deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2017-2876
Published: 2018-09-19
Description: An exploitable buffer overflow vulnerability exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10000 can cause a buffer overflow resulting in overwriting arbitrary data.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0383; https://www.talosintelligence.com/vulnerability_reports/TALOS-2017-0383
CVE: CVE-2017-2877
Published: 2018-09-19
Description: A missing error check exists in the Multi-Camera interface used by the Foscam C1 Indoor HD Camera running application firmware 2.52.2.43. A specially crafted request on port 10001 could allow an attacker to reset the user accounts to factory defaults, without authentication.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-755
References: https://talosintelligence.com/vulnerability_reports/TALOS-2017-0384; https://talosintelligence.com/vulnerability_reports/TALOS-2017-0384
CVE: CVE-2018-3823
Published: 2018-09-19
Description: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. Users with manage_ml permissions could create jobs containing malicious data as part of their configuration that could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of other ML users viewing the results of the jobs.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422
CVE: CVE-2018-3824
Published: 2018-09-19
Description: X-Pack Machine Learning versions before 6.2.4 and 5.6.9 had a cross-site scripting (XSS) vulnerability. If an attacker is able to inject data into an index that has a ML job running against it, then when another user views the results of the ML job it could allow the attacker to obtain sensitive information from or perform destructive actions on behalf of that other ML user.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-2-4-and-5-6-9-security-update/128422
CVE: CVE-2018-3825
Published: 2018-09-19
Description: In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 a default master encryption key is used in the process of granting ZooKeeper access to Elasticsearch clusters. Unless explicitly overwritten, this master key is predictable across all ECE deployments. If an attacker can connect to ZooKeeper directly they would be able to access configuration information of other tenants if their cluster ID is known.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-321, CWE-1188
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE: CVE-2018-3826
Published: 2018-09-19
Description: In Elasticsearch versions 6.0.0-beta1 to 6.2.4 a disclosure flaw was found in the _snapshot API. When the access_key and security_key parameters are set using the _snapshot API they can be exposed as plain text by users able to query the _snapshot API.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-200, CWE-311
References: https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777
CVE: CVE-2018-3827
Published: 2018-09-19
Description: A sensitive data disclosure flaw was found in the Elasticsearch repository-azure (formerly elasticsearch-cloud-azure) plugin. When the repository-azure plugin is set to log at TRACE level Azure credentials can be inadvertently logged.
CVSS Score: 8.1 (HIGH)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-3-0-and-5-6-10-security-update/135777
CVE: CVE-2018-3828
Published: 2018-09-19
Description: Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 contain an information exposure vulnerability. It was discovered that certain exception conditions would result in encryption keys, passwords, and other security sensitive headers being leaked to the allocator logs. An attacker with access to the logging cluster may obtain leaked credentials and perform authenticated actions using these credentials.
CVSS Score: 7.5 (HIGH)
CWE: CWE-532, CWE-532
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE: CVE-2018-3829
Published: 2018-09-19
Description: In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE install to gain access to other clusters data.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-285, CWE-290
References: https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-cloud-enterprise-1-1-4-security-update/135778
CVE: CVE-2018-3830
Published: 2018-09-19
Description: Kibana versions 5.3.0 to 6.4.1 had a cross-site scripting (XSS) vulnerability via the source field formatter that could allow an attacker to obtain sensitive information from or perform destructive actions on behalf of other Kibana users.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://access.redhat.com/errata/RHSA-2018:3537; https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035; https://www.elastic.co/community/security
CVE: CVE-2018-3831
Published: 2018-09-19
Description: Elasticsearch Alerting and Monitoring in versions before 6.4.1 or 5.6.12 have an information disclosure issue when secrets are configured via the API. The Elasticsearch _cluster/settings API, when queried, could leak sensitive configuration information such as passwords, tokens, or usernames. This could allow an authenticated Elasticsearch user to improperly view these details.
