Qualcomm, Inc.
Page 17 of 30 — Qualcomm, Inc. CVEs from a corpus of 2956, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3626 | High | 7.8 | 2020-06-22 | Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2020-3614 | Critical | 9.8 | 2020-06-22 | Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2020-3613 | High | 7.8 | 2020-06-22 | Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in SM8… |
CVE-2019-14094 | High | 7.8 | 2020-06-22 | Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14092 | Medium | 5.5 | 2020-06-22 | System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MD… |
CVE-2019-14091 | High | 7.8 | 2020-06-22 | Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14080 | Critical | 9.8 | 2020-06-22 | Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14076 | High | 7.8 | 2020-06-22 | Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14073 | Critical | 9.8 | 2020-06-22 | Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow when processing large dat… |
CVE-2019-14062 | Critical | 9.8 | 2020-06-22 | Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-14047 | High | 7.8 | 2020-06-22 | While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon A… |
CVE-2019-10626 | Medium | 5.5 | 2020-06-22 | Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-10597 | High | 7.8 | 2020-06-22 | kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2020-3680 | High | 7.0 | 2020-06-02 | A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IO… |
CVE-2020-3645 | High | 7.5 | 2020-06-02 | Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Conn… |
CVE-2020-3641 | Critical | 9.8 | 2020-06-02 | Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2020-3633 | Critical | 9.8 | 2020-06-02 | Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snapdragon Auto, Snapdr… |
CVE-2020-3630 | High | 7.8 | 2020-06-02 | Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2020-3625 | High | 7.8 | 2020-06-02 | When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon Auto, Snapdragon Consu… |
CVE-2020-3623 | High | 7.8 | 2020-06-02 | kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130 |
CVE-2020-3618 | High | 7.8 | 2020-06-02 | NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Netwo… |
CVE-2020-3616 | High | 7.8 | 2020-06-02 | Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2020-3615 | Critical | 9.8 | 2020-06-02 | Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to improper enum values… |
CVE-2020-3610 | High | 7.8 | 2020-06-02 | Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this obje… |
CVE-2019-14087 | High | 7.8 | 2020-06-02 | Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, Snapdragon Mobile, Snapd… |
CVE-2019-14078 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14077 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14067 | Medium | 5.5 | 2020-06-02 | Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto… |
CVE-2019-14066 | High | 7.8 | 2020-06-02 | Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking Feature ID status in Snap… |
CVE-2019-14054 | High | 7.8 | 2020-06-02 | Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute… |
CVE-2019-14053 | High | 7.1 | 2020-06-02 | When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to a value that does n… |
CVE-2019-14043 | High | 7.1 | 2020-06-02 | Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-14042 | High | 7.1 | 2020-06-02 | Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-14039 | High | 7.1 | 2020-06-02 | Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14038 | High | 7.1 | 2020-06-02 | Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapd… |
CVE-2020-3653 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon Compute, Snapdragon… |
CVE-2020-3652 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable receive… |
CVE-2020-3651 | High | 7.5 | 2020-04-16 | Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14135 | High | 7.8 | 2020-04-16 | Possible integer overflow to buffer overflow in WLAN while parsing nonstandard NAN IE messages. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2019-14134 | Critical | 9.8 | 2020-04-16 | Possible out of bound access in WLAN handler when the received value of length in rx path is shorter than the expected value of country IE in Snapdragon Comput… |
CVE-2019-14132 | Critical | 9.8 | 2020-04-16 | Buffer over-write when this 0-byte buffer is typecasted to some other structure and hence memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdr… |
CVE-2019-14131 | Critical | 9.8 | 2020-04-16 | Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-14127 | Critical | 9.8 | 2020-04-16 | Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-14122 | High | 7.8 | 2020-04-16 | Memory failure in SKB if it fails to to add the requested padding to the skb in low memory targets or targets with major memory fragmentation in Snapdragon Aut… |
CVE-2019-14116 | High | 7.8 | 2020-04-16 | Privilege escalation by using an altered debug policy image can occur as the XPU protecting the debug policy regions are disabled during the crash dump boot fl… |
CVE-2019-14114 | Critical | 9.8 | 2020-04-16 | Buffer overflow in WLAN firmware while parsing GTK IE containing GTK key having length more than the buffer size in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-14113 | Critical | 9.8 | 2020-04-16 | Buffer overflow can occur in In WLAN firmware while unwraping data using CCMP cipher suite during parsing of EAPOL handshake frame in Snapdragon Auto, Snapdrag… |
CVE-2019-14112 | Critical | 9.8 | 2020-04-16 | Potential buffer overflow while processing CBF frames due to lack of check of buffer length before copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2019-14111 | Critical | 9.8 | 2020-04-16 | Possible buffer overflow while handling NAN reception of NMF in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics C… |
CVE-2019-14110 | Critical | 9.8 | 2020-04-16 | Buffer overflow can occur in function wlan firmware while copying association frame content if frame length is more than the maximum buffer size in case of SAP… |
CVE-2019-14105 | High | 7.8 | 2020-04-16 | Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial IOT, Snapdragon Mobi… |
CVE-2019-14104 | High | 7.1 | 2020-04-16 | Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in Snapdragon Compute, Snapdrago… |
CVE-2019-14075 | Medium | 5.5 | 2020-04-16 | Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag… |
CVE-2019-14070 | High | 7.0 | 2020-04-16 | Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14033 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach reject/attach accept in Snapdragon Auto… |
CVE-2019-14022 | High | 7.5 | 2020-04-16 | Error occurs While extracting the ipv6_header having an invalid length due to lack of length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2019-14021 | High | 7.8 | 2020-04-16 | Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in… |
CVE-2019-14020 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding dedicated_eps_bearer_req/ act_def_context_req/ cs_serv_notification/ emm_info/ guti_r… |
CVE-2019-14019 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt req/bearer resource alloc Rej/Deact EPs… |
CVE-2019-14018 | High | 7.8 | 2020-04-16 | Possible out of bound array access as there is no check on carrier index passed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Ind… |
CVE-2019-14012 | High | 7.5 | 2020-04-16 | Possibility of null pointer deference as the array of video codecs from media info is referenced without null checking while processing SDP messages in Snapdra… |
CVE-2019-14011 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data transport/ bearer modify conte… |
CVE-2019-14009 | High | 7.8 | 2020-04-16 | Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Snapdragon Auto, Snapd… |
CVE-2019-14007 | Medium | 5.5 | 2020-04-16 | Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruptio… |
CVE-2019-14001 | High | 7.8 | 2020-04-16 | Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile… |
CVE-2019-10625 | High | 7.1 | 2020-04-16 | Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-10624 | High | 7.8 | 2020-04-16 | While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdr… |
CVE-2019-10623 | High | 7.1 | 2020-04-16 | Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Sn… |
CVE-2019-10622 | Critical | 9.1 | 2020-04-16 | Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon… |
CVE-2019-10621 | High | 7.8 | 2020-04-16 | Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10620 | High | 7.8 | 2020-04-16 | Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Co… |
CVE-2019-10610 | Critical | 9.1 | 2020-04-16 | Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Auto, Snapdragon Comp… |
CVE-2019-10609 | Critical | 9.8 | 2020-04-16 | Out of bound write can happen due to lack of check of array index value while calculating it. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-10608 | Medium | 5.5 | 2020-04-16 | Information disclosure issue occurs as there is no binding between the secure keypad session and the secure display session that allows user to take control of… |
CVE-2019-10589 | Critical | 9.8 | 2020-04-16 | Lack of length check of response buffer can lead to buffer over-flow while GP command response buffer handling in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2019-10588 | Critical | 9.8 | 2020-04-16 | Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow. in Snapdragon Auto, Snap… |
CVE-2019-10575 | High | 7.8 | 2020-04-16 | Wlan binary which is not signed with OEMs RoT is working on secure device without authentication failure in Snapdragon Compute, Snapdragon Consumer IOT, Snapdr… |
CVE-2019-10574 | High | 7.1 | 2020-04-16 | Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snap… |
CVE-2019-10556 | High | 7.8 | 2020-04-16 | Missing length check before copying the data from kernel space to userspace through the copy function can lead to buffer overflow in some cases in Snapdragon A… |
CVE-2019-10551 | Critical | 9.1 | 2020-04-16 | String error while processing non standard SIP messages received can lead to buffer overread and then denial of service in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10547 | High | 7.8 | 2020-04-16 | When issuing IOCTL calls to ION, Memory leak can occur due to failure in unassign pages under certain conditions in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-10523 | Medium | 5.5 | 2020-04-16 | Target specific data is being sent to remote server and leads to information exposure in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdrag… |
CVE-2019-10483 | Medium | 5.5 | 2020-04-16 | Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-2317 | Critical | 9.8 | 2020-03-05 | The secret key used to make the Initial Sequence Number in the TCP SYN packet could be brute forced and therefore can be predicted in Snapdragon Auto, Snapdrag… |
CVE-2019-2311 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying it in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2019-2300 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN handler due to lack of validation of destination buffer size before copying into it in Snapdragon Auto, Snapdragon Compute, Sn… |
CVE-2019-14098 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in data offload handler due to lack of check of keydata length when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Co… |
CVE-2019-14097 | Critical | 9.8 | 2020-03-05 | Possible buffer overflow in WLAN Parser due to lack of length check when copying data in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14095 | Critical | 9.8 | 2020-03-05 | Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon Auto, Snapdragon Co… |
CVE-2019-14086 | Critical | 9.8 | 2020-03-05 | Possible integer overflow while checking the length of frame which is a 32 bit integer and is added to another 32 bit integer which can lead to unexpected resu… |
CVE-2019-14085 | High | 7.8 | 2020-03-05 | Possible Integer underflow in WLAN function due to lack of check of data received from user side in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer El… |
CVE-2019-14083 | Critical | 9.8 | 2020-03-05 | While parsing Service Descriptor Extended Attribute received as part of SDF frame, there is a possibility that incorrect length is specified in the attribute l… |
CVE-2019-14082 | Critical | 9.1 | 2020-03-05 | Potential buffer over-read due to lack of bound check of memory offset passed in WLAN firmware in Snapdragon Compute, Snapdragon Consumer Electronics Connectiv… |
CVE-2019-14081 | High | 7.1 | 2020-03-05 | Buffer Over-read when WLAN module gets a WMI message for SAR limits with invalid number of limits to be enforced in Snapdragon Compute, Snapdragon Consumer Ele… |
CVE-2019-14079 | High | 7.8 | 2020-03-05 | Access to the uninitialized variable when the driver tries to unmap the dma buffer of a request which was never mapped in the first place leading to kernel fai… |
CVE-2019-14072 | High | 7.0 | 2020-03-05 | Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free and sparse bind ioctls which ac… |
CVE-2019-14071 | High | 7.8 | 2020-03-05 | Compromised reset handler may bypass access control due to AC config is being reset if debug path is enabled to collect secure or non-secure ram dumps in Snapd… |
CVE-2019-14068 | High | 7.8 | 2020-03-05 | Out of bound access in msm routing due to lack of check of size before accessing in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon In… |
CVE-2019-14061 | High | 7.5 | 2020-03-05 | Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2019-14050 | High | 7.8 | 2020-03-05 | Out-of-bound writes occurs due to lack of check of buffer size will cause buffer overflow only in 32bit architecture. in Snapdragon Auto, Snapdragon Compute, S… |