PT-2020-9467 · Qualcomm · Snapdragon Wearables+7

Published 2020-02-07 · Updated 2020-02-10 · CVE-2019-14040

Positive Technologies (AI Summary)

CVSS v2.0

4.6

Medium

Base vector

AV:L/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions (affected versions not specified)

Description: The issue is related to the use of memory after it has been freed in the qsee component due to a wrong implementation. This can lead to unexpected behavior, including the execution of unknown code. The affected products include Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wearables. The estimated number of potentially affected devices is not provided.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2019-14040

Affected Products

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

References · 3

• 🔥 https://github.com/tamirzb/CVE-2019-14040 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-14040 · Security Note
• https://qualcomm.com/company/product-security/bulletins/february-2020-bulletin · Vendor Advisory