cnvd - cnvd-2020-41777

cnvd-2020-41777

Vulnerability from cnvd

Title: 多款Qualcomm产品输入验证错误漏洞（CNVD-2020-41777）

Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX20是一款调制解调器。

多款Qualcomm产品中的Video存在输入验证错误漏洞，远程攻击者可借助特制的剪辑文件利用该漏洞导致拒绝服务。

Severity: 高

Patch Name: 多款Qualcomm产品输入验证错误漏洞（CNVD-2020-41777）的补丁

Patch Description:

Qualcomm MDM9206等都是美国高通（Qualcomm）公司的产品。MDM9206是一款中央处理器（CPU）产品。MDM9607是一款中央处理器（CPU）产品。SDX20是一款调制解调器。

多款Qualcomm产品中的Video存在输入验证错误漏洞，远程攻击者可借助特制的剪辑文件利用该漏洞导致拒绝服务。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin

Reference: https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin

Impacted products

Name
['Qualcomm MDM9206', 'Qualcomm MDM9607', 'Qualcomm MSM8909W', 'Qualcomm SDX20', 'Qualcomm SDM429', 'Qualcomm SDM439', 'Qualcomm SDM632', 'Qualcomm SDM636', 'Qualcomm SDM660', 'Qualcomm MSM8996AU', 'Qualcomm SXR1130', 'Qualcomm QCS605', 'Qualcomm SM7150', 'Qualcomm SDM630', 'Qualcomm QCA6574AU', 'Qualcomm SDA 660', 'Qualcomm Nicobar', 'Qualcomm SDA 845', 'Qualcomm APQ8009', 'Qualcomm SDM670', 'Qualcomm SM8150', 'Qualcomm MDM9207C', 'Qualcomm SDM429W', 'Qualcomm APQ8017', 'Qualcomm APQ8053', 'Qualcomm APQ8096AU', 'Qualcomm MSM8917', 'Qualcomm MSM8920', 'Qualcomm MSM8937', 'Qualcomm MSM8940', 'Qualcomm MSM8953', 'Qualcomm SDM450', 'Qualcomm APQ8098', 'Qualcomm MSM8909', 'Qualcomm MSM8998', 'Qualcomm QM215', 'Qualcomm Rennell', 'Qualcomm SDM710', 'Qualcomm SDM845', 'Qualcomm SM6150', 'Qualcomm SM8250', 'Qualcomm SXR2130', 'Qualcomm MSM8939', 'Qualcomm APQ8064', 'Qualcomm MSM8996']

Name

['Qualcomm MDM9206', 'Qualcomm MDM9607', 'Qualcomm MSM8909W', 'Qualcomm SDX20', 'Qualcomm SDM429', 'Qualcomm SDM439', 'Qualcomm SDM632', 'Qualcomm SDM636', 'Qualcomm SDM660', 'Qualcomm MSM8996AU', 'Qualcomm SXR1130', 'Qualcomm QCS605', 'Qualcomm SM7150', 'Qualcomm SDM630', 'Qualcomm QCA6574AU', 'Qualcomm SDA 660', 'Qualcomm Nicobar', 'Qualcomm SDA 845', 'Qualcomm APQ8009', 'Qualcomm SDM670', 'Qualcomm SM8150', 'Qualcomm MDM9207C', 'Qualcomm SDM429W', 'Qualcomm APQ8017', 'Qualcomm APQ8053', 'Qualcomm APQ8096AU', 'Qualcomm MSM8917', 'Qualcomm MSM8920', 'Qualcomm MSM8937', 'Qualcomm MSM8940', 'Qualcomm MSM8953', 'Qualcomm SDM450', 'Qualcomm APQ8098', 'Qualcomm MSM8909', 'Qualcomm MSM8998', 'Qualcomm QM215', 'Qualcomm Rennell', 'Qualcomm SDM710', 'Qualcomm SDM845', 'Qualcomm SM6150', 'Qualcomm SM8250', 'Qualcomm SXR2130', 'Qualcomm MSM8939', 'Qualcomm APQ8064', 'Qualcomm MSM8996']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2019-10578",
      "cveUrl": "https://nvd.nist.gov/vuln/detail/CVE-2019-10578"
    }
  },
  "description": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX20\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\n\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684Video\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u526a\u8f91\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2020-41777",
  "openTime": "2020-07-23",
  "patchDescription": "Qualcomm MDM9206\u7b49\u90fd\u662f\u7f8e\u56fd\u9ad8\u901a\uff08Qualcomm\uff09\u516c\u53f8\u7684\u4ea7\u54c1\u3002MDM9206\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002MDM9607\u662f\u4e00\u6b3e\u4e2d\u592e\u5904\u7406\u5668\uff08CPU\uff09\u4ea7\u54c1\u3002SDX20\u662f\u4e00\u6b3e\u8c03\u5236\u89e3\u8c03\u5668\u3002\r\n\r\n\u591a\u6b3eQualcomm\u4ea7\u54c1\u4e2d\u7684Video\u5b58\u5728\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff0c\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u7279\u5236\u7684\u526a\u8f91\u6587\u4ef6\u5229\u7528\u8be5\u6f0f\u6d1e\u5bfc\u81f4\u62d2\u7edd\u670d\u52a1\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-41777\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Qualcomm MDM9206",
      "Qualcomm MDM9607",
      "Qualcomm MSM8909W",
      "Qualcomm SDX20",
      "Qualcomm SDM429",
      "Qualcomm SDM439",
      "Qualcomm SDM632",
      "Qualcomm SDM636",
      "Qualcomm SDM660",
      "Qualcomm MSM8996AU",
      "Qualcomm SXR1130",
      "Qualcomm QCS605",
      "Qualcomm SM7150",
      "Qualcomm SDM630",
      "Qualcomm QCA6574AU",
      "Qualcomm SDA 660",
      "Qualcomm Nicobar",
      "Qualcomm SDA 845",
      "Qualcomm APQ8009",
      "Qualcomm SDM670",
      "Qualcomm SM8150",
      "Qualcomm MDM9207C",
      "Qualcomm SDM429W",
      "Qualcomm APQ8017",
      "Qualcomm APQ8053",
      "Qualcomm APQ8096AU",
      "Qualcomm MSM8917",
      "Qualcomm MSM8920",
      "Qualcomm MSM8937",
      "Qualcomm MSM8940",
      "Qualcomm MSM8953",
      "Qualcomm SDM450",
      "Qualcomm APQ8098",
      "Qualcomm MSM8909",
      "Qualcomm MSM8998",
      "Qualcomm QM215",
      "Qualcomm Rennell",
      "Qualcomm SDM710",
      "Qualcomm SDM845",
      "Qualcomm SM6150",
      "Qualcomm SM8250",
      "Qualcomm SXR2130",
      "Qualcomm MSM8939",
      "Qualcomm APQ8064",
      "Qualcomm MSM8996"
    ]
  },
  "referenceLink": "https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin",
  "serverity": "\u9ad8",
  "submitTime": "2020-01-09",
  "title": "\u591a\u6b3eQualcomm\u4ea7\u54c1\u8f93\u5165\u9a8c\u8bc1\u9519\u8bef\u6f0f\u6d1e\uff08CNVD-2020-41777\uff09"
}

CVE-2019-10578 (GCVE-0-2019-10578)

Vulnerability from cvelistv5

Published

2020-01-21 06:30

Modified

2024-08-04 22:24

Severity ?

CWE

Improper Input Validation in Video

Summary

Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

References

▼	URL	Tags
	https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Qualcomm, Inc.	Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables	Version: APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T22:24:18.707Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables",
          "vendor": "Qualcomm, Inc.",
          "versions": [
            {
              "status": "affected",
              "version": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Improper Input Validation in Video",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-01-21T06:30:47",
        "orgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
        "shortName": "qualcomm"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "product-security@qualcomm.com",
          "ID": "CVE-2019-10578",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Qualcomm, Inc."
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Null pointer dereference can occur while parsing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice \u0026 Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MSM8909, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8939, MSM8940, MSM8953, MSM8996, MSM8996AU, MSM8998, Nicobar, QCA6574AU, QCS605, QM215, Rennell, SDA660, SDA845, SDM429, SDM429W, SDM439, SDM450, SDM630, SDM632, SDM636, SDM660, SDM670, SDM710, SDM845, SDX20, SM6150, SM7150, SM8150, SM8250, SXR1130, SXR2130"
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Improper Input Validation in Video"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin",
              "refsource": "CONFIRM",
              "url": "https://www.qualcomm.com/company/product-security/bulletins/january-2020-bulletin"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "2cfc7d3e-20d3-47ac-8db7-1b7285aff15f",
    "assignerShortName": "qualcomm",
    "cveId": "CVE-2019-10578",
    "datePublished": "2020-01-21T06:30:47",
    "dateReserved": "2019-03-29T00:00:00",
    "dateUpdated": "2024-08-04T22:24:18.707Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted