Vulnerability CVE-2013-4736

Vulnerability Name:

CVE-2013-4736 (CCN-103071)

Assigned:

2013-07-01

Published:

2013-07-01

Updated:

2014-09-04

Summary:

Multiple integer overflows in the JPEG engine drivers in the MSM camera driver for the Linux kernel 2.6.x and 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to cause a denial of service (system crash) via a large number of commands in an ioctl call, related to (1) camera_v1/gemini/msm_gemini_sync.c, (2) camera_v2/gemini/msm_gemini_sync.c, (3) camera_v2/jpeg_10/msm_jpeg_sync.c, (4) gemini/msm_gemini_sync.c, (5) jpeg_10/msm_jpeg_sync.c, and (6) mercury/msm_mercury_sync.c.

CVSS v3 Severity:

4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Low

CVSS v2 Severity:

7.8 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C)
5.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Complete

2.1 Low (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P)
1.6 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): None Availibility (A): Partial

Vulnerability Type:

CWE-189

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2013-4736

Source: CCN
Type: BID-65567
Code Aurora Multiple Products MSM Camera Driver Multiple Integer Overflow Vulnerabilities

Source: XF
Type: UNKNOWN
codeaurora-cve20134736-bo(103071)

Source: CCN
Type: CodeAurora security advisory QCIR-2013-00005-1
Integer overflow and signedness issue in camera JPEG engines (CVE-2013-4736)

Source: CONFIRM
Type: Patch, Vendor Advisory
https://www.codeaurora.org/projects/security-advisories/integer-overflow-and-signedness-issue-camera-jpeg-engines-cve-2013-4736

Vulnerable Configuration:

Configuration 1:

cpe:/o:codeaurora:android-msm:3.2.54:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.72:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.73:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.74:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.75:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.76:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.77:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.78:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.4.79:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.22:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.23:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.24:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.25:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.26:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.27:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.28:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.10.29:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.3:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.4:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.5:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.6:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.7:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.8:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.9:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.12.10:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc1:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc2:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc3:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc4:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc5:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc6:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc7:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13:rc8:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13.1:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.13.2:*:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.14:rc1:*:*:*:*:*:*

OR cpe:/o:codeaurora:android-msm:3.14:rc2:*:*:*:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20134736000	V	CVE-2013-4736 on Ubuntu 12.04 LTS (precise) - low.	2014-02-10
oval:com.ubuntu.trusty:def:20134736000	V	CVE-2013-4736 on Ubuntu 14.04 LTS (trusty) - low.	2014-02-10
oval:com.ubuntu.xenial:def:20134736000	V	CVE-2013-4736 on Ubuntu 16.04 LTS (xenial) - low.	2014-02-10
oval:com.ubuntu.xenial:def:201347360000000	V	CVE-2013-4736 on Ubuntu 16.04 LTS (xenial) - low.	2014-02-10

BACK