Vulnerability Name: CVE-2019-14123 (CCN-186141) Assigned: 2019-07-19 Published: 2019-07-19 Updated: 2021-07-21 Summary: Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130 CVSS v3 Severity: 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): LowUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-20 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2019-14123 Source: XF Type: UNKNOWNqualcomm-cve201914123-bo(186141) Source: CCN Type: Qualcomm Web siteQualcomm Source: CONFIRM Type: Broken Linkhttps://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin Source: MISC Type: Vendor Advisoryhttps://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin Vulnerable Configuration: Configuration 1 :cpe:/o:qualcomm:kamorta_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:kamorta:-:*:*:*:*:*:*:* Configuration 2 :cpe:/o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:qcs404:-:*:*:*:*:*:*:* Configuration 3 :cpe:/o:qualcomm:rennell_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:rennell:-:*:*:*:*:*:*:* Configuration 4 :cpe:/o:qualcomm:sc7180_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sc7180:-:*:*:*:*:*:*:* Configuration 5 :cpe:/o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdx55:-:*:*:*:*:*:*:* Configuration 6 :cpe:/o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm6150:-:*:*:*:*:*:*:* Configuration 7 :cpe:/o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm7150:-:*:*:*:*:*:*:* Configuration 8 :cpe:/o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm8250:-:*:*:*:*:*:*:* Configuration 9 :cpe:/o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sxr2130:-:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/h:qualcomm:snapdragon_mobile:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_auto:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_compute:-:*:*:*:*:*:*:* OR cpe:/o:qualcomm:snapdragon_wired_infrastructure_&_networking:-:*:*:*:*:*:*:* Denotes that component is vulnerable BACK
qualcomm kamorta firmware -
qualcomm kamorta -
qualcomm qcs404 firmware -
qualcomm qcs404 -
qualcomm rennell firmware -
qualcomm rennell -
qualcomm sc7180 firmware -
qualcomm sc7180 -
qualcomm sdx55 firmware -
qualcomm sdx55 -
qualcomm sm6150 firmware -
qualcomm sm6150 -
qualcomm sm7150 firmware -
qualcomm sm7150 -
qualcomm sm8250 firmware -
qualcomm sm8250 -
qualcomm sxr2130 firmware -
qualcomm sxr2130 -
qualcomm snapdragon mobile -
qualcomm snapdragon auto -
qualcomm snapdragon compute -
qualcomm snapdragon wired infrastructure & networking -