Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2018-11967—Signature verification of the skel library could potentially be disabled as the memory region on the remote subsystem in which the library iEPSS 0.2%CVE-2019-10629—u'User Process can potentially corrupt kernel virtual page by passing a crafted page in API' in Snapdragon Auto, Snapdragon Compute, SnapdraEPSS 0.2%CVE-2019-10628—u'Memory can be potentially corrupted if random index is allowed to manipulate TLB entries in Kernel from user library' in Snapdragon Auto, EPSS 0.2%CVE-2015-9217—In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile and Snapdragon Wear MSM8909W, SD 210/SD 212/SD 20EPSS 0.2%CVE-2018-12013—Improper authentication in locked memory region can lead to unprivilged access to the memory in Snapdragon Auto, Snapdragon Compute, SnapdraEPSS 0.2%CVE-2018-3583—A buffer overflow can occur while processing an extscan hotlist event in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, SnapEPSS 0.2%CVE-2018-13896—XBL_SEC image authentication and other crypto related validations are accessible to a compromised OEM XBL Loader due to missing lock at XBL_EPSS 0.2%CVE-2017-18322—Cryptographic key material leaked in WCDMA debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDEPSS 0.2%CVE-2020-11149—Out of bound access due to usage of an out-of-range pointer offset in the camera driver. in Snapdragon Auto, Snapdragon Compute, Snapdragon EPSS 0.2%CVE-2017-18324—Cryptographic key material leaked in debug messages - GERAN in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, EPSS 0.2%CVE-2018-11925—Data length received from firmware is not validated against the max allowed size which can result in buffer overflow. in Snapdragon Auto, SnEPSS 0.2%CVE-2017-18319—Information leak in UIM API debug messages in snapdragon mobile and snapdragon wear in versions MDM9206, MDM9607, MDM9615, MDM9625, MDM9635MEPSS 0.2%CVE-2017-11004—A non-secure user may be able to access certain registers in snapdragon automobile, snapdragon mobile and snapdragon wear in versions IPQ807EPSS 0.2%CVE-2020-11150—Out of bound memory access in camera driver due to improper validation on data coming from UMD which is used for offset manipulation of poinEPSS 0.2%CVE-2020-11146—Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon Auto, Snapdragon CompEPSS 0.2%CVE-2017-18321—Security keys used by the terminal and NW for a session could be leaked in snapdragon mobile in versions MDM9650, MDM9655, SD 835, SDA660.EPSS 0.2%CVE-2017-18323—Cryptographic key material leaked in TDSCDMA RRC debug messages in snapdragon automobile, snapdragon mobile and snapdragon wear in versions EPSS 0.2%CVE-2017-18326—Cryptographic keys are printed in modem debug messages in snapdragon mobile and snapdragon wear in versions MDM9607, MDM9615, MDM9625, MDM96EPSS 0.2%CVE-2020-11148—Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggEPSS 0.2%CVE-2017-18172—In a device, with screen size 1440x2560, the check of contiguous buffer will overflow on certain buffer size resulting in an Integer OverfloEPSS 0.2%