Vulnerabilities in Qualcomm, Inc.

2,934 results
Vexday analysis

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2015-9044—In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reacEPSS 0.8%CVE-2015-9067—In all Qualcomm products with Android releases from CAF using the Linux kernel, a potential compiler optimization of memset() is addressed.EPSS 0.8%CVE-2015-9035—In all Qualcomm products with Android releases from CAF using the Linux kernel, a memory buffer fails to be freed after it is no longer needEPSS 0.8%CVE-2015-8596—In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of buffer lengths is missing in malware protectioEPSS 0.8%CVE-2015-9046—In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in LTE where an assertion can be reacEPSS 0.8%CVE-2014-9973—In all Qualcomm products with Android releases from CAF using the Linux kernel, validation of a buffer length was missing in a PlayReady DRMEPSS 0.8%CVE-2016-10388—In all Qualcomm products with Android releases from CAF using the Linux kernel, a configuration vulnerability exists when loading a 3rd-partEPSS 0.8%CVE-2015-9060—In all Qualcomm products with Android releases from CAF using the Linux kernel, a pointer is not properly validated in a QTEE system call.EPSS 0.8%CVE-2015-9068—In all Qualcomm products with Android releases from CAF using the Linux kernel, an argument to a mink syscall is not properly validated.EPSS 0.8%CVE-2016-10343—In all Qualcomm products with Android releases from CAF using the Linux kernel, sSL handshake failure with ClientHello rejection results in EPSS 0.8%CVE-2015-9048—In all Qualcomm products with Android releases from CAF using the Linux kernel, a vulnerability exists in the processing of lost RTP packetsEPSS 0.8%CVE-2015-9037—In all Qualcomm products with Android releases from CAF using the Linux kernel, a buffer over-read may occur in the processing of a downlinkEPSS 0.8%CVE-2020-11158—u'Null pointer dereference in HP OfficeJet Pro 8210 jbig2 filter due to lack of check of PDF font array leads to denial of service' in IPS PEPSS 0.8%CVE-2017-7364—In all Qualcomm products with Android releases from CAF using the Linux kernel, in function __mdss_fb_copy_destscaler_data(), variable ds_daEPSS 0.8%CVE-2018-5876—While parsing an mp4 file, a buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.EPSS 0.8%CVE-2018-11935—Improper input validation might result in incorrect app id returned to the caller Instead of returning failure in Snapdragon Auto, SnapdragoEPSS 0.8%CVE-2018-5874—While parsing an mp4 file, a stack-based buffer overflow can occur in Snapdragon Automobile, Snapdragon Mobile and Snapdragon Wear.EPSS 0.8%CVE-2020-11279HIGHMemory corruption while processing crafted SDES packets due to improper length check in sdes packets recieved in Snapdragon Auto, SnapdragonEPSS 0.8%CVE-2020-11163—Possible buffer overflow while updating ikev2 parameters due to lack of check of input validation for certain parameters received from the eEPSS 0.8%CVE-2021-35088HIGHPossible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon CEPSS 0.8%