Qualcomm
Page 17 of 26 — Qualcomm CVEs from a corpus of 2538, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-3681 | Critical | 9.8 | 2020-07-31 | Authenticated and encrypted payload MMEs can be forged and remotely sent to any HPAV2 system using a jailbreak key recoverable from code. |
CVE-2020-3701 | High | 7.8 | 2020-07-30 | Use after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM825… |
CVE-2020-3700 | High | 7.5 | 2020-07-30 | Possible out of bounds read due to a missing bounds check and could lead to local information disclosure in the wifi driver with no additional execution privil… |
CVE-2020-3699 | Critical | 9.8 | 2020-07-30 | Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon C… |
CVE-2020-3698 | Critical | 9.8 | 2020-07-30 | Out of bound write while QoS DSCP mapping due to improper input validation for data received from association response frame in Snapdragon Auto, Snapdragon Com… |
CVE-2020-3688 | Critical | 9.8 | 2020-07-30 | Possible buffer overflow while parsing mp4 clip with corrupted sample atoms due to improper validation of index in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2020-3671 | Critical | 9.8 | 2020-07-30 | Use-after-free issue could occur due to dangling pointer when generating a frame buffer in OpenGL ES in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon… |
CVE-2019-14130 | High | 7.8 | 2020-07-30 | Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, Snapdragon Compute, Sna… |
CVE-2019-14124 | High | 7.8 | 2020-07-30 | Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Wi… |
CVE-2019-14123 | High | 7.8 | 2020-07-30 | Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-trustable in Snapdrago… |
CVE-2019-14101 | High | 7.1 | 2020-07-30 | Out of bounds read can happen in diag event set mask command handler when user provided length in the command request is less than expected length in Snapdrago… |
CVE-2019-14100 | High | 7.8 | 2020-07-30 | Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14099 | High | 7.8 | 2020-07-30 | Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2019-14093 | High | 7.8 | 2020-07-30 | Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon Connectivity, Snapdrag… |
CVE-2019-14037 | High | 7.8 | 2020-07-30 | Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2019-10580 | High | 7.8 | 2020-07-30 | When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in Snapdragon Auto, Snapdr… |
CVE-2020-3676 | High | 7.8 | 2020-06-22 | Possible memory corruption in perfservice due to improper validation array length taken from user application. in Snapdragon Auto, Snapdragon Consumer IOT, Sna… |
CVE-2020-3665 | High | 7.8 | 2020-06-22 | A possible buffer overflow would occur while processing command from firmware due to the group_id obtained from the firmware being out of range in Snapdragon A… |
CVE-2020-3663 | Critical | 9.8 | 2020-06-22 | Buffer over-write may occur during fetching track decoder specific information if cb size exceeds buffer size in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2020-3662 | Critical | 9.8 | 2020-06-22 | Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2020-3661 | Critical | 9.8 | 2020-06-22 | Buffer overflow will happen while parsing mp4 clip with corrupted sample atoms values which exceeds MAX_UINT32 range due to lack of validation checks in Snapdr… |
CVE-2020-3660 | Critical | 9.8 | 2020-06-22 | Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2020-3658 | Critical | 9.1 | 2020-06-22 | Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connect… |
CVE-2020-3642 | High | 7.8 | 2020-06-22 | Use after free issue in camera applications when used randomly over multiple operations due to pointer not set to NULL after free/destroy of the object in Snap… |
CVE-2020-3635 | High | 7.8 | 2020-06-22 | Stack based overflow If the maximum number of arguments allowed per request in perflock exceeds in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2020-3628 | Critical | 9.8 | 2020-06-22 | Improper access due to socket opened by the logging application without specifying localhost address in Snapdragon Consumer IOT, Snapdragon Mobile in APQ8053… |
CVE-2020-3626 | High | 7.8 | 2020-06-22 | Any application can bind to it and exercise the APIs due to no protection for AIDL uimlpaservice in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IO… |