CVSS Score: 8.8 (HIGH)
CWE: CWE-200, CWE-200
References: https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035; https://www.elastic.co/community/security; https://discuss.elastic.co/t/elastic-stack-6-4-1-and-5-6-12-security-update/149035
CVE: CVE-2018-8889
Published: 2018-09-19
Description: A directory traversal vulnerability in the Connect Service of the BlackBerry Enterprise Mobility Server (BEMS) 2.8.17.29 and earlier could allow an attacker to retrieve arbitrary files in the context of a BEMS administrator account.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-22
References: http://support.blackberry.com/kb/articleDetail?articleNumber=000051590&language=en_US; http://support.blackberry.com/kb/articleDetail?articleNumber=000051590&language=en_US
CVE: CVE-2018-17228
Published: 2018-09-19
Description: nmap4j 1.1.0 allows attackers to execute arbitrary commands via shell metacharacters in an includeHosts call.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78
References: https://github.com/narkisr/nmap4j/issues/9; https://github.com/narkisr/nmap4j/issues/9
CVE: CVE-2018-17229
Published: 2018-09-19
Description: Exiv2::d2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html; https://github.com/Exiv2/exiv2/issues/453; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE: CVE-2018-17230
Published: 2018-09-19
Description: Exiv2::ul2Data in types.cpp in Exiv2 v0.26 allows remote attackers to cause a denial of service (heap-based buffer overflow) via a crafted image file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-787
References: http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html; https://github.com/Exiv2/exiv2/issues/455; http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00009.html
CVE: CVE-2018-17231
Published: 2018-09-19
Description: Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and application exit) via an "Edit color palette" search that triggers an "index out of range" condition. NOTE: this issue is disputed by multiple third parties because the described attack scenario does not cross a privilege boundary
CVSS Score: 7.5 (HIGH)
CWE: CWE-617
References: https://www.openwall.com/lists/oss-security/2018/09/19/8; https://www.openwall.com/lists/oss-security/2018/09/19/8
CVE: CVE-2018-17232
Published: 2018-09-20
Description: SQL injection vulnerability in archivebot.py in docmarionum1 Slack ArchiveBot (aka slack-archive-bot) before 2018-09-19 allows remote attackers to execute arbitrary SQL commands via the text parameter to cursor.execute().
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://github.com/docmarionum1/slack-archive-bot/issues/12; https://github.com/docmarionum1/slack-archive-bot/issues/12
CVE: CVE-2018-17233
Published: 2018-09-20
Description: A SIGFPE signal is raised in the function H5D__create_chunk_file_map_hyper() of H5Dchunk.c in the HDF HDF5 through 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. It could allow a remote denial of service attack.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln2#divided-by-zero---h5d__create_chunk_file_map_hyper_div_zero; https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln2#divided-by-zero---h5d__create_chunk_file_map_hyper_div_zero
CVE: CVE-2018-17234
Published: 2018-09-20
Description: Memory leak in the H5O__chunk_deserialize() function in H5Ocache.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service (memory consumption) via a crafted HDF5 file.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-772
References: https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln3#memory-leak---h5o__chunk_deserialize_memory_leak; https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html; https://github.com/SegfaultMasters/covering360/tree/master/HDF5/vuln3#memory-leak---h5o__chunk_deserialize_memory_leak
CVE: CVE-2018-17235
Published: 2018-09-20
Description: The function mp4v2::impl::MP4Track::FinishSdtp() in mp4track.cpp in libmp4v2 2.1.0 mishandles compatibleBrand while processing a crafted mp4 file, which leads to a heap-based buffer over-read, causing denial of service.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-125
References: https://bugzilla.redhat.com/show_bug.cgi?id=1629451; https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0; https://bugzilla.redhat.com/show_bug.cgi?id=1629451
CVE: CVE-2018-17236
Published: 2018-09-20
Description: The function MP4Free() in mp4property.cpp in libmp4v2 2.1.0 internally calls free() on a invalid pointer, raising a SIGABRT signal.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-416
References: https://bugzilla.redhat.com/show_bug.cgi?id=1629453; https://github.com/enzo1982/mp4v2/releases/tag/v2.1.0; https://bugzilla.redhat.com/show_bug.cgi?id=1629453
CVE: CVE-2018-17237
Published: 2018-09-20
Description: A SIGFPE signal is raised in the function H5D__chunk_set_info_real() of H5Dchunk.c in the HDF HDF5 1.10.3 library during an attempted parse of a crafted HDF file, because of incorrect protection against division by zero. This issue is different from CVE-2018-11207.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-369
References: https://github.com/SegfaultMasters/covering360/blob/master/HDF5/README.md#divided-by-zero---h5d__chunk_set_info_real_div_by_zero; https://lists.debian.org/debian-lts-announce/2023/08/msg00009.html; https://github.com/SegfaultMasters/covering360/blob/master/HDF5/README.md#divided-by-zero---h5d__chunk_set_info_real_div_by_zero
CVE: CVE-2018-17243
Published: 2018-09-20
Description: Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-89
References: https://www.manageengine.com/network-monitoring/help/read-me.html; https://www.manageengine.com/network-monitoring/help/read-me.html
CVE: CVE-2017-18280
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9607, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDM429, SDM439, SDM632, Snapdragon_High_Med_2016, when a Trusted Application has opened the SPI/I2C interface to a particular device, it is possible for another Trusted Application to read the data on this open interface by calling the SPI/I2C read function.
