Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2018-11858—When processing IE set command, buffer overwrite may occur due to lack of input validation of the IE length in Snapdragon Mobile in version EPSS 0.2%CVE-2018-11857—Improper input validation in WLAN encrypt/decrypt module can lead to a buffer copy in Snapdragon Mobile in version SD 835, SD 845, SD 850EPSS 0.2%CVE-2018-5913—A non-time constant function memcmp is used which creates a side channel that could leak information in Snapdragon Auto, Snapdragon Compute,EPSS 0.2%CVE-2018-11966—Undefined behavior in UE while processing unknown IEI in OTA message in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdrEPSS 0.2%CVE-2020-11217—A possible double free or invalid memory access in audio driver while reading Speaker Protection parameters in Snapdragon Compute, SnapdragoEPSS 0.2%CVE-2017-18311—XPU Master privilege escalation is possible due to improper access control of unused configuration xPU ports where unused configuration portEPSS 0.2%CVE-2019-2346—Firmware is getting into loop of overwriting memory when scan command is given from host because of improper validation. in Snapdragon CompuEPSS 0.2%CVE-2019-14099—Device misbehavior may be observed when incorrect offset, length or number of buffers is passed by user space in Snapdragon Auto, SnapdragonEPSS 0.2%CVE-2018-11968—Improper check before assigning value can lead to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdragEPSS 0.2%CVE-2018-11826—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on integer overfloEPSS 0.2%CVE-2019-14124—Memory failure in content protection module due to not having pointer within the scope in Snapdragon Auto, Snapdragon Compute, Snapdragon MoEPSS 0.2%CVE-2019-2250—Kernel can write to arbitrary memory address passed by user while freeing/stopping a thread in Snapdragon Compute, Snapdragon Consumer IOT, EPSS 0.2%CVE-2018-12012—While updating blacklisting region shared buffered memory region is not validated against newly updated black list, causing boot-up to be coEPSS 0.2%CVE-2018-11970—TZ App dynamic allocations not protected from XBL loader in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics ConnectivitEPSS 0.2%CVE-2018-11830—Improper input validation in QCPE create function may lead to integer overflow in Snapdragon Auto, Snapdragon Consumer Electronics ConnectivEPSS 0.2%CVE-2018-5839—Improperly configured memory protection allows read/write access to modem image from HLOS kernel in Snapdragon Auto, Snapdragon Compute, SnaEPSS 0.2%CVE-2018-3588—There is improper access control of the SSC and GPU mapped regions which lead to inject code from HLOS in Snapdragon Automobile, Snapdragon EPSS 0.2%CVE-2019-10580—When kernel thread unregistered listener, Use after free issue happened as the listener client`s private data has been already freed in SnapEPSS 0.2%CVE-2018-11999—Improper input validation in trustzone can lead to denial of service in snapdragon automobile, snapdragon mobile and snapdragon wear in versEPSS 0.2%CVE-2019-14037—Close and bind operations done on a socket can lead to a Use-After-Free condition. in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnecEPSS 0.2%