CVE-2020-3614 | Critical | 9.8 | 2020-06-22 | Possible buffer overflow while copying the frame to local buffer due to lack of check of length before copying in Snapdragon Auto, Snapdragon Compute, Snapdrag… |
CVE-2020-3613 | High | 7.8 | 2020-06-22 | Double free issue in kernel memory mapping due to lack of memory protection mechanism in Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in SM8… |
CVE-2019-14094 | High | 7.8 | 2020-06-22 | Integer overflow in diag command handler when user inputs a large value for number of tasks field in the request packet in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14092 | Medium | 5.5 | 2020-06-22 | System Services exports services without permission protect and can lead to information exposure in Snapdragon Industrial IOT, Snapdragon Mobile in MDM9206, MD… |
CVE-2019-14091 | High | 7.8 | 2020-06-22 | Double free issue in NPU due to lack of resource locking mechanism to avoid race condition in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Sna… |
CVE-2019-14080 | Critical | 9.8 | 2020-06-22 | Out of bound write can happen due to lack of check of array index value while parsing SDP attribute for SAR in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14076 | High | 7.8 | 2020-06-22 | Buffer overflow occurs while processing an subsample data length out of range due to lack of user input validation in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14073 | Critical | 9.8 | 2020-06-22 | Copying RTCP messages into the output buffer without checking the destination buffer size which could lead to a remote stack overflow when processing large dat… |
CVE-2019-14062 | Critical | 9.8 | 2020-06-22 | Buffer overflows while decoding setup message from Network due to lack of check of IE message length received from network in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-14047 | High | 7.8 | 2020-06-22 | While IPA driver processes route add rule IOCTL, there is no input validation of the rule ID prior to adding the rule to the IPA HW commit list in Snapdragon A… |
CVE-2019-10626 | Medium | 5.5 | 2020-06-22 | Payload size is not validated before reading memory that may cause issue of accessing invalid pointer or some garbage data in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-10597 | High | 7.8 | 2020-06-22 | kernel writes to user passed address without any checks can lead to arbitrary memory write in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Sna… |
CVE-2020-3680 | High | 7.0 | 2020-06-02 | A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IO… |
CVE-2020-3645 | High | 7.5 | 2020-06-02 | Firmware will hit assert in WLAN firmware If encrypted data length in FILS IE of reassoc response is more than 528 bytes in Snapdragon Compute, Snapdragon Conn… |
CVE-2020-3641 | Critical | 9.8 | 2020-06-02 | Integer overflow may occur if atom size is less than atom offset as there is improper validation of atom size in Snapdragon Auto, Snapdragon Compute, Snapdrago… |
CVE-2020-3633 | Critical | 9.8 | 2020-06-02 | Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snapdragon Auto, Snapdr… |
CVE-2020-3630 | High | 7.8 | 2020-06-02 | Possibility of out of bound access while processing the responses from video firmware in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdrag… |
CVE-2020-3625 | High | 7.8 | 2020-06-02 | When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon Auto, Snapdragon Consu… |
CVE-2020-3623 | High | 7.8 | 2020-06-02 | kernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130 |
CVE-2020-3618 | High | 7.8 | 2020-06-02 | NULL exception due to accessing bad pointer while posting events on RT FIFO in Snapdragon Compute, Snapdragon Mobile, Snapdragon Wired Infrastructure and Netwo… |
CVE-2020-3616 | High | 7.8 | 2020-06-02 | Buffer overflow in display function due to memory copy without checking length of size using strcpy function in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2020-3615 | Critical | 9.8 | 2020-06-02 | Valid deauth/disassoc frames is dropped in case if RMF is enabled and some rouge peer keep on sending rogue deauth/disassoc frames due to improper enum values… |
CVE-2020-3610 | High | 7.8 | 2020-06-02 | Possibility of double free of the drawobj that is added to the drawqueue array of the context during IOCTL commands as there is no refcount taken for this obje… |
CVE-2019-14087 | High | 7.8 | 2020-06-02 | Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, Snapdragon Mobile, Snapd… |
