Qualcomm, Inc.
Page 16 of 30 — Qualcomm, Inc. CVEs from a corpus of 2956, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3654 | Critical | 9.8 | 2020-11-02 | u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Co… |
CVE-2020-3638 | High | 7.8 | 2020-11-02 | u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Snapdragon Auto, Snap… |
CVE-2020-11174 | High | 7.8 | 2020-11-02 | u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2020-11173 | High | 7.0 | 2020-11-02 | u'Two threads running simultaneously from user space can lead to race condition in fastRPC driver' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectiv… |
CVE-2020-11172 | Critical | 9.8 | 2020-11-02 | u'fscanf reads a string from a file and stores its contents on a statically allocated stack memory which leads to stack overflow' in Snapdragon Wired Infrastru… |
CVE-2020-11169 | Critical | 9.1 | 2020-11-02 | u'Buffer over-read while processing received L2CAP packet due to lack of integer overflow check' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2020-11164 | High | 7.8 | 2020-11-02 | u'Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control' in Snapdragon Auto, Snapdragon… |
CVE-2020-11162 | High | 7.8 | 2020-11-02 | u'Possible buffer overflow in MHI driver due to lack of input parameter validation of EOT events received from MHI device side' in Snapdragon Auto, Snapdragon… |
CVE-2020-11157 | High | 7.5 | 2020-11-02 | u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto, Sna… |
CVE-2020-11156 | High | 8.1 | 2020-11-02 | u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap packet received from peer device.' in Snapdragon Auto, Snapdragon… |
CVE-2020-11155 | High | 8.8 | 2020-11-02 | u'Buffer overflow while processing PDU packet in bluetooth due to lack of check of buffer length before copying into it.' in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11154 | High | 8.8 | 2020-11-02 | u'Buffer overflow while processing a crafted PDU data packet in bluetooth due to lack of check of buffer size before copying' in Snapdragon Auto, Snapdragon Co… |
CVE-2020-11153 | Critical | 9.8 | 2020-11-02 | u'Out of bound memory access while processing GATT data received due to lack of check of pdu data length and leads to remote code execution' in Snapdragon Auto… |
CVE-2020-11141 | High | 8.1 | 2020-11-02 | u'Buffer over-read issue in Bluetooth estack due to lack of check for invalid length of L2cap configuration request received from peer device.' in Snapdragon A… |
CVE-2020-11125 | High | 7.8 | 2020-11-02 | u'Out of bound access can happen in MHI command process due to lack of check of channel id value received from MHI devices' in Snapdragon Auto, Snapdragon Comp… |
CVE-2020-11114 | High | 8.8 | 2020-11-02 | u'Bluetooth devices does not properly restrict the L2CAP payload length allowing users in radio range to cause a buffer overflow via a crafted Link Layer packe… |
CVE-2020-3679 | Medium | 5.5 | 2020-09-09 | u'During execution after Address Space Layout Randomization is turned on for QTEE, part of code is still mapped at known address including code segments' in Sn… |
CVE-2020-3674 | Medium | 5.5 | 2020-09-09 | Information can leak into userspace due to improper transfer of data from kernel to userspace in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2020-3656 | High | 7.8 | 2020-09-09 | Out of bound access can happen in MHI command process due to lack of check of command channel id value received from MHI devices in Snapdragon Auto, Snapdragon… |
CVE-2020-3634 | Critical | 9.1 | 2020-09-09 | u'Multiple Read overflows issue due to improper length check while decoding Generic NAS transport/EMM info' in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2020-3617 | High | 7.1 | 2020-09-09 | u'Buffer over-read Issue in Q6 testbus framework due to diag packet length is not completely validated before accessing the field and leads to Information disc… |
CVE-2020-11135 | High | 7.5 | 2020-09-09 | u'Reachable assertion when wrong data size is returned by parser for ape clips' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdra… |
CVE-2020-11129 | High | 7.8 | 2020-09-09 | u'During the error occurrence in capture request, the buffer is freed and later accessed causing the camera APP to fail due to memory use-after-free' in Snapdr… |
CVE-2020-11124 | High | 7.8 | 2020-09-09 | u'Possible use-after-free while accessing diag client map table since list can be reallocated due to exceeding max client limit.' in Snapdragon Auto, Snapdrago… |
CVE-2020-3702 | Medium | 6.5 | 2020-09-08 | u'Specifically timed and handcrafted traffic can cause internal errors in a WLAN device that lead to improper layer 2 Wi-Fi encryption with a consequent possib… |
CVE-2020-3675 | Critical | 9.8 | 2020-09-08 | u'Potential integer underflow while parsing Service Info and IPv6 link-local TLVs that comes as part of NDPE attribute' in Snapdragon Auto, Snapdragon Compute… |
CVE-2020-3669 | Critical | 9.8 | 2020-09-08 | u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2020-3668 | Critical | 9.8 | 2020-09-08 | u'Buffer overflow while parsing PMF enabled MCBC frames due to frame length being lesser than what is expected while parsing' in Snapdragon Auto, Snapdragon Co… |
CVE-2020-3667 | Critical | 9.8 | 2020-09-08 | u'Buffer Overflow in mic calculation for WPA due to copying data into buffer without validating the length of buffer' in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2020-3666 | High | 7.8 | 2020-09-08 | u'Out of bounds memory access during memory copy while processing Host command' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Con… |
