CVE-2019-14078: qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking Incorrect Calculation of Buffer Size

Vulnerability summary

CVE-2019-14078 is a high (CVSS 7.8) Incorrect Calculation of Buffer Size vulnerability in qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking. EPSS estimates a 0.19% chance of exploitation in the next 30 days, higher than 8.1% of scored vulnerabilities.

Timeline

1. 02-06-2020
   PublishedVulnerability first disclosed.
2. 05-08-2024
   Last modifiedVulnerability information updated.

Description

Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8098, MSM8909, MSM8998, SDA660, SDA845, SDM630, SDM636, SDM660, SDM845

• CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.