Sign-up

ID

VAR-201804-0214


CVE

CVE-2016-10478


TITLE

Qualcomm Snapdragon Mobile Integer overflow vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-003456

DESCRIPTION

In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 617, incorrect size calculation in QCRIL SCWS processing have Integer overflow which will lead to a buffer overflow. Qualcomm Snapdragon Mobile Contains an integer overflow vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Google Android is prone to multiple unspecified security vulnerabilities. Little is known about these issues or its effects at this time. We will update this BID as more information emerges. Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance (OHA). Qualcomm SD 617 is a central processing unit (CPU) product of Qualcomm (Qualcomm). There is an integer overflow vulnerability in Qualcomm closed-source components in versions before Android 2018-04-05. The vulnerability stems from the fact that the program does not calculate the correct size value when processing QCRIL SCWS. An attacker could exploit this vulnerability with a specially crafted value to cause a buffer overflow and execute arbitrary code on the system. The following products are affected: Qualcomm SD 617

Trust: 2.07

sources: NVD: CVE-2016-10478 // JVNDB: JVNDB-2018-003456 // BID: 103671 // VULHUB: VHN-89258 // VULMON: CVE-2016-10478

AFFECTED PRODUCTS

vendor:qualcommmodel:sd 617scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 617scope:eqversion:2018/04/05

Trust: 0.8

vendor:googlemodel:pixel xlscope:eqversion:0

Trust: 0.3

vendor:googlemodel:pixel cscope:eqversion:0

Trust: 0.3

vendor:googlemodel:pixel xlscope:eqversion:20

Trust: 0.3

vendor:googlemodel:pixelscope:eqversion:20

Trust: 0.3

vendor:googlemodel:pixelscope:eqversion:0

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:9

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:7

Trust: 0.3

vendor:googlemodel:nexus 6pscope: - version: -

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:6

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:5x

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:5

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:4

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:10

Trust: 0.3

vendor:googlemodel:androidscope:eqversion:0

Trust: 0.3

sources: BID: 103671 // JVNDB: JVNDB-2018-003456 // CNNVD: CNNVD-201804-865 // NVD: CVE-2016-10478

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-10478
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-10478
value: CRITICAL

Trust: 0.8

CNNVD: CNNVD-201804-865
value: CRITICAL

Trust: 0.6

VULHUB: VHN-89258
value: HIGH

Trust: 0.1

VULMON: CVE-2016-10478
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-10478
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-89258
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-10478
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-89258 // VULMON: CVE-2016-10478 // JVNDB: JVNDB-2018-003456 // CNNVD: CNNVD-201804-865 // NVD: CVE-2016-10478

PROBLEMTYPE DATA

problemtype:CWE-190

Trust: 1.9

sources: VULHUB: VHN-89258 // JVNDB: JVNDB-2018-003456 // NVD: CVE-2016-10478

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201804-865

TYPE

digital error

Trust: 0.6

sources: CNNVD: CNNVD-201804-865

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-003456

PATCH
title:Android のセキュリティに関する公開情報 - 2018 年 4 月url:https://source.android.com/security/bulletin/2018-04-01
Trust: 0.8
title:Qualcomm Snapdragonurl:https://www.qualcomm.co.jp/snapdragon
Trust: 0.8
title:Android Qualcomm Fixing measures for closed source component digital error vulnerabilityurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=80221
Trust: 0.6
title:Android Security Bulletins: Android Security Bulletin—April 2018url:https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=068d787c35ce8cea494780f9a47b5827
Trust: 0.1
sources:
            
            
            VULMON: CVE-2016-10478 // 
            
            
            
            JVNDB: JVNDB-2018-003456 // 
            
            
            
            CNNVD: CNNVD-201804-865

EXTERNAL IDS
db:NVDid:CVE-2016-10478
Trust: 2.9
db:BIDid:103671
Trust: 1.5
db:JVNDBid:JVNDB-2018-003456
Trust: 0.8
db:CNNVDid:CNNVD-201804-865
Trust: 0.6
db:VULHUBid:VHN-89258
Trust: 0.1
db:VULMONid:CVE-2016-10478
Trust: 0.1
sources:
            
            
            VULHUB: VHN-89258 // 
            
            
            
            VULMON: CVE-2016-10478 // 
            
            
            
            BID: 103671 // 
            
            
            
            JVNDB: JVNDB-2018-003456 // 
            
            
            
            CNNVD: CNNVD-201804-865 // 
            
            
            
            NVD: CVE-2016-10478

REFERENCES
url:https://source.android.com/security/bulletin/2018-04-01
Trust: 2.1
url:http://www.securityfocus.com/bid/103671
Trust: 1.3
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-10478
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2016-10478
Trust: 0.8
url:http://code.google.com/android/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/190.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://source.android.com/security/bulletin/2018-04-01.html
Trust: 0.1
sources:
            
            
            VULHUB: VHN-89258 // 
            
            
            
            VULMON: CVE-2016-10478 // 
            
            
            
            BID: 103671 // 
            
            
            
            JVNDB: JVNDB-2018-003456 // 
            
            
            
            CNNVD: CNNVD-201804-865 // 
            
            
            
            NVD: CVE-2016-10478

CREDITS
The vendor reported these issues.
Trust: 0.3
sources:
            
            
            BID: 103671

SOURCES
db:VULHUBid:VHN-89258
db:VULMONid:CVE-2016-10478
db:BIDid:103671
db:JVNDBid:JVNDB-2018-003456
db:CNNVDid:CNNVD-201804-865
db:NVDid:CVE-2016-10478

LAST UPDATE DATE
2024-11-23T21:39:08.503000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-89258date:2018-05-01T00:00:00
db:VULMONid:CVE-2016-10478date:2018-05-01T00:00:00
db:BIDid:103671date:2018-04-05T00:00:00
db:JVNDBid:JVNDB-2018-003456date:2018-05-24T00:00:00
db:CNNVDid:CNNVD-201804-865date:2018-05-18T00:00:00
db:NVDid:CVE-2016-10478date:2024-11-21T02:44:05.670

SOURCES RELEASE DATE
db:VULHUBid:VHN-89258date:2018-04-18T00:00:00
db:VULMONid:CVE-2016-10478date:2018-04-18T00:00:00
db:BIDid:103671date:2018-04-05T00:00:00
db:JVNDBid:JVNDB-2018-003456date:2018-05-24T00:00:00
db:CNNVDid:CNNVD-201804-865date:2018-04-18T00:00:00
db:NVDid:CVE-2016-10478date:2018-04-18T14:29:13.183