Qualcomm, Inc. Snapdragon Mobile, Snapdragon Wear vulnerabilities, page 3

118 vulnerabilities

Known vulnerabilities in Qualcomm, Inc. Snapdragon Mobile, Snapdragon Wear, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

10CriticalCVE-2015-9205qualcomm, inc. · snapdragon mobile, snapdragon wear +10 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 410/12, SD 615/16/SD 415, SD 808, and SD 810, in a PlayReady API function, a buffer over-read can occur.EPSS1.25%10CriticalCVE-2015-9127qualcomm, inc. · snapdragon mobile, snapdragon wear +11 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, and SD 810, possible null pointer dereference occurs due to failure of memory allocation when a large value is passed for buffer allocation in the Playready App.EPSS1.26%10CriticalCVE-2015-9136qualcomm, inc. · snapdragon mobile, snapdragon wear +19 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9640, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 600, SD 625, SD 650/52, SD 808, SD 810, SD 820, SD 835, and SDX20, in pre-auth request, Host driver uses FT IEs sent by the supplicant. A buffer overflow may occur if FT IEs sent by the supplicant are larger than the expected value.EPSS1.28%10CriticalCVE-2015-9135qualcomm, inc. · snapdragon mobile, snapdragon wear +20 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9625, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 800, SD 808, and SD 810, in a QTEE syscall handler, an untrusted pointer dereference can occur.EPSS1.19%10CriticalCVE-2015-9200qualcomm, inc. · snapdragon mobile, snapdragon wear +12 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9650, SD 210/SD 212/SD 205, SD 425, SD 430, SD 450, SD 625, SD 650/52, and SD 835, in some TrustZone API functions, untrusted pointers can be dereferenced.EPSS1.19%10CriticalCVE-2015-9190qualcomm, inc. · snapdragon mobile, snapdragon wear +19 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, if start_addr + size is too large in boot_clobber_check_local_address_range(), an integer overflow occurs, resulting in clobber protection check being bypassed and SBL memory corruption.EPSS1.21%7.5HighCVE-2015-9213qualcomm, inc. · snapdragon mobile, snapdragon wear +35 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, the DIAG-EFS command EFS2_DIAG_DELTREE, which is handled by the function fs_diag_deltree_handler(), is used to delete files and directories only inside the /public folder.EPSS0.66%10CriticalCVE-2015-9191qualcomm, inc. · snapdragon mobile, snapdragon wear +20 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 617, SD 650/52, SD 808, SD 810, and SDX20, in a QTEE syscall handler, an untrusted pointer dereference can occur.EPSS1.19%10CriticalCVE-2015-9143qualcomm, inc. · snapdragon mobile, snapdragon wear +21 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9640, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, and SDX20, when reading CDT from eMMC with a very large meta offset (>size of default CDT-array compiled in bootloader) for one of the CDBs, a buffer overflow occurs.EPSS1.28%10CriticalCVE-2015-9208qualcomm, inc. · snapdragon mobile, snapdragon wear +18 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 800, and SD 810, the function tzbsp_pil_verify_sig() does not strictly check that the pointer to ELF and program headers and hash segment is within secure memory. It only checks that the address is not in non-secure memory. A given address range can overlap with both secure and non-secure regions - hence if such an address is passed in, it would not pass the non-secure range check, and would be considered valid by the function, even though that memory area could be modified by the non-secure side.EPSS1.19%10CriticalCVE-2015-9122qualcomm, inc. · snapdragon mobile, snapdragon wear +28 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9640, MDM9645, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, and SD 835, possible buffer overflow if SIM card sends a response greater than 64KB of data for stream APDU command.EPSS1.38%7.8HighCVE-2015-9222qualcomm, inc. · snapdragon mobile, snapdragon wear +24 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, and Snapdragon_High_Med_2016, processing erroneous bitstreams may result in a HW freeze. FW should detect the HW freeze based on watchdog timer, but because the watchdog timer is not enabled, an infinite loop occurs, resulting in a device freeze.EPSS4.27%10CriticalCVE-2015-9130qualcomm, inc. · snapdragon mobile, snapdragon wear +15 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 615/16/SD 415, SD 617, SD 650/52, SD 808, and SD 810, in a PlayReady function, a NULL pointer dereference can occur.EPSS1.26%7.5HighCVE-2015-9189qualcomm, inc. · snapdragon mobile, snapdragon wear +19 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear IPQ4019, MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 600, SD 615/16/SD 415, SD 808, and SD 810, processing of TZ application command in tz_app_cmd_handler function could lead to potential content disclosure of secure memory.EPSS0.85%10CriticalCVE-2015-9156qualcomm, inc. · snapdragon mobile, snapdragon wear +19 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 615/16/SD 415, SD 617, SD 800, SD 808, and SD 810, when making a high speed Dual Carrier Downlink Data call in a multicell environment, a buffer overflow may occur.EPSS1.28%10CriticalCVE-2015-9209qualcomm, inc. · snapdragon mobile, snapdragon wear +34 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9615, MDM9625, MDM9635M, MDM9640, MDM9645, MDM9650, MDM9655, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, SD 845, SD 850, and SDX20, there is improper access control in a file storage API.EPSS1.12%10CriticalCVE-2015-8594qualcomm, inc. · snapdragon mobile, snapdragon wearqualcomm, inc. snapdragon mobile, snapdragon wearIn all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read vulnerability exists in RFA-1x.EPSS1.17%10CriticalCVE-2015-8593qualcomm, inc. · snapdragon mobile, snapdragon wearqualcomm, inc. snapdragon mobile, snapdragon wearIn all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer overflow vulnerability exists in 1x call processing.EPSS1.27%10CriticalCVE-2016-10380qualcomm, inc. · snapdragon mobile, snapdragon wearqualcomm, inc. snapdragon mobile, snapdragon wearIn all Qualcomm products with Android releases from CAF using the Linux kernel, the UE can send unprotected MeasurementReports revealing UE location.EPSS1.04%10CriticalCVE-2016-10473qualcomm, inc. · snapdragon mobile, snapdragon wear +27 morequalcomm, inc. snapdragon mobile, snapdragon wearIn Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9650, MSM8909W, SD 210/SD 212/SD 205, SD 400, SD 410/12, SD 425, SD 430, SD 450, SD 600, SD 615/16/SD 415, SD 617, SD 625, SD 650/52, SD 800, SD 808, SD 810, SD 820, SD 835, and SDX20, in a supplementary services function, a buffer overflow can occur.EPSS1.28%