PT-2020-9462 · Qualcomm · Snapdragon Industrial Iot+16

Published 2020-01-21 · Updated 2020-01-24 · CVE-2019-14036

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions (affected versions not specified)

Description: The issue is related to a possible buffer overflow in error processing due to improper validation of an array index value. This affects various Qualcomm Snapdragon products, including Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wired Infrastructure and Networking, in specific chipsets such as APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9607, MDM9615, MDM9640, MSM8996AU, and QCN7605.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Validation of Array Index

Weakness Enumeration

CWE-129

Related Identifiers

CVE-2019-14036

Affected Products

Apq8064

Apq8096Au

Ipq4019

Ipq8064

Ipq8074

Mdm9607

Mdm9615

Mdm9640

Msm8996Au

Qcn7605

Snapdragon Auto

Snapdragon Consumer Electronics Connectivity

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wired Infrastructure/Networking

References · 2

• https://qualcomm.com/company/product-security/bulletins/january-2020-bulletin · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14036 · Security Note