deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2018-9195
Published: 2019-11-21
Description: Use of a hardcoded cryptographic key in the FortiGuard services communication protocol may allow a Man in the middle with knowledge of the key to eavesdrop on and modify information (URL/SPAM services in FortiOS 5.6, and URL/SPAM/AV services in FortiOS 6.0.; URL rating in FortiClient) sent and received from Fortiguard severs by decrypting these messages. Affected products include FortiClient for Windows 6.0.6 and below, FortiOS 6.0.7 and below, FortiClient for Mac OS 6.2.1 and below.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-798
References: https://fortiguard.com/advisory/FG-IR-18-100; https://fortiguard.com/advisory/FG-IR-18-100
CVE: CVE-2019-10486
Published: 2019-11-21
Description: Race condition due to the lack of resource lock which will be concurrently modified in the memcpy statement leads to out of bound access in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909W, MSM8939, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150
CVSS Score: 7.0 (HIGH)
CWE: CWE-367
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10490
Published: 2019-11-21
Description: Use after free issue in Xtra daemon shutdown due to static object instance getting freed from a multiple places in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCS605, SDA660, SDA845, SDM450, SDM660, SDM670, SDM710, SDM845, SDX20, SDX24, SM6150, SM7150, SM8150, SM8250, SXR2130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10503
Published: 2019-11-21
Description: Out-of-bounds access can occur in camera driver due to improper validation of array index in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, QCN7605, SDA660, SDM450, SDM630, SDM636, SDM660, SDX20
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10535
Published: 2019-11-21
Description: Improper validation for loop variable received from firmware can lead to out of bound access in WLAN function while iterating through loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, APQ8098, MDM9640, MSM8996AU, MSM8998, QCA6574AU, QCN7605, QCS405, QCS605, SDA845, SDM845, SDX20
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-20, CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10563
Published: 2019-11-21
Description: Buffer over-read can occur in fast message handler due to improper input validation while processing a message from firmware in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, MSM8996AU, MSM8998, QCN7605, QCS405, QCS605, SDA660, SDM636, SDM660, SDX20, SDX24
CVSS Score: 7.8 (HIGH)
CWE: CWE-20, CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10566
Published: 2019-11-21
Description: Buffer overflow can occur in wlan module if supported rates or extended rates element length is greater than max rate set length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8017, APQ8053, APQ8096AU, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8905, MSM8996AU, Nicobar, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA845, SDM670, SDM710, SDM845, SDX20, SM6150, SM8150, SM8250, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-120
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10617
Published: 2019-11-21
Description: Low privilege users can access service configuration which contains registry data that admins uses to create or delete entries in the registry in QCA6174_9377.WIN.1.0 in QCA6174_9377
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-10627
Published: 2019-11-21
Description: Integer overflow to buffer overflow vulnerability in PostScript image handling code used by the PostScript- and PDF-compatible interpreters due to incorrect buffer size calculation. in PostScript and PDF printers that use IPS versions prior to 2019.2 in PostScript and PDF printers that use IPS versions prior to 2019.2
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-119, CWE-131, CWE-190
References: https://support.hp.com/us-en/document/c06458150; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://support.hp.com/us-en/document/c06458150
CVE: CVE-2019-15704
Published: 2019-11-21
Description: A clear text storage of sensitive information vulnerability in FortiClient for Mac may allow a local attacker to read sensitive information logged in the console window when the user connects to an SSL VPN Gateway.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-311
References: https://fortiguard.com/advisory/FG-IR-19-227; https://fortiguard.com/advisory/FG-IR-19-227
CVE: CVE-2019-16340
Published: 2019-11-21
Description: Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-425
References: http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt; https://puzzor.github.io/Linksys-Velop-Authentication-bypass; https://www.linksys.com/us/support-article?articleNum=207568
CVE: CVE-2019-16538
Published: 2019-11-21
Description: A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.67 and earlier related to the handling of default parameter expressions in closures allowed attackers to execute arbitrary code in sandboxed scripts.
CVSS Score: 8.8 (HIGH)
CWE: CWE-863
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1658; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16539
Published: 2019-11-21
Description: A missing permission check in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete support bundles.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-281
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1634; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16540
Published: 2019-11-21
Description: A path traversal vulnerability in Jenkins Support Core Plugin 2.63 and earlier allows attackers with Overall/Read permission to delete arbitrary files on the Jenkins master.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-22
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1634; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16541
Published: 2019-11-21
Description: Jenkins JIRA Plugin 3.0.10 and earlier does not declare the correct (folder) scope for per-folder Jira site definitions, allowing users to select and use credentials with System scope.
CVSS Score: 9.9 (CRITICAL)
CWE: CWE-668
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1106; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16542
Published: 2019-11-21
Description: Jenkins Anchore Container Image Scanner Plugin 1.0.19 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1539; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16543
Published: 2019-11-21
Description: Jenkins Spira Importer Plugin 3.2.2 and earlier stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1554; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16544
Published: 2019-11-21
Description: Jenkins QMetry for JIRA - Test Management Plugin 1.12 and earlier stores credentials unencrypted in job config.xml files on the Jenkins master where they can be viewed by users with Extended Read permission, or access to the master file system.