CVE-2020-3648 | High | 7.8 | 2020-09-08 | u'Possible out of bound write in DSP driver code due to lack of check of data received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer I… |
CVE-2020-3647 | High | 7.8 | 2020-09-08 | u'Potential buffer overflow when accessing npu debugfs node "off"/"log" with large buffer size' in Snapdragon Compute, Snapdragon Industrial IOT, Snapdragon Mo… |
CVE-2020-3646 | High | 7.8 | 2020-09-08 | u'Buffer overflow seen as the destination buffer size is lesser than the source buffer size in video application' in Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2020-3644 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display session' in Snapdragon Auto, Snapdragon… |
CVE-2020-3643 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-3640 | High | 7.8 | 2020-09-08 | u'Resizing the usage table header before passing all the checks leads to the function exiting with a usage table in invalid state when a HLOS adversary calls t… |
CVE-2020-3636 | High | 7.8 | 2020-09-08 | u'Out of bound writes happen when accessing usage_table header entry beyond the memory allocated for the header' in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2020-3629 | High | 7.8 | 2020-09-08 | u'Stack out of bound issue occurs when making query to DSP capabilities due to wrong assumption was made on determining the buffer size for the DSP attributes'… |
CVE-2020-3624 | High | 7.8 | 2020-09-08 | u'A potential buffer overflow exists due to integer overflow when parsing handler options due to wrong data type usage in operation' in Snapdragon Auto, Snapdr… |
CVE-2020-3622 | High | 7.8 | 2020-09-08 | u'Channel name string which has been read from shared memory is potentially subjected to string manipulations but not validated for NULL termination can result… |
CVE-2020-3621 | Medium | 5.5 | 2020-09-08 | u'Lack of check to ensure that the TX read index & RX write index that are read from shared memory are less than the FIFO size results into memory corruption a… |
CVE-2020-3620 | Medium | 5.5 | 2020-09-08 | u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and pote… |
CVE-2020-3619 | High | 7.0 | 2020-09-08 | u'Non-secure memory is touched multiple times during TrustZone\u2019s execution and can lead to privilege escalation or memory corruption' in Snapdragon Auto… |
CVE-2020-3611 | High | 7.8 | 2020-09-08 | u'XBL SEC clears only ZI region when loading Qualcomm-signed segments can lead to improper access issue' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdr… |
CVE-2020-11158 | High | 7.5 | 2020-09-08 | u'Null pointer dereference in HP OfficeJet Pro 8210 jbig2 filter due to lack of check of PDF font array leads to denial of service' in IPS PDF releases prior t… |
CVE-2020-11133 | High | 7.8 | 2020-09-08 | u'Possible out of bound array write in rxdco cal utility due to lack of array bound check' in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industria… |
CVE-2020-11128 | High | 7.8 | 2020-09-08 | u'Possible out of bound access while copying the mask file content into the buffer without checking the buffer size' in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2020-11122 | Medium | 5.5 | 2020-09-08 | u'Null Pointer exception while playing crafted mkv file as data stream get deleted on secondary invalid configuration' in Snapdragon Auto, Snapdragon Consumer… |
CVE-2020-11120 | High | 7.8 | 2020-09-08 | u'Calling thread may free the data buffer pointer that was passed to the callback and later when event loop executes the callback, data buffer may not be valid… |
CVE-2020-11118 | High | 7.5 | 2020-09-08 | u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2020-11117 | Critical | 9.8 | 2020-09-08 | u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arbitrary content resulting in remote code… |
CVE-2020-11116 | Critical | 9.8 | 2020-09-08 | u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapdragon Auto, Snapdragon Comput… |
CVE-2020-11115 | High | 7.5 | 2020-09-08 | u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in Snapdragon Auto, Snapdragon Co… |
CVE-2019-14119 | High | 7.0 | 2020-09-08 | u'While processing SMCInvoke asynchronous message header, message count is modified leading to a TOCTOU race condition and lead to memory corruption' in Snapdr… |
CVE-2019-14117 | High | 7.8 | 2020-09-08 | u'Whenever the page list is updated via privileged user, the previous list elements are freed but are not deleted from the list which results in a use after fr… |
CVE-2019-14115 | Medium | 5.5 | 2020-09-08 | u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result in user reading the… |
CVE-2019-14089 | High | 7.8 | 2020-09-08 | u'Keymaster attestation key and device IDs provisioning which is a one time process is incorrectly allowed to be re-provisioned after a user data erase or a fa… |