CVSS Score: 7.8 (HIGH)
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18301
Published: 2018-09-20
Description: In Small Cell SoC and Snapdragon (Automobile, Mobile, Wear) in version FSM9055, FSM9955, MDM9607, MDM9640, MDM9650, MSM8909W, SD 425, SD 427, SD 430, SD 435, SD 450, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, providing the NULL argument of ICE regulator while processing create key IOCTL results in system restart.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-476
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18302
Published: 2018-09-20
Description: In Snapdragon (Automobile ,Mobile) in version MSM8996AU, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, a crafted HLOS client can modify the structure in memory passed to a QSEE application between the time of check and the time of use, resulting in arbitrary writes to TZ kernel memory regions.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: http://www.securitytracker.com/id/1041432; https://source.android.com/security/bulletin/2018-08-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2017-18314
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, on TZ cold boot the CNOC_QDSS RG0 locked by xBL_SEC is cleared by TZ.
CVSS Score: 9.8 (CRITICAL)
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2018-11267
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9615, MDM9640, MDM9650, MDM9655, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, when sending an malformed XML data to deviceprogrammer/firehose it may do an out of bounds buffer write allowing a region of memory to be filled with 0x20.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/106128; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106128
CVE: CVE-2018-11268
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016, a potential buffer overflow exists when parsing TFTP options.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/106845; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/106845
CVE: CVE-2018-11269
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016, a potential buffer overflow exists when parsing TFTP options.
CVSS Score: 7.8 (HIGH)
CWE: CWE-129
References: http://www.securityfocus.com/bid/105838; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/105838
CVE: CVE-2018-11277
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, the com.qualcomm.embms is a vendor package deployed in the system image which has an inadequate permission level and allows any application installed from Play Store to request this permission at install-time. The system application interfaces with the Radio Interface Layer leading to potential access control issue.
CVSS Score: 7.8 (HIGH)
CWE: CWE-732
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11285
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, SDX20, Snapdragon_High_Med_2016, while parsing FLAC file with corrupted picture block, a buffer over-read can occur.
CVSS Score: 7.8 (HIGH)
CWE: CWE-125
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2018-11287
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, incorrect control flow implementation in Video while checking buffer sufficiency.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-20
References: https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components
CVE: CVE-2018-11290
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 820A, SD 845, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests is not done properly due to a flawed RNG in use.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000051618; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11291
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6574, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, SD 425, SD 427, SD 430, SD 435, SD 450, SD 600, SD 625, SD 650/52, SD 810, SD 820, SD 820A, SD 835, SD 845, SD 850, SDM630, SDM632, SDM636, SDM660, SDX20, Snapdragon_High_Med_2016, cryptographic issues due to the random number generator was not a strong one in NAN.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: http://www.securityfocus.com/bid/107681; https://www.qualcomm.com/company/product-security/bulletins; http://www.securityfocus.com/bid/107681
CVE: CVE-2018-11292
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820A, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, Snapdragon_High_Med_2016, lack of input validation in WLANWMI command handlers can lead to integer & heap overflows.
CVSS Score: 7.8 (HIGH)
CWE: CWE-190, CWE-787
References: http://support.blackberry.com/kb/articleDetail?language=en_US&articleNumber=000051618; https://source.android.com/security/bulletin/2018-09-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-11982
Published: 2018-09-20
Description: In Snapdragon (Mobile, Wear) in version MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 810, SD 820, SD 835, Snapdragon_High_Med_2016, a double free of ASN1 heap memory used for EUTRA CAP container occurs during UTRAN to LTE Capability inquiry procedure.
CVSS Score: 8.8 (HIGH)
CWE: CWE-415
References: https://www.qualcomm.com/company/product-security/bulletins; https://www.qualcomm.com/company/product-security/bulletins
CVE: CVE-2018-5837
Published: 2018-09-20
Description: In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 820A, SD 835, SD 845, SD 850, SDA660, SDM429, SDM439, SDM630, SDM632, SDM636, SDM660, SDM710, Snapdragon_High_Med_2016, MAC address randomization performed during probe requests is not done properly due to a flawed RNG which produced repeating output much earlier than expected.
CVSS Score: 7.5 (HIGH)
CWE: CWE-338
References: https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components; https://www.qualcomm.com/company/product-security/bulletins; https://source.android.com/security/bulletin/2018-07-01#qualcomm-closed-source-components