CVSS Score: 8.8 (HIGH)
CWE: CWE-522
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%281%29; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16545
Published: 2019-11-21
Description: Jenkins QMetry for JIRA - Test Management Plugin transmits credentials in its configuration in plain text as part of job configuration forms, potentially resulting in their exposure.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-319
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-727%20%282%29; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16546
Published: 2019-11-21
Description: Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-639
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1584; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16547
Published: 2019-11-21
Description: Missing permission checks in various API endpoints in Jenkins Google Compute Engine Plugin 4.1.1 and earlier allow attackers with Overall/Read permission to obtain limited information about the plugin configuration and environment.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-862
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1585; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-16548
Published: 2019-11-21
Description: A cross-site request forgery vulnerability in Jenkins Google Compute Engine Plugin 4.1.1 and earlier in ComputeEngineCloud#doProvision could be used to provision new agents.
CVSS Score: 8.8 (HIGH)
CWE: CWE-352
References: http://www.openwall.com/lists/oss-security/2019/11/21/1; https://jenkins.io/security/advisory/2019-11-21/#SECURITY-1586; http://www.openwall.com/lists/oss-security/2019/11/21/1
CVE: CVE-2019-17421
Published: 2019-11-21
Description: Incorrect file permissions on the packaged Nipper executable file in Zoho ManageEngine OpManager 12.4.072 and Firewall Analyzer 12.4.072 allow local users to elevate privileges to root by overwriting this file with a malicious payload.
CVSS Score: 7.8 (HIGH)
CWE: CWE-276
References: https://blog.vastart.dev/2019/11/cve-2019-17421-privilege-escalation.html; https://twitter.com/va_start; https://www.manageengine.com/products/firewall/security-updates/cve-2019-17421.html
CVE: CVE-2019-18958
Published: 2019-11-21
Description: Nitro Pro before 13.2 creates a debug.log file in the directory where a .pdf file is located, if the .pdf document was produced by an OCR operation on the JPEG output of a scanner. Reportedly, this can have a security risk if debug.log is later edited and then executed.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.html; https://a-man-in-the-cookie.blogspot.com/2019/11/nitro-pro-vulnerability.html
CVE: CVE-2019-2251
Published: 2019-11-21
Description: If a bitmap file is loaded from any un-authenticated source, there is a possibility that the bitmap can potentially cause stack buffer overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8016, APQ8096AU, APQ8098, MDM9205, MSM8996AU, MSM8998, Nicobar, QCS405, QCS605, SA6155P, SC8180X, SDA660, SDA845, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX24, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2266
Published: 2019-11-21
Description: Possible double free issue in kernel while handling the camera sensor and its sub modules power sequence in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in APQ8053, IPQ4019, IPQ8064, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, Nicobar, QCA9980, QCS405, QCS605, SDM845, SDX24, SM7150, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2268
Published: 2019-11-21
Description: Possible OOB read issue in P2P action frames while handling WLAN management frame in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9650, MSM8996AU, MSM8998, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCS405, QCS605, SDA660, SDM630, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2271
Published: 2019-11-21
Description: Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2289
Published: 2019-11-21
Description: Lack of integrity check allows MODEM to accept any NAS messages which can result into authentication bypass of NAS in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-345
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2295
Published: 2019-11-21
Description: Information disclosure due to lack of address range check done on the SysDBG buffers in SDI code. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, MDM9205, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8998, Nicobar, QCS404, QCS405, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, Snapdragon_High_Med_2016, SXR1130
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-119
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2297
Published: 2019-11-21
Description: Buffer overflow can occur while processing non-standard NAN message from user space. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, IPQ4019, IPQ8064, IPQ8074, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8905, MSM8996AU, QCA6174A, QCA6574AU, QCA9377, QCA9379, QCN7605, QCS405, QCS605, SDA660, SDA845, SDM636, SDM660, SDM845, SDX20, SDX24, SM8150
CVSS Score: 7.8 (HIGH)
CWE: CWE-119, CWE-190
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2303
Published: 2019-11-21
Description: SNDCP module may access array out side its boundary when it receives malformed XID message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX24, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2315
Published: 2019-11-21
Description: While invoking the API to copy from fd or local buffer to the secure buffer, Parameters being populated are from non secure environment. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8009, APQ8017, APQ8053, APQ8096, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9650, MSM8905, MSM8909, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, QCS404, QCS605, QM215, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SM6150, SM7150, SM8150, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2318
Published: 2019-11-21
Description: Non Secure Kernel can cause Trustzone to do an arbitrary memory read which will result into DOS in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired Infrastructure and Networking in APQ8017, APQ8053, APQ8096, APQ8096AU, IPQ8074, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996, MSM8996AU, QCA8081, QM215, SDM429, SDM439, SDM450, SDM632, Snapdragon_High_Med_2016
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-125
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2329
Published: 2019-11-21
Description: Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application. in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710, SDM845, SDX55, SM6150, SM7150, SM8150, SXR1130, SXR2130
CVSS Score: 7.8 (HIGH)
CWE: CWE-416
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin
CVE: CVE-2019-2335
Published: 2019-11-21
Description: While processing Attach Reject message, Valid exit condition is not met resulting into an infinite loop in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9150, MDM9205, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9650, MDM9655, MSM8905, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8976, MSM8996AU, MSM8998, Nicobar, QCM2150, QCS605, QM215, SC8180X, SDA660, SDA845, SDM429, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDM850, SDX20, SDX55, SM6150, SM7150, SM8150, SM8250, Snapdragon_High_Med_2016, SXR1130, SXR2130
CVSS Score: 7.5 (HIGH)
CWE: CWE-835
References: https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin; https://www.qualcomm.com/company/product-security/bulletins/october-2019-bulletin