CVE-2019-10542: qualcomm, inc. snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music Out-of-bounds Read

Vulnerability summary

CVE-2019-10542 is a critical (CVSS 9.8) Out-of-bounds Read vulnerability in qualcomm, inc. snapdragon auto, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 52.9% of scored vulnerabilities.

Timeline

1. 06-11-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

Buffer over-read may occur when downloading a corrupted firmware file that has chunk length in header which doesn`t match the contents in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 845 / SD 850, SDX20

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.