Critical severity · published Jul 22, 2019
CVE-2019-2269
Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon…
9.8
CVSS
0.7%
EPSS
No
On KEV
Description
Possible buffer overflow while processing the high level lim process action frame due to improper buffer length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9650, MSM8996AU, QCS405, QCS605, SD 625, SD 636, SD 665, SD 712 / SD 710 / SD 670, SD 730, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
MF
Mdm9150 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Mdm9650 Firmware · Qualcomm
All versions, or not specified · source: NVD
MF
Msm8996au Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs405 Firmware · Qualcomm
All versions, or not specified · source: NVD
QF
Qcs605 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 625 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 636 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 665 Firmware · Qualcomm
All versions, or not specified · source: NVD
S6
SD 670 Firmware · Qualcomm
All versions, or not specified · source: NVD
S7
SD 710 Firmware · Qualcomm
All versions, or not specified · source: NVD
S7
SD 712 Firmware · Qualcomm
All versions, or not specified · source: NVD
S7
SD 730 Firmware · Qualcomm
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-2269
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-2269
Patch
https://www.codeaurora.org/security-bulletin/2019/06/03/june-2019-code-aurora-security-bulletin
More from Mdm9150 Firmware
7.8
CVE-2022-22071
Qualcomm Multiple Chipsets Use-After-Free Vulnerability
5.5
CVE-2021-1906
Qualcomm Multiple Chipsets Detection of Error Condition Without Action Vulnerability
9.8
CVE-2022-40510
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder
9.8
CVE-2022-40537
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response
9.8
CVE-2022-40515
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms