Details of VAR-201912-1451

ID

VAR-201912-1451

CVE

CVE-2019-2304

TITLE

plural Snapdragon Classic buffer overflow vulnerability in products

Trust: 0.8

sources: JVNDB: JVNDB-2019-013287

DESCRIPTION

Integer overflow to buffer overflow due to lack of validation of event arguments received from firmware. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in IPQ4019, IPQ8064, IPQ8074, MDM9607, MSM8917, MSM8920, MSM8937, MSM8940, QCN7605, QCS405, QCS605, SDA845, SDM660, SDM845, SDX24, SDX55, SM6150, SM7150, SM8150, SXR1130. plural Snapdragon The product contains a classic buffer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state

Trust: 1.62

sources: NVD: CVE-2019-2304 // JVNDB: JVNDB-2019-013287

IOT TAXONOMY

category:	['other device', 'embedded device']	sub_category:	SoC	Trust: 0.1
category:	['other device', 'embedded device']	sub_category:	general	Trust: 0.1

sources: OTHER: None

AFFECTED PRODUCTS

vendor:	qualcomm	model:	sm8150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx55	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sda845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8917	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdx24	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm7150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs405	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcs605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sm6150	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	mdm9607	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	ipq8064	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	ipq4019	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm660	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	ipq8074	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	qcn7605	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sdm845	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8940	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8920	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	sxr1130	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	msm8937	scope:	eq	version:	-	Trust: 1.0
vendor:	qualcomm	model:	ipq4019	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	ipq8064	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	ipq8074	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	mdm9607	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8917	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8920	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8937	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	msm8940	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcn7605	scope:	-	version:	-	Trust: 0.8
vendor:	qualcomm	model:	qcs405	scope:	-	version:	-	Trust: 0.8

sources: JVNDB: JVNDB-2019-013287 // NVD: CVE-2019-2304

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2019-2304
value:	HIGH
Trust: 1.0
NVD:	CVE-2019-2304
value:	HIGH
Trust: 0.8
CNNVD:	CNNVD-201912-085
value:	HIGH
Trust: 0.6

nvd@nist.gov:	CVE-2019-2304
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8

nvd@nist.gov:	CVE-2019-2304
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2019-2304
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: JVNDB: JVNDB-2019-013287 // CNNVD: CNNVD-201912-085 // NVD: CVE-2019-2304

PROBLEMTYPE DATA

problemtype:	CWE-787	Trust: 1.0
problemtype:	CWE-20	Trust: 1.0
problemtype:	CWE-190	Trust: 1.0
problemtype:	CWE-120	Trust: 0.8

sources: JVNDB: JVNDB-2019-013287 // NVD: CVE-2019-2304

THREAT TYPE

local

Trust: 0.6

sources: CNNVD: CNNVD-201912-085

TYPE

buffer error

Trust: 0.6

sources: CNNVD: CNNVD-201912-085

CONFIGURATIONS

sources: JVNDB: JVNDB-2019-013287

PATCH

title:	December 2019 Security Bulletin	url:	https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin	Trust: 0.8
title:	Multiple Qualcomm Product Buffer Error Vulnerability Fix	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=105459	Trust: 0.6

sources: JVNDB: JVNDB-2019-013287 // CNNVD: CNNVD-201912-085

EXTERNAL IDS

db:	NVD	id:	CVE-2019-2304	Trust: 2.5
db:	JVNDB	id:	JVNDB-2019-013287	Trust: 0.8
db:	CNNVD	id:	CNNVD-201912-085	Trust: 0.6
db:	OTHER	id:	NONE	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2019-013287 // CNNVD: CNNVD-201912-085 // NVD: CVE-2019-2304

REFERENCES

url:	https://www.qualcomm.com/company/product-security/bulletins/december-2019-bulletin	Trust: 1.6
url:	https://nvd.nist.gov/vuln/detail/cve-2019-2304	Trust: 1.4
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-2304	Trust: 0.8
url:	https://source.android.google.cn/security/bulletin/2019-12-01.html	Trust: 0.6
url:	https://vigilance.fr/vulnerability/google-android-pixel-multiple-vulnerabilities-of-december-2019-31041	Trust: 0.6
url:	https://ieeexplore.ieee.org/abstract/document/10769424	Trust: 0.1

sources: OTHER: None // JVNDB: JVNDB-2019-013287 // CNNVD: CNNVD-201912-085 // NVD: CVE-2019-2304

SOURCES

db:	OTHER	id:	-
db:	JVNDB	id:	JVNDB-2019-013287
db:	CNNVD	id:	CNNVD-201912-085
db:	NVD	id:	CVE-2019-2304

LAST UPDATE DATE

2025-01-30T19:50:11.808000+00:00

SOURCES UPDATE DATE

db:	JVNDB	id:	JVNDB-2019-013287	date:	2019-12-25T00:00:00
db:	CNNVD	id:	CNNVD-201912-085	date:	2020-06-04T00:00:00
db:	NVD	id:	CVE-2019-2304	date:	2024-11-21T04:40:39.803

SOURCES RELEASE DATE

db:	JVNDB	id:	JVNDB-2019-013287	date:	2019-12-25T00:00:00
db:	CNNVD	id:	CNNVD-201912-085	date:	2019-12-02T00:00:00
db:	NVD	id:	CVE-2019-2304	date:	2019-12-18T06:15:13.080