Vulnerability Name: CVE-2019-14130 (CCN-186138) Assigned: 2019-07-19 Published: 2019-07-19 Updated: 2021-07-21 Summary: Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in Kamorta, QCS404, Rennell, SC7180, SDX55, SM6150, SM7150, SM8250, SXR2130 CVSS v3 Severity: 7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H )6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): LowUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAuthentication (Au): NoneImpact Metrics: Confidentiality (C): PartialIntegrity (I): PartialAvailibility (A): Partial
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-119 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2019-14130 Source: XF Type: UNKNOWNqualcomm-cve201914130-code-exec(186138) Source: CCN Type: Qualcomm Web siteQualcomm Source: CONFIRM Type: Broken Linkhttps://www.qualcomm.com/company/product-security/bulletins/july-2020-bulletin Source: MISC Type: Vendor Advisoryhttps://www.qualcomm.com/company/product-security/bulletins/july-2020-security-bulletin Vulnerable Configuration: Configuration 1 :cpe:/o:qualcomm:kamorta_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:kamorta:-:*:*:*:*:*:*:* Configuration 2 :cpe:/o:qualcomm:qcs404_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:qcs404:-:*:*:*:*:*:*:* Configuration 3 :cpe:/o:qualcomm:rennell_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:rennell:-:*:*:*:*:*:*:* Configuration 4 :cpe:/o:qualcomm:sc7180_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sc7180:-:*:*:*:*:*:*:* Configuration 5 :cpe:/o:qualcomm:sdx55_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sdx55:-:*:*:*:*:*:*:* Configuration 6 :cpe:/o:qualcomm:sm6150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm6150:-:*:*:*:*:*:*:* Configuration 7 :cpe:/o:qualcomm:sm7150_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm7150:-:*:*:*:*:*:*:* Configuration 8 :cpe:/o:qualcomm:sm8250_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sm8250:-:*:*:*:*:*:*:* Configuration 9 :cpe:/o:qualcomm:sxr2130_firmware:-:*:*:*:*:*:*:* AND cpe:/h:qualcomm:sxr2130:-:*:*:*:*:*:*:* Configuration CCN 1 :cpe:/h:qualcomm:snapdragon_mobile:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_auto:-:*:*:*:*:*:*:* OR cpe:/h:qualcomm:snapdragon_compute:-:*:*:*:*:*:*:* OR cpe:/o:qualcomm:snapdragon_wired_infrastructure_&_networking:-:*:*:*:*:*:*:* Denotes that component is vulnerable BACK
qualcomm kamorta firmware -
qualcomm kamorta -
qualcomm qcs404 firmware -
qualcomm qcs404 -
qualcomm rennell firmware -
qualcomm rennell -
qualcomm sc7180 firmware -
qualcomm sc7180 -
qualcomm sdx55 firmware -
qualcomm sdx55 -
qualcomm sm6150 firmware -
qualcomm sm6150 -
qualcomm sm7150 firmware -
qualcomm sm7150 -
qualcomm sm8250 firmware -
qualcomm sm8250 -
qualcomm sxr2130 firmware -
qualcomm sxr2130 -
qualcomm snapdragon mobile -
qualcomm snapdragon auto -
qualcomm snapdragon compute -
qualcomm snapdragon wired infrastructure & networking -