Lucene search

QualcommCVE-2018-11998

HistoryJan 18, 2019 - 10:29 p.m.

CVE-2018-11998

2019-01-1822:29:00

CWE-362

qualcomm

web.nvd.nist.gov

cve-2018-11998

mqtt

race condition

snapdragon

out-of-bounds access

nvd

CVSS2

7.9

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.5

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

30.6%

JSON

While processing a packet decode request in MQTT, Race condition can occur leading to an out-of-bounds access in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 427, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016

Affected configurations

Nvd

Node

qualcommmdm9206Match-

AND

qualcommmdm9206_firmwareMatch-

Node

qualcommmdm9607Match-

AND

qualcommmdm9607_firmwareMatch-

Node

qualcommsd_210Match-

AND

qualcommsd_210_firmwareMatch-

Node

qualcommsd_212Match-

AND

qualcommsd_212_firmwareMatch-

Node

qualcommsd_205Match-

AND

qualcommsd_205_firmwareMatch-

Node

qualcommsd_427Match-

AND

qualcommsd_427_firmwareMatch-

Node

qualcommsd_435Match-

AND

qualcommsd_435_firmwareMatch-

Node

qualcommsd_450Match-

AND

qualcommsd_450_firmwareMatch-

Node

qualcommsd_625_firmwareMatch-

AND

qualcommsd_625Match-

Node

qualcommsd_636_firmwareMatch-

AND

qualcommsd_636Match-

Node

qualcommsd_835_firmwareMatch-

AND

qualcommsd_835Match-

Node

qualcommsda660_firmwareMatch-

AND

qualcommsda660Match-

Node

qualcommsdm630_firmwareMatch-

AND

qualcommsdm630Match-

Node

qualcommsdm660_firmwareMatch-

AND

qualcommsdm660Match-

Node

qualcommsnapdragon_high_med_2016_firmwareMatch-

AND

qualcommsnapdragon_high_med_2016Match-

VendorProductVersionCPE
qualcommmdm9206-cpe:2.3:h:qualcomm:mdm9206:-:*:*:*:*:*:*:*
qualcommmdm9206_firmware-cpe:2.3:o:qualcomm:mdm9206_firmware:-:*:*:*:*:*:*:*
qualcommmdm9607-cpe:2.3:h:qualcomm:mdm9607:-:*:*:*:*:*:*:*
qualcommmdm9607_firmware-cpe:2.3:o:qualcomm:mdm9607_firmware:-:*:*:*:*:*:*:*
qualcommsd_210-cpe:2.3:h:qualcomm:sd_210:-:*:*:*:*:*:*:*
qualcommsd_210_firmware-cpe:2.3:o:qualcomm:sd_210_firmware:-:*:*:*:*:*:*:*
qualcommsd_212-cpe:2.3:h:qualcomm:sd_212:-:*:*:*:*:*:*:*
qualcommsd_212_firmware-cpe:2.3:o:qualcomm:sd_212_firmware:-:*:*:*:*:*:*:*
qualcommsd_205-cpe:2.3:h:qualcomm:sd_205:-:*:*:*:*:*:*:*
qualcommsd_205_firmware-cpe:2.3:o:qualcomm:sd_205_firmware:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qualcomm	mdm9206	-	cpe:2.3:h:qualcomm:mdm9206:-:::::::*
qualcomm	mdm9206_firmware	-	cpe:2.3:o:qualcomm:mdm9206_firmware:-:::::::*
qualcomm	mdm9607	-	cpe:2.3:h:qualcomm:mdm9607:-:::::::*
qualcomm	mdm9607_firmware	-	cpe:2.3:o:qualcomm:mdm9607_firmware:-:::::::*
qualcomm	sd_210	-	cpe:2.3:h:qualcomm:sd_210:-:::::::*
qualcomm	sd_210_firmware	-	cpe:2.3:o:qualcomm:sd_210_firmware:-:::::::*
qualcomm	sd_212	-	cpe:2.3:h:qualcomm:sd_212:-:::::::*
qualcomm	sd_212_firmware	-	cpe:2.3:o:qualcomm:sd_212_firmware:-:::::::*
qualcomm	sd_205	-	cpe:2.3:h:qualcomm:sd_205:-:::::::*
qualcomm	sd_205_firmware	-	cpe:2.3:o:qualcomm:sd_205_firmware:-:::::::*

Rows per page:

1-10 of 301

CNA Affected

[
  {
    "product": "Snapdragon Mobile, Snapdragon Wear",
    "vendor": "Qualcomm, Inc.",
    "versions": [
      {
        "status": "affected",
        "version": "MDM9206, MDM9607, SD 210/SD 212/SD 205, SD 427, SD 435, SD 450, SD 625, SD 636, SD 835, SDA660, SDM630, SDM660, Snapdragon_High_Med_2016"
      }
    ]
  }
]

References

www.qualcomm.com/company/product-security/bulletins

CVSS2

7.9

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:M/Au:N/C:C/I:C/A:C

CVSS3

7.5

Attack Vector

ADJACENT

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.001

Percentile

30.6%

JSON

Related for CVE-2018-11998