product-security/bulletins/november-2020-bulletin · Vendor Advisory