Qualcomm Snapdragon 865 5G Mobile vulnerabilities, page 3
63 vulnerabilities
Known vulnerabilities in Qualcomm Snapdragon 865 5G Mobile, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CriticalCVE-2023-43548qualcomm, inc. · snapdragon +136 moreBuffer Copy Without Checking Size of Input in VideoMemory corruption while parsing qcp clip with invalid chunk data size.EPSS0.26%HighCVE-2023-43524qualcomm, inc. · snapdragon +56 moreBuffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in AudioMemory corruption when the bandpass filter order received from AHAL is not within the expected range.EPSS0.11%HighCVE-2023-43529qualcomm, inc. · snapdragon +154 moreReachable Assertion in Data ModemTransient DOS while processing IKEv2 Informational request messages, when a malformed fragment packet is received.EPSS0.32%HighCVE-2023-43549qualcomm, inc. · snapdragon +136 moreStack-based Buffer Overflow in WLAN HALMemory corruption while processing TPC target power table in FTM TPC.EPSS0.11%HighCVE-2023-43530qualcomm, inc. · snapdragon +154 moreInteger Overflow or Wraparound in HLOSMemory corruption in HLOS while checking for the storage type.EPSS0.11%HighCVE-2023-43531qualcomm, inc. · snapdragon +124 moreAccess of Uninitialized Pointer in SPS ApplicationsMemory corruption while verifying the serialized header when the key pairs are generated.EPSS0.11%MediumCVE-2023-43528qualcomm, inc. · snapdragon +90 moreBuffer Over-read in AudioInformation disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.EPSS0.11%HighCVE-2023-43539qualcomm, inc. · snapdragon +135 moreBuffer Over-read in WLAN FirmwareTransient DOS while processing an improperly formatted 802.11az Fine Time Measurement protocol frame.EPSS0.32%CriticalCVE-2023-43538qualcomm, inc. · snapdragon +133 moreBuffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in TZ Secure OSMemory corruption in TZ Secure OS while Tunnel Invoke Manager initialization.EPSS0.10%HighCVE-2023-28547qualcomm, inc. · snapdragon +295 moreBuffer Copy Without Checking Size of Input in SPS ApplicationsMemory corruption in SPS Application while requesting for public key in sorter TA.EPSS0.11%CriticalCVE-2023-28578qualcomm, inc. · snapdragon +333 moreImproper Input Validation in ServicesMemory corruption in Core Services while executing the command for removing a single event listener.EPSS0.12%HighCVE-2023-33101qualcomm, inc. · snapdragon +97 moreIncorrect Type Conversion or Cast in Multi-Mode Call ProcessorTransient DOS while processing DL NAS TRANSPORT message with payload length 0.EPSS0.32%HighCVE-2023-33099qualcomm, inc. · snapdragon +97 moreImproper Input Validation in Multi-Mode Call ProcessorTransient DOS while processing SMS container of non-standard size received in DL NAS transport in NR.EPSS0.32%HighCVE-2023-33023qualcomm, inc. · snapdragon +281 moreBuffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in SPS-ApplicationsMemory corruption while processing finish_sign command to pass a rsp buffer.EPSS0.11%HighCVE-2023-33104qualcomm, inc. · snapdragon +95 moreImproper input Validation in Multi-Mode Call ProcessorTransient DOS while processing PDU Release command with a parameter PDU ID out of range.EPSS0.32%HighCVE-2023-33119qualcomm, inc. · snapdragon +157 moreTime-of-check Time-of-use (TOCTOU) Race Condition in HypervisorMemory corruption while loading a VM from a signed VM image that is not coherent in the processor cache.EPSS0.08%MediumCVE-2023-33111qualcomm, inc. · snapdragon +83 moreImproper Validation of Array Index in AudioInformation disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.EPSS0.11%HighCVE-2023-33066qualcomm, inc. · snapdragon +307 moreUse of Out-of-range Pointer Offset in AudioMemory corruption in Audio while processing RT proxy port register driver.EPSS0.11%HighCVE-2023-33095qualcomm, inc. · snapdragon +95 moreReachable Assertion in Multi-Mode Call ProcessorTransient DOS while processing multiple payload container type with incorrect container length received in DL NAS transport OTA in NR.EPSS0.32%HighCVE-2023-33096qualcomm, inc. · snapdragon +95 moreReachable Assertion in Multi-Mode Call ProcessorTransient DOS while processing DL NAS Transport message, as specified in 3GPP 24.501 v16.EPSS0.32%