Qualcomm, Inc. Snapdragon Mobile vulnerabilities, page 4

114 vulnerabilities

Known vulnerabilities in Qualcomm, Inc. Snapdragon Mobile, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

10CriticalCVE-2016-10442qualcomm, inc. · snapdragon mobile +7 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, SDM630, MSM8976, MSM8937, SDM845, MSM8976, and MSM8952, when running module or kernel code with improper access control allowing writing to arbitrary regions of memory, the user may utilize this vector to alter module executable code.EPSS1.12%10CriticalCVE-2016-10454qualcomm, inc. · snapdragon mobile +4 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 425, SD 430, SD 450, and SD 625, in a QTEE API function, an array out-of-bounds index can occur.EPSS1.19%10CriticalCVE-2016-10458qualcomm, inc. · snapdragon mobile +25 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, SDX20, and Snapdragon_High_Med_2016, the 'proper' solution for this will be to ensure that any users of qsee_log in the bootchain (before Linux boots) unallocate their buffers and clear the qsee_log pointer. Until support for that is implemented in TZ and the bootloader, enable tz_log to avoid potential scribbling. This solution will prevent the linux kernel memory corruption.EPSS1.33%10CriticalCVE-2016-10407qualcomm, inc. · snapdragon mobile +20 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, an integer overflow leading to buffer overflow can occur during a VT call.EPSS1.34%7.8HighCVE-2016-10411qualcomm, inc. · snapdragon mobile +20 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, RTP daemon crashes and terminates VT call when UE receives RTCP unknown APP packet report which caused the parser to miss an end of RTCP packet length and go on forever looking for it, even going beyond the limits of the RTCP Packet length.EPSS0.87%10CriticalCVE-2016-10385qualcomm, inc. · snapdragon mobilequalcomm, inc. snapdragon mobileIn all Qualcomm products with Android releases from CAF using the Linux kernel, a use-after-free vulnerability exists in IMS RCS.EPSS1.00%10CriticalCVE-2016-10419qualcomm, inc. · snapdragon mobile +13 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9640, MDM9645, MDM9650, MDM9655, SD 450, SD 625, SD 650/52, SD 820, SD 835, SD 845, SD 850, and SDX20, when initializing scheduler object service request, an out of bounds access could occur due to uninitialized object number.EPSS1.19%7.5HighCVE-2016-10406qualcomm, inc. · snapdragon mobile +19 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9650, SD 210/SD 212/SD 205, SD 410/12, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 808, SD 810, SD 820, and SD 835, while printing debug message of a pointer in wlan_qmi_err_cb, the real kernel address will be printed regardless of the kptr_restrict system settings.EPSS0.84%10CriticalCVE-2016-10496qualcomm, inc. · snapdragon mobile +15 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 210/SD 212/SD 205, SD 410/12, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 808, and SD 810, A NULL pointer dereference can occur during an SSL handshake.EPSS1.38%10CriticalCVE-2016-10489qualcomm, inc. · snapdragon mobile +1 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400, lack of address argument validation in qsee_get_tz_app_name() may lead to an untrusted pointer dereference.EPSS1.19%7.8HighCVE-2020-3701qualcomm, inc. · snapdragon mobile +3 morequalcomm, inc. snapdragon mobileUse after free issue while processing error notification from camx driver due to not properly releasing the sequence data in Snapdragon Mobile in Saipan, SM8250, SXR2130EPSS0.22%7.8HighCVE-2020-3623qualcomm, inc. · snapdragon mobile +2 morequalcomm, inc. snapdragon mobilekernel failure due to load failures while running v1 path directly via kernel in Snapdragon Mobile in SM8250, SXR2130EPSS0.24%10CriticalCVE-2014-9972qualcomm, inc. · snapdragon mobilequalcomm, inc. snapdragon mobileIn all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts can potentially cause a NULL pointer dereference during an out-of-memory condition.EPSS1.03%10CriticalCVE-2014-9994qualcomm, inc. · snapdragon mobile +2 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, lack of validation of input could cause a integer overflow that could subsequently lead to a buffer overflow.EPSS1.34%10CriticalCVE-2014-9985qualcomm, inc. · snapdragon mobile +3 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9635M, SD 400, and SD 800, TOCTOU condition may result in bypassing error condition checks, leading to undefined behavior.EPSS1.19%10CriticalCVE-2014-9971qualcomm, inc. · snapdragon mobilequalcomm, inc. snapdragon mobileIn all Qualcomm products with Android releases from CAF using the Linux kernel, disabling asserts causes an instruction inside of an assert to not be executed resulting in incorrect control flow.EPSS1.03%10CriticalCVE-2014-9981qualcomm, inc. · snapdragon mobilequalcomm, inc. snapdragon mobileIn all Qualcomm products with Android releases from CAF using the Linux kernel, an overflow check in the USB interface was insufficient during boot.EPSS1.03%10CriticalCVE-2014-9995qualcomm, inc. · snapdragon mobile +2 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, in drmprov_cmd_verify_key(), the variable feature_name_length is not validated. There is a check for feature_name_len + filePathLen but there might be an integer wrap when checking feature_name_len + filePathLen. This leads to a buffer overflow.EPSS1.28%10CriticalCVE-2014-9996qualcomm, inc. · snapdragon mobile +2 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile SD 400 and SD 800, while verifying provisioning, a buffer overflow can occur.EPSS1.28%7.5HighCVE-2014-10063qualcomm, inc. · snapdragon mobile +2 morequalcomm, inc. snapdragon mobileIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MDM9625 and SD 800, a fuse is not correctly blown on a secure device.EPSS0.66%