PT-2020-9487 · Qualcomm · Qcm2150+62

Published 2020-06-22 · Updated 2020-06-26 · CVE-2019-14062

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Snapdragon Auto (affected versions not specified) Snapdragon Compute (affected versions not specified) Snapdragon Consumer IOT (affected versions not specified) Snapdragon Industrial IOT (affected versions not specified) Snapdragon IoT (affected versions not specified) Snapdragon Mobile (affected versions not specified) Snapdragon Voice & Music (affected versions not specified) Snapdragon Wearables (affected versions not specified) APQ8009 (affected versions not specified) APQ8017 (affected versions not specified) APQ8053 (affected versions not specified) APQ8076 (affected versions not specified) APQ8096 (affected versions not specified) APQ8096AU (affected versions not specified) APQ8098 (affected versions not specified) Kamorta (affected versions not specified) MDM9150 (affected versions not specified) MDM9205 (affected versions not specified) MDM9206 (affected versions not specified) MDM9207C (affected versions not specified) MDM9607 (affected versions not specified) MDM9625 (affected versions not specified) MDM9635M (affected versions not specified) MDM9640 (affected versions not specified) MDM9645 (affected versions not specified) MDM9650 (affected versions not specified) MDM9655 (affected versions not specified) MSM8905 (affected versions not specified) MSM8909 (affected versions not specified) MSM8909W (affected versions not specified) MSM8917 (affected versions not specified) MSM8920 (affected versions not specified) MSM8937 (affected versions not specified) MSM8940 (affected versions not specified) MSM8953 (affected versions not specified) MSM8996AU (affected versions not specified) MSM8998 (affected versions not specified) Nicobar (affected versions not specified) QCM2150 (affected versions not specified) QCS605 (affected versions not specified) QM215 (affected versions not specified) Rennell (affected versions not specified) SA415M (affected versions not specified) SC7180 (affected versions not specified) SC8180X (affected versions not specified) SDA660 (affected versions not specified) SDA845 (affected versions not specified) SDM429 (affected versions not specified) SDM429W (affected versions not specified) SDM439 (affected versions not specified) SDM450 (affected versions not specified) SDM630 (affected versions not specified) SDM632 (affected versions not specified) SDM636 (affected versions not specified) SDM660 (affected versions not specified) SDM670 (affected versions not specified) SDM710 (affected versions not specified) SDM845 (affected versions not specified) SDM850 (affected versions not specified) SDX20 (affected versions not specified) SDX24 (affected versions not specified) SM6150 (affected versions not specified) SM7150 (affected versions not specified) SM8150 (affected versions not specified) SXR1130 (affected versions not specified)

Description: Buffer overflows occur while decoding setup messages from the network due to a lack of check of IE message length received from the network. This issue affects various Snapdragon products, including Auto, Compute, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, and Wearables, as well as multiple chipsets.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2019-14062

Affected Products

Apq8009

Apq8017

Apq8053

Apq8076

Apq8096

Apq8096Au

Apq8098

Kamorta

Mdm9150

Mdm9205

Mdm9206

Mdm9207C

Mdm9607

Mdm9625

Mdm9635M

Mdm9640

Mdm9645

Mdm9650

Mdm9655

Msm8905

Msm8909W

Msm8917

Msm8920

Msm8937

Msm8940

Msm8953

Msm8996Au

Msm8998

Nicobar

Qcm2150

Qcs605

Qm215

Rennell

Sa415M

Sc7180

Sc8180X

Sda660

Sda845

Sdm429

Sdm439

Sdm450

Sdm630

Sdm632

Sdm636

Sdm660

Sdm670

Sdm710

Sdm845

Sdm850

Sdx20

Sdx24

Sm6150

Sm7150

Sm8150

Sxr1130

Snapdragon Auto

Snapdragon Compute

Snapdragon Consumer Iot

Snapdragon Industrial Iot

Snapdragon Iot

Snapdragon Mobile

Snapdragon Voice & Music

Snapdragon Wearables

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-14062 · Security Note
• https://qualcomm.com/company/product-security/bulletins/june-2020-security-bulletin · Vendor Advisory
• https://t.me/cibsecurity/13041 · Telegram Post
• https://qualcomm.com/company/product-security/bulletins/june-2020-bulletin · Note
• https://t.me/cvenotify/4544 · Telegram Post