First published: Mon Apr 01 2019(Updated: )
Lack of check in length before using memcpy in WLAN function can lead to OOB access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8996AU, QCS605, SD 625, SD 636, SD 712 / SD 710 / SD 670, SD 820, SD 820A, SD 835, SD 845 / SD 850, SD 855, SDA660, SDM630, SDM660, SDX20, SDX24, SXR1130
Credit: product-security@qualcomm.com
Affected Software | Affected Version | How to fix |
---|---|---|
Android | ||
Qualcomm MDM9150 firmware | ||
Qualcomm MDM9150 firmware | ||
Qualcomm MDM9206 | ||
Qualcomm MDM9206 firmware | ||
Qualcomm MD9607 Firmware | ||
Qualcomm MDM9607 firmware | ||
qualcomm mdm9640 firmware | ||
Qualcomm MDM9640 | ||
Qualcomm MDM9650 | ||
Qualcomm MDM9650 firmware | ||
qualcomm MSM8996AU firmware | ||
Qualcomm MSM8996AU Firmware | ||
Qualcomm ZZ QCS605 firmware | ||
Qualcomm QCS605 Firmware | ||
Qualcomm SD 625 Firmware | ||
Qualcomm Snapdragon 625 | ||
Qualcomm SDM636 Firmware | ||
Qualcomm Snapdragon 636 | ||
Qualcomm Snapdragon 712 Firmware | ||
Qualcomm Snapdragon 712 | ||
qualcomm sdm710 firmware | ||
Qualcomm Snapdragon 710 | ||
Qualcomm SDM670 Firmware | ||
Qualcomm SDM670 | ||
Qualcomm SD820 Firmware | ||
Qualcomm SD820 Firmware | ||
Qualcomm SD820A Firmware | ||
Qualcomm SD820A Firmware | ||
Qualcomm SD835 Firmware | ||
Qualcomm Snapdragon 835 | ||
Qualcomm SDA845 Firmware | ||
Qualcomm SD845 | ||
Qualcomm SD850 Firmware | ||
Qualcomm SD850 | ||
Qualcomm SD855 Firmware | ||
Qualcomm SD855 Firmware | ||
Qualcomm SDA660 | ||
Qualcomm SDA660 | ||
qualcomm SDM630 firmware | ||
qualcomm SDM630 | ||
Qualcomm SD660 Firmware | ||
Qualcomm Snapdragon 660 | ||
Qualcomm SDX20 Firmware | ||
Qualcomm SDX20 Firmware | ||
Qualcomm SDX24 | ||
Qualcomm SDX24 | ||
Qualcomm SXR1130 | ||
Qualcomm SXR1130 Firmware |
https://www.codeaurora.org/security-bulletin/2019/04/01/april-2019-code-aurora-security-bulletin
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2018-11940 has been categorized as a high severity vulnerability due to the potential for out-of-bounds access.
To fix CVE-2018-11940, it is recommended to update affected Qualcomm firmware and ensure software checks for proper length before using memcpy.
CVE-2018-11940 impacts multiple devices using Snapdragon Auto, Compute, Consumer IOT, Industrial IOT, and Mobile platforms.
CVE-2018-11940 is an out-of-bounds (OOB) access vulnerability caused by inadequate length checks in memory operations.
Yes, CVE-2018-11940 can potentially be exploited remotely, depending on the application's access and the network configuration.