PT-2020-9477 · Qualcomm · Sda660+31

Published 2020-03-05 · Updated 2020-03-06 · CVE-2019-14050

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions (affected versions not specified)

Description: Out-of-bound writes occur due to a lack of check of buffer size, causing buffer overflow, but only in 32-bit architecture. This issue affects various Snapdragon products, including Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, and Snapdragon Wired Infrastructure and Networking, in multiple chipsets such as APQ8009, MDM9150, MDM9205, MDM9607, MDM9650, MSM8905, Nicobar, QCS405, QCS605, Rennell, SA6155P, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, and SXR1130.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2019-14050

Affected Products

Apq8009

Mdm9150

Mdm9205

Mdm9607

Mdm9650

Msm8905

Nicobar

Qcs405

Qcs605

Rennell

Sa6155P

Sda660

Sda845

Sdm630

Sdm636

Sdm660

Sdm670

Sdm710

Sdm845

Sdm850

Sdx24

Sm6150

Sm7150

Sm8150

Sxr1130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wired Infrastructure/Networking

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-14050 · Security Note
• https://qualcomm.com/company/product-security/bulletins/march-2020-bulletin · Vendor Advisory
• https://t.me/cvenotify/1364 · Telegram Post