Sign-up

ID

VAR-201807-1821


CVE

CVE-2018-5892


TITLE

Snapdragon Mobile and Snapdragon Wear Vulnerabilities in environment settings

Trust: 0.8

sources: JVNDB: JVNDB-2018-007676

DESCRIPTION

The Touch Pal application can collect user behavior data without awareness by the user in Snapdragon Mobile and Snapdragon Wear. Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. An attacker can exploit these issues to perform unauthorized actions. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-73539080, A-73539065, A-72951191, A-72950815, A-72950554, A-74236854, and A-74235510

Trust: 2.07

sources: NVD: CVE-2018-5892 // JVNDB: JVNDB-2018-007676 // BID: 104759 // VULHUB: VHN-135924 // VULMON: CVE-2018-5892

AFFECTED PRODUCTS

vendor:qualcommmodel:mdm9607scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 205scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 212scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 210scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:msm8996auscope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 425scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 430scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:mdm9650scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:mdm9206scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sd 427scope:eqversion: -

Trust: 1.6

vendor:qualcommmodel:sdm636scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 415scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 650scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 835scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 652scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:snapdragon high med 2016scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm710scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 615scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm630scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 810scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 845scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 820scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sdm660scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 450scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 616scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 435scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:sd 625scope:eqversion: -

Trust: 1.0

vendor:qualcommmodel:mdm9206scope: - version: -

Trust: 0.8

vendor:qualcommmodel:mdm9607scope: - version: -

Trust: 0.8

vendor:qualcommmodel:mdm9650scope: - version: -

Trust: 0.8

vendor:qualcommmodel:msm8996auscope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 205scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 210scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 212scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 415scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 425scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 427scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 430scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 435scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 450scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 615scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 616scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 625scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 650scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 652scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 810scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 820scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 835scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sd 845scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 630scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 636scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm 660scope: - version: -

Trust: 0.8

vendor:qualcommmodel:sdm710scope: - version: -

Trust: 0.8

vendor:qualcommmodel:snapdragon high med 2016scope: - version: -

Trust: 0.8

vendor:googlemodel:pixel xlscope:eqversion:0

Trust: 0.3

vendor:googlemodel:pixel cscope:eqversion:0

Trust: 0.3

vendor:googlemodel:pixelscope:eqversion:0

Trust: 0.3

vendor:googlemodel:nexus playerscope:eqversion:0

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:9

Trust: 0.3

vendor:googlemodel:nexus 6pscope: - version: -

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:6

Trust: 0.3

vendor:googlemodel:nexusscope:eqversion:5x

Trust: 0.3

vendor:googlemodel:androidscope:eqversion:0

Trust: 0.3

sources: BID: 104759 // JVNDB: JVNDB-2018-007676 // CNNVD: CNNVD-201807-396 // NVD: CVE-2018-5892

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-5892
value: HIGH

Trust: 1.0

NVD: CVE-2018-5892
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201807-396
value: HIGH

Trust: 0.6

VULHUB: VHN-135924
value: MEDIUM

Trust: 0.1

VULMON: CVE-2018-5892
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2018-5892
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

VULHUB: VHN-135924
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-5892
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.0

Trust: 1.8

sources: VULHUB: VHN-135924 // VULMON: CVE-2018-5892 // JVNDB: JVNDB-2018-007676 // CNNVD: CNNVD-201807-396 // NVD: CVE-2018-5892

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.1

problemtype:CWE-16

Trust: 0.9

sources: VULHUB: VHN-135924 // JVNDB: JVNDB-2018-007676 // NVD: CVE-2018-5892

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201807-396

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201807-396

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-007676

PATCH
title:July 2018 Qualcomm Technologies, Inc. Security Bulletinurl:https://www.qualcomm.com/company/product-security/bulletins
Trust: 0.8
title:Qualcomm Snapdragon Mobile  and Snapdragon Wear Fixes for configuration error vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=81817
Trust: 0.6
title:Android Security Bulletins: Android Security Bulletin—June 2018url:https://vulmon.com/vendoradvisory?qidtp=android_security_bulletins&qid=cc496c56e2bf669809bfb568f59af8e1
Trust: 0.1
title:SamsungReleaseNotesurl:https://github.com/samreleasenotes/SamsungReleaseNotes 
Trust: 0.1
sources:
            
            
            VULMON: CVE-2018-5892 // 
            
            
            
            JVNDB: JVNDB-2018-007676 // 
            
            
            
            CNNVD: CNNVD-201807-396

EXTERNAL IDS
db:NVDid:CVE-2018-5892
Trust: 2.9
db:JVNDBid:JVNDB-2018-007676
Trust: 0.8
db:CNNVDid:CNNVD-201807-396
Trust: 0.7
db:BIDid:104759
Trust: 0.3
db:VULHUBid:VHN-135924
Trust: 0.1
db:VULMONid:CVE-2018-5892
Trust: 0.1
sources:
            
            
            VULHUB: VHN-135924 // 
            
            
            
            VULMON: CVE-2018-5892 // 
            
            
            
            BID: 104759 // 
            
            
            
            JVNDB: JVNDB-2018-007676 // 
            
            
            
            CNNVD: CNNVD-201807-396 // 
            
            
            
            NVD: CVE-2018-5892

REFERENCES
url:https://www.qualcomm.com/company/product-security/bulletins
Trust: 1.8
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-5892
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-5892
Trust: 0.8
url:http://code.google.com/android/
Trust: 0.3
url:http://www.qualcomm.com/
Trust: 0.3
url:https://source.android.com/security/bulletin/2018-06-01
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/200.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://source.android.com/security/bulletin/2018-06-01.html
Trust: 0.1
url:https://github.com/samreleasenotes/samsungreleasenotes
Trust: 0.1
sources:
            
            
            VULHUB: VHN-135924 // 
            
            
            
            VULMON: CVE-2018-5892 // 
            
            
            
            BID: 104759 // 
            
            
            
            JVNDB: JVNDB-2018-007676 // 
            
            
            
            CNNVD: CNNVD-201807-396 // 
            
            
            
            NVD: CVE-2018-5892

CREDITS
The vendor reported these issues.
Trust: 0.3
sources:
            
            
            BID: 104759

SOURCES
db:VULHUBid:VHN-135924
db:VULMONid:CVE-2018-5892
db:BIDid:104759
db:JVNDBid:JVNDB-2018-007676
db:CNNVDid:CNNVD-201807-396
db:NVDid:CVE-2018-5892

LAST UPDATE DATE
2024-11-23T22:06:40.349000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-135924date:2019-10-03T00:00:00
db:VULMONid:CVE-2018-5892date:2019-10-03T00:00:00
db:BIDid:104759date:2018-06-06T00:00:00
db:JVNDBid:JVNDB-2018-007676date:2018-09-21T00:00:00
db:CNNVDid:CNNVD-201807-396date:2019-10-23T00:00:00
db:NVDid:CVE-2018-5892date:2024-11-21T04:09:39.150

SOURCES RELEASE DATE
db:VULHUBid:VHN-135924date:2018-07-06T00:00:00
db:VULMONid:CVE-2018-5892date:2018-07-06T00:00:00
db:BIDid:104759date:2018-06-06T00:00:00
db:JVNDBid:JVNDB-2018-007676date:2018-09-21T00:00:00
db:CNNVDid:CNNVD-201807-396date:2018-07-06T00:00:00
db:NVDid:CVE-2018-5892date:2018-07-06T17:29:02.147