CVE-2019-14078 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing qpay due to not validating length of the response buffer provided by User. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14077 | High | 7.8 | 2020-06-02 | Out of bound memory access while processing ese transmit command due to passing Response buffer received from user in Snapdragon Auto, Snapdragon Compute, Snap… |
CVE-2019-14067 | Medium | 5.5 | 2020-06-02 | Using non-time-constant functions like memcmp to compare sensitive data can lead to information leakage through timing side channel issue. in Snapdragon Auto… |
CVE-2019-14066 | High | 7.8 | 2020-06-02 | Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking Feature ID status in Snap… |
CVE-2019-14054 | High | 7.8 | 2020-06-02 | Improper permissions in XBL_SEC region enable user to update XBL_SEC code and data and divert the RAM dump path to normal cold boot path in Snapdragon Compute… |
CVE-2019-14053 | High | 7.1 | 2020-06-02 | When attempting to create a new XFRM policy, a stack out-of-bounds read will occur if the user provides a template where the mode is set to a value that does n… |
CVE-2019-14043 | High | 7.1 | 2020-06-02 | Out of bound read in Fingerprint application due to requested data is being used without length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connec… |
CVE-2019-14042 | High | 7.1 | 2020-06-02 | Out of bound read in in fingerprint application due to requested data assigned to a local buffer without length check in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-14039 | High | 7.1 | 2020-06-02 | Out of bound read in adm call back function due to incorrect boundary check for payload in command response in Snapdragon Auto, Snapdragon Compute, Snapdragon… |
CVE-2019-14038 | High | 7.1 | 2020-06-02 | Buffer over-read in ADSP parse function due to lack of check for availability of sufficient data payload received in command response in Snapdragon Auto, Snapd… |
CVE-2019-20775 | Medium | 5.5 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 9.0 (Qualcomm SDM450, SDM845, SM6150, and SM8150 chipsets) software. Weak encryption leads to loca… |
CVE-2020-3653 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read in windows wlan driver function due to lack of check of length of variable received from userspace in Snapdragon Compute, Snapdragon… |
CVE-2020-3652 | Critical | 9.1 | 2020-04-16 | Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable receive… |
CVE-2020-3651 | High | 7.5 | 2020-04-16 | Active command timeout since WM status change cmd is not removed from active queue if peer sends multiple deauth frames. in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14135 | High | 7.8 | 2020-04-16 | Possible integer overflow to buffer overflow in WLAN while parsing nonstandard NAN IE messages. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2019-14134 | Critical | 9.8 | 2020-04-16 | Possible out of bound access in WLAN handler when the received value of length in rx path is shorter than the expected value of country IE in Snapdragon Comput… |
CVE-2019-14132 | Critical | 9.8 | 2020-04-16 | Buffer over-write when this 0-byte buffer is typecasted to some other structure and hence memory corruption in Snapdragon Auto, Snapdragon Consumer IOT, Snapdr… |
CVE-2019-14131 | Critical | 9.8 | 2020-04-16 | Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Auto, Snapdragon Compu… |
CVE-2019-14127 | Critical | 9.8 | 2020-04-16 | Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |
CVE-2019-14122 | High | 7.8 | 2020-04-16 | Memory failure in SKB if it fails to to add the requested padding to the skb in low memory targets or targets with major memory fragmentation in Snapdragon Aut… |
CVE-2019-14116 | High | 7.8 | 2020-04-16 | Privilege escalation by using an altered debug policy image can occur as the XPU protecting the debug policy regions are disabled during the crash dump boot fl… |
CVE-2019-14114 | Critical | 9.8 | 2020-04-16 | Buffer overflow in WLAN firmware while parsing GTK IE containing GTK key having length more than the buffer size in Snapdragon Auto, Snapdragon Compute, Snapdr… |
CVE-2019-14113 | Critical | 9.8 | 2020-04-16 | Buffer overflow can occur in In WLAN firmware while unwraping data using CCMP cipher suite during parsing of EAPOL handshake frame in Snapdragon Auto, Snapdrag… |
CVE-2019-14112 | Critical | 9.8 | 2020-04-16 | Potential buffer overflow while processing CBF frames due to lack of check of buffer length before copy in Snapdragon Auto, Snapdragon Compute, Snapdragon Cons… |
