VulnerabilityModified

CVE-2014-9998

CRITICAL 9.8EPSS 1.17%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.17%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Automobile, Snapdragon Mobile, and Snapdragon Wear IPQ4019, IPQ8064, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9650, QCA4531, QCA6174A, QCA6574AU, QCA6584, QCA6584AU, QCA9377, QCA9378, QCA9379, QCA9558, QCA9880, QCA9886, QCA9980, SD 210/SD 212/SD 205, SD 425, SD 625, SD 808, SD 810, SD 820, and SDX20, while processing firmware image signature, the internal buffer may overflow if the firmware signature size is large.

CVSS 3.0: 9.8 CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.17% probability · 66th percentile
CISA KEV: Not listed
Weakness: CWE-119
Affected: qualcomm/mdm9206 firmware · qualcomm/mdm9607 firmware · qualcomm/ipq4019 firmware · qualcomm/ipq8064 firmware · qualcomm/mdm9635m firmware · qualcomm/mdm9640 firmware · qualcomm/mdm9645 firmware · qualcomm/mdm9650 firmware · qualcomm/qca4531 firmware · qualcomm/qca6174a firmware · qualcomm/sd 210 firmware · qualcomm/sd 212 firmware · qualcomm/sd 205 firmware · qualcomm/qca6574au firmware · qualcomm/qca6584 firmware · qualcomm/qca6584au firmware · qualcomm/sd 425 firmware · qualcomm/qca9377 firmware · qualcomm/qca9378 firmware · qualcomm/qca9379 firmware · +9 more
Source: product-security@qualcomm.com

References

http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory
http://www.securityfocus.com/bid/103671Third Party Advisory, VDB Entry
https://source.android.com/security/bulletin/2018-04-01Vendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.