Vulnerabilidades en Qualcomm, Inc.

2976 resultados
Análisis Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2020-11164—u'Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control' in SnapdragoEPSS 0.2%CVE-2019-14099—Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, SnapdragonEPSS 0.2%CVE-2019-14037—Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnecEPSS 0.2%CVE-2019-14124—Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon MoEPSS 0.2%CVE-2019-14130—Memory corruption can occurs in trusted application if offset size from HLOS is more than actual mapped buffer size in Snapdragon Auto, SnapEPSS 0.2%CVE-2019-14093—Array out of bound access can occur in display module due to lack of bound check on input parcel received in Snapdragon Auto, Snapdragon ConEPSS 0.2%CVE-2018-3569—A buffer over-read can occur during a fast initial link setup (FILS) connection in Android releases from CAF using the linux kernel (AndroidEPSS 0.2%CVE-2019-10580—When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in SnapEPSS 0.2%CVE-2019-14100—Register write via debugfs is disabled by default to prevent register writing via debugfs. in Snapdragon Auto, Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2019-14123—Possible buffer overflow and over read possible due to missing bounds checks for fixed limits if we consider widevine HLOS client as non-truEPSS 0.2%CVE-2020-3680—A race condition can occur when using the fastrpc memory mapping API. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdEPSS 0.2%CVE-2019-2247—Possibility of double free issue while running multiple instances of smp2p test because of proper protection is missing while using global vEPSS 0.2%CVE-2021-35103HIGHPossible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon AEPSS 0.2%CVE-2019-2299—An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application. in Snapdragon Auto, Snapdragon CoEPSS 0.2%CVE-2021-35105HIGHPossible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon EPSS 0.2%CVE-2019-2301—Possibility of out-of-bound read if id received from SPI is not in range of FIFO in Snapdragon Auto, Snapdragon Compute, Snapdragon ConsumerEPSS 0.2%CVE-2018-11939—Use after issue in WLAN function due to multiple ACS scan requests at a time in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon IndustrEPSS 0.2%CVE-2019-2277—Out of bound read can happen due to lack of NULL termination on user controlled data in WLAN in Snapdragon Auto, Snapdragon Compute, SnapdraEPSS 0.2%CVE-2019-2292—Out of bound access can occur due to buffer copy without checking size of input received from WLAN firmware in Snapdragon Auto, Snapdragon CEPSS 0.2%CVE-2019-2293—Pointer dereference while freeing IFE resources due to lack of length check of in port resource. in Snapdragon Consumer IOT, Snapdragon InduEPSS 0.2%