CVSS: 10.0EPSS: 0%CPEs: 74EXPL: 0CVE-2019-14083
https://notcve.org/view.php?id=CVE-2019-14083
While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute length field of extended SSI which can lead to integer underflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8053, APQ8096, APQ8098, IPQ6018, IPQ8074, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS404, QCS405, QCS605, Rennell, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130, SXR2130 Mientras se analiza el Service Descriptor Extended Attribute recibido como parte de la trama SDF, se presenta la posibilidad que una longitud incorrecta sea especificada en el campo attribute length del SSI extendido, lo que puede conllevar a un subdesbordamiento de enteros en los productos Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking en las versiones APQ8009, APQ8053, APQ8096, APQ8098, IPQ6018, IPQ8074, MSM8996AU, MSM8998, Nicobar, QCA6174A, QCA6390, QCA6574AU, QCA8081, QCA9377, QCA9379, QCN7605, QCS404, QCS405, QCS605, Rennell, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SM6150, SM7150, SM8150, SXR1130, SXR2130. • https://www.qualcomm.com/company/product-security/bulletins/march-2020-bulletin • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2019-10618
https://notcve.org/view.php?id=CVE-2019-10618
Driver may access an invalid address while processing IO control due to lack of check of address validation in Snapdragon Connectivity in QCA6390 Un controlador puede acceder a una dirección no válida mientras procesa el control de Entradas y Salidas debido a la falta de comprobación de la validación de la dirección en el producto Snapdragon Connectivity en la versión QCA6390. • https://www.qualcomm.com/company/product-security/bulletins/november-2019-bulletin • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •