CVE-2018-11279

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Lack of check of input size can make device memory get corrupted because of buffer overflow in snapdragon automobile, snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
Qualcomm, Inc.	Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear	MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 439 / SD 429, SD 450, SD 615/16/SD 415, SD 625, SD 636, SD 650/52, SD 712 / SD 710 / SD 670, SD 810, SD 820, SD 820A, SD 835, SD 845 / SD 850, SDA660, SDM439, SDM630, SDM660, SDX20, Snapdragon_High_Med_2016, SXR1130

References

http://www.securityfocus.com/bid/106128Third Party Advisory, VDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory
http://www.securityfocus.com/bid/106128Third Party Advisory, VDB Entry
https://www.qualcomm.com/company/product-security/bulletinsVendor Advisory

Timeline

Published: Jan 18, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-11287.5It was found that cephx authentication protocol did not verify ceph clients correctly and was vulnerable to replay attack. Any attacker havi CVE-2018-112805.5In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing user-space ther CVE-2018-112817.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while calling IPA_IOC_MDFY_RT_RU CVE-2018-112849.3Spoofed SMS can be used to send a large number of messages to the device which will in turn initiate a flood of registration updates with th CVE-2018-112857.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD CVE-2018-112867.8In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while accessing global variable CVE-2018-112879.8In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 427, SD CVE-2018-112887.8Possible undefined behavior due to lack of size check in function for parameter segment_idx can lead to a read outside of the intended regio CVE-2018-112897.8Data truncation during higher to lower type conversion which causes less memory allocation than desired can lead to a buffer overflow in Sna CVE-2018-11296.5A flaw was found in the way signature calculation was handled by cephx authentication protocol. An attacker having access to ceph cluster ne CVE-2018-112907.5In Snapdragon (Automobile, Mobile, Wear) in version MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA6574AU, QCA6584, SD 210/SD 212/SD 205,CVE-2018-112917.5In Snapdragon (Automobile, Mobile, Wear) in version IPQ8074, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCA4531, QCA6174A, QCA6564, QCA6