CVE-2019-14111 | Critical | 9.8 | 2020-04-16 | Possible buffer overflow while handling NAN reception of NMF in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics C… |
CVE-2019-14110 | Critical | 9.8 | 2020-04-16 | Buffer overflow can occur in function wlan firmware while copying association frame content if frame length is more than the maximum buffer size in case of SAP… |
CVE-2019-14105 | High | 7.8 | 2020-04-16 | Kernel was reading the CSL defined reserved field as uint16 instead of uint32 which could lead to memory overflow in Snapdragon Industrial IOT, Snapdragon Mobi… |
CVE-2019-14104 | High | 7.1 | 2020-04-16 | Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in Snapdragon Compute, Snapdrago… |
CVE-2019-14075 | Medium | 5.5 | 2020-04-16 | Null pointer dereference issue in radio interface layer due to lack of null check in sapmodule destructor in Snapdragon Auto, Snapdragon Consumer IOT, Snapdrag… |
CVE-2019-14070 | High | 7.0 | 2020-04-16 | Possible use after free issue in pcm volume controls due to race condition exist in private data used in mixer controls in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-14033 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach reject/attach accept in Snapdragon Auto… |
CVE-2019-14022 | High | 7.5 | 2020-04-16 | Error occurs While extracting the ipv6_header having an invalid length due to lack of length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer… |
CVE-2019-14021 | High | 7.8 | 2020-04-16 | Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payload size received in… |
CVE-2019-14020 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding dedicated_eps_bearer_req/ act_def_context_req/ cs_serv_notification/ emm_info/ guti_r… |
CVE-2019-14019 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding RAU accept/PDN disconnect Rej/Modify EPS ctxt req/bearer resource alloc Rej/Deact EPs… |
CVE-2019-14018 | High | 7.8 | 2020-04-16 | Possible out of bound array access as there is no check on carrier index passed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Ind… |
CVE-2019-14012 | High | 7.5 | 2020-04-16 | Possibility of null pointer deference as the array of video codecs from media info is referenced without null checking while processing SDP messages in Snapdra… |
CVE-2019-14011 | Critical | 9.1 | 2020-04-16 | Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data transport/ bearer modify conte… |
CVE-2019-14009 | High | 7.8 | 2020-04-16 | Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Snapdragon Auto, Snapd… |
CVE-2019-14007 | Medium | 5.5 | 2020-04-16 | Due to the use of non-time-constant comparison functions there is issue in timing side channels which can be used as a potential side channel for SUI corruptio… |
CVE-2019-14001 | High | 7.8 | 2020-04-16 | Wrong public key usage from existing oem_keystore for hash generation in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile… |
CVE-2019-10625 | High | 7.1 | 2020-04-16 | Out of bound access in diag services when DCI command buffer reallocation is not done properly with required capacity in Snapdragon Auto, Snapdragon Compute, S… |
CVE-2019-10624 | High | 7.8 | 2020-04-16 | While handling the vendor command there is an integer truncation issue that could yield a buffer overflow due to int data type copied to u8 data type in Snapdr… |
CVE-2019-10623 | High | 7.1 | 2020-04-16 | Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Sn… |
CVE-2019-10622 | Critical | 9.1 | 2020-04-16 | Out of bound memory access can happen while parsing ADSP message due to lack of check of size of payload received from userspace in Snapdragon Auto, Snapdragon… |
CVE-2019-10621 | High | 7.8 | 2020-04-16 | Use after free issue when MAP and UNMAP calls at same time as data structure used my MAP may be freed by UNMAP function in Snapdragon Auto, Snapdragon Compute… |
CVE-2019-10620 | High | 7.8 | 2020-04-16 | Kernel memory error in debug module due to improper check of user data length before copying into memory in Snapdragon Auto, Snapdragon Consumer Electronics Co… |
CVE-2019-10610 | Critical | 9.1 | 2020-04-16 | Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Auto, Snapdragon Comp… |
CVE-2019-10609 | Critical | 9.8 | 2020-04-16 | Out of bound write can happen due to lack of check of array index value while calculating it. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT… |