What is CVE-2018-11970?

CVE-2018-11970 is a high-severity vulnerability in Qualcomm Mdm9206. CVSS score: 7.8/10. Published 2019-04-04.

How severe is CVE-2018-11970?

High severity. CVSS v3 base score is 7.8 out of 10.

Vulnerability in Qualcomm Mdm9206

CVE-2018-11970

TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MDM9607, MDM9650, MDM9655, QCS605, SD 410/12, SD 636, SD 712 / SD 710 / SD 670, SD 845 / SD 850, SD 8CX, SDA660, SDM630, SDM660, SXR1130

EPSS: 0.002 (11.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Qualcomm Mdm9206
Qualcomm Mdm9206_firmware
Qualcomm Mdm9607
Qualcomm Mdm9607_firmware
Qualcomm Mdm9650
Qualcomm Mdm9650_firmware
Qualcomm Mdm9655
Qualcomm Mdm9655_firmware
Qualcomm Qcs605
Qualcomm Qcs605_firmware

References

product-security@qualcomm.com (x_refsource_CONFIRM, Vendor Advisory)

Frequently asked questions

What is CVE-2018-11970?: CVE-2018-11970 is a high-severity vulnerability in Qualcomm Mdm9206. CVSS score: 7.8/10. Published 2019-04-04.
How severe is CVE-2018-11970?: High severity. CVSS v3 base score is 7.8 out of 10.