Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2020-3632—u'Incorrect validation of ring context fetched from host memory can lead to memory overflow' in Snapdragon Compute, Snapdragon Mobile in QSMEPSS 0.2%CVE-2019-10602—Potential use-after-free heap error during Validate/Present calls on display HW composer in Snapdragon Auto, Snapdragon Compute, Snapdragon EPSS 0.2%CVE-2019-14028—Buffer overwrite during memcpy due to lack of check on SSID length validation in Snapdragon Auto, Snapdragon Compute, Snapdragon ConnectivitEPSS 0.2%CVE-2019-14023—String format issue will occur while processing HLOS data as there is no user input validation to ensure inputs are properly NULL terminatedEPSS 0.2%CVE-2020-11127—u'Integer overflow can cause a buffer overflow due to lack of table length check in the extensible boot Loader during the validation of secuEPSS 0.2%CVE-2019-2329—Use after free issue in cleanup routine due to missing pointer sanitization for a failed start of a trusted application. in Snapdragon CompuEPSS 0.2%CVE-2020-11245HIGHUnintended reads and writes by NS EL2 in access control driver due to lack of check of input validation in Snapdragon Auto, Snapdragon CompuEPSS 0.2%CVE-2019-14060—Uninitialized stack data gets used If memory is not allocated for blob or if the allocated blob is less than the struct size required due toEPSS 0.2%CVE-2019-14030—The size of a buffer is determined by addition and multiplications operations that have the potential to overflow due to lack of bound checkEPSS 0.2%CVE-2018-11298—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing SET_PASSPOINT_LEPSS 0.2%CVE-2019-14066—Integer overflow in calculating estimated output buffer size when getting a list of installed Feature IDs, Serial Numbers or checking FeaturEPSS 0.2%CVE-2018-11897—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while processing diag event afteEPSS 0.2%CVE-2019-14085—Possible Integer underflow in WLAN function due to lack of check of data received from user side in Snapdragon Auto, Snapdragon Compute, SnaEPSS 0.2%CVE-2020-11234HIGHWhen sending a socket event message to a user application, invalid information will be passed if socket is freed by other thread resulting iEPSS 0.2%CVE-2019-10585—Possible integer overflow happens when mmap find function will increment refcount every time when it invokes and can lead to use after free EPSS 0.2%CVE-2020-11237HIGHMemory crash when accessing histogram type KPI input received due to lack of check of histogram definition before accessing it in SnapdragonEPSS 0.2%CVE-2019-10537—Improper validation of event buffer extracted from FW response can lead to integer overflow, which will allow to pass the length check and eEPSS 0.2%CVE-2019-14009—Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in SnaEPSS 0.2%CVE-2019-14122—Memory failure in SKB if it fails to to add the requested padding to the skb in low memory targets or targets with major memory fragmentatioEPSS 0.2%CVE-2019-10583—Use after free issue occurs when camera access sensors data through direct report mode in Snapdragon Auto, Snapdragon Compute, Snapdragon CoEPSS 0.2%