7.8high
CVE-2017-18294
While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.3%
percentile 18%
Public exploits
0
none known
Summary
While reading file class type from ELF header, a buffer overread may happen if the ELF file size is less than the size of ELF64 header size in Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear in version FSM9055, MDM9206, MDM9607, MDM9650, MSM8909W, MSM8996AU, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 820A, SD 835, SD 845, SDA660, SDX20.
Exploit prediction (EPSS)
0.26% probability of exploitation in the next 30 days, higher than 18% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.8 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.2 | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Affected products
- Qualcomm, Inc. Small Cell SoC, Snapdragon Automobile, Snapdragon Mobile, Snapdragon Wear
Classification
- Weakness
- CWE-125 Out-of-bounds Read
References
- qualcomm.com /company/product-security/bulletins · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1041432 · vdb-entry, x_refsource_SECTRACK, x_transferred
- source.android.com /security/bulletin/2018-08-01#qualcomm-closed-source-components · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-18294
- NVD: CVE-2017-18294
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.