CVE-2019-14074 | High | 7.8 | 2020-09-08 | u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2019-14065 | High | 7.8 | 2020-09-08 | u'Pointer double free in HavenSvc due to not setting the pointer to NULL after freeing it' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14056 | High | 7.8 | 2020-09-08 | u'Possible integer overflow in API due to lack of check on large oid range count in cert extension field' in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-14052 | Critical | 9.8 | 2020-09-08 | u'Accessing an uninitialized data structure could result in partially copying of contents and thus incorrect processing' in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14025 | Medium | 5.5 | 2020-09-08 | u'When a new session is created, Object is returned that contains TZ addresses and it get passed to HLOS as an handle to refer to a particular session and can… |
CVE-2019-13999 | High | 7.8 | 2020-09-08 | u'Lack of check for integer overflow for round up and addition operations result into memory corruption and potential information leakage' in Snapdragon Auto… |
CVE-2019-13998 | High | 7.8 | 2020-09-08 | u'Lack of check that the TX FIFO write and read indices that are read from shared RAM are less than the FIFO size results into memory corruption and potential… |
CVE-2019-13995 | High | 7.8 | 2020-09-08 | u'Lack of integer overflow check for addition of fragment size and remaining size that are read from shared memory can lead to memory corruption and potential… |
CVE-2019-13994 | High | 7.8 | 2020-09-08 | u'Lack of check that the current received data fragment size of a particular packet that are read from shared memory are less than the actual packet size can l… |
CVE-2019-13992 | High | 7.8 | 2020-09-08 | u'Out of bound memory access if stack push and pop operation are performed without doing a bound check on stack top' in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-10629 | High | 7.8 | 2020-09-08 | u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, S… |
CVE-2019-10628 | High | 7.8 | 2020-09-08 | u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10615 | High | 7.8 | 2020-09-08 | u'Possibility of integer overflow in keymaster 4 while allocating memory due to multiplication of large numcerts value and size of keymaster bob which can lead… |
CVE-2019-10596 | High | 7.8 | 2020-09-08 | u'Improper access control can lead signed process to guess pid of other processes and access their address space' in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-10562 | High | 7.8 | 2020-09-08 | u'Improper authentication and signature verification of debug polices in secure boot loader will allow unverified debug policies to be loaded into secure memor… |
CVE-2019-10527 | High | 7.8 | 2020-09-08 | u'SMEM partition can be manipulated in case of any compromise on HLOS, thus resulting in access to memory outside of SMEM address range which could lead to mem… |
CVE-2018-13903 | High | 8.1 | 2020-09-08 | u'Error in UE due to race condition in EPCO handling' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mo… |
CVE-2020-3681 | Critical | 9.8 | 2020-07-31 | Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code. |
CVE-2020-3701 | High | 7.8 | 2020-07-30 | Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM825… |
CVE-2020-3700 | High | 7.5 | 2020-07-30 | Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no additional execution privil… |
CVE-2020-3699 | Critical | 9.8 | 2020-07-30 | Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon C… |
CVE-2020-3698 | Critical | 9.8 | 2020-07-30 | Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon Auto, Snapdragon Com… |
CVE-2020-3688 | Critical | 9.8 | 2020-07-30 | Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2020-3671 | Critical | 9.8 | 2020-07-30 | Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-14130 | High | 7.8 | 2020-07-30 | Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-14124 | High | 7.8 | 2020-07-30 | Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wi… |
CVE-2019-14123 | High | 7.8 | 2020-07-30 | Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdrago… |
CVE-2019-14101 | High | 7.1 | 2020-07-30 | Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected length in Snapdrago… |
CVE-2019-14100 | High | 7.8 | 2020-07-30 | Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14099 | High | 7.8 | 2020-07-30 | Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2019-14093 | High | 7.8 | 2020-07-30 | Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14037 | High | 7.8 | 2020-07-30 | Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2019-10580 | High | 7.8 | 2020-07-30 | When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in Snapdragon Auto, Snapdr… |
CVE-2020-3676 | High | 7.8 | 2020-06-22 | Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Sna… |
CVE-2020-3665 | High | 7.8 | 2020-06-22 | A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being out of range in Snapdragon A… |
CVE-2020-3663 | Critical | 9.8 | 2020-06-22 | Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2020-3662 | Critical | 9.8 | 2020-06-22 | Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-3661 | Critical | 9.8 | 2020-06-22 | Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack of validation checks in Snapdr… |
CVE-2020-3660 | Critical | 9.8 | 2020-06-22 | Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2020-3658 | Critical | 9.1 | 2020-06-22 | Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2020-3642 | High | 7.8 | 2020-06-22 | Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snap… |
CVE-2020-3635 | High | 7.8 | 2020-06-22 | Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2020-3628 | Critical | 9.8 | 2020-06-22 | Improper access due to socket opened by the logging application without specifying localhost address in Snapdragon Consumer IOT, Snapdragon Mobile in APQ8053… |