CVE-2020-11294
Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.15%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Out of bound write in logger due to prefix size is not validated while prepended to logging string in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.15% probability · 4th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-129
- Affected
- qualcomm/ar8035 firmware · qualcomm/pm215 firmware · qualcomm/pm3003a firmware · qualcomm/pm6125 firmware · qualcomm/pm6150 firmware · qualcomm/pm6150a firmware · qualcomm/pm6150l firmware · qualcomm/pm6350 firmware · qualcomm/pm640a firmware · qualcomm/pm640l firmware · qualcomm/pm640p firmware · qualcomm/pm670 firmware · qualcomm/pm670l firmware · qualcomm/pm7150a firmware · qualcomm/pm7150l firmware · qualcomm/pm7250 firmware · qualcomm/pm7250b firmware · qualcomm/pm8005 firmware · qualcomm/pm8008 firmware · qualcomm/pm8009 firmware · +40 more
- Source
- product-security@qualcomm.com
References
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.