Vulnerabilidades em Qualcomm, Inc.

2.991 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2019-14021—Possible buffer overrun when processing EFS filename and payload sent over diag interface due to lack of check for filename length and payloEPSS 0.2%CVE-2020-3625—When making query to DSP capabilities, Stack out of bounds occurs due to wrong buffer length configured for DSP attributes in Snapdragon AutEPSS 0.2%CVE-2019-10604—Possibility of heap-buffer-overflow during last iteration of loop while populating image version information in diag command response packetEPSS 0.2%CVE-2018-11860—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, a potential buffer over flow couEPSS 0.2%CVE-2019-14034—Use after free while processing eeprom query as there is a chance to not unlock mutex after error occurs in Snapdragon Auto, Snapdragon CompEPSS 0.2%CVE-2018-11851—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, lack of check on input received EPSS 0.2%CVE-2018-11265—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, possible buffer overflow while iEPSS 0.2%CVE-2020-11199—HLOS to access EL3 stack canary by just mapping imem region due to Improper access control and can lead to information exposure in SnapdragoEPSS 0.2%CVE-2019-14032—Memory use after free issue in audio due to lack of resource control in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, SnapdrEPSS 0.2%CVE-2019-14049—Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in SnapdEPSS 0.2%CVE-2019-10558—While transferring data from APPS to DSP, Out of bound in FastRPC HLOS Driver due to the data buffer which can be controlled by DSP in SnapdEPSS 0.2%CVE-2018-11895—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, improper length check ValidationEPSS 0.2%CVE-2018-11262—In Android for MSM, Firefox OS for MSM, and QRD Android with all Android releases from CAF using the Linux kernel while trying to find out tEPSS 0.2%CVE-2019-14046—Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, SnaEPSS 0.2%CVE-2019-14018—Possible out of bound array access as there is no check on carrier index passed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer EPSS 0.2%CVE-2019-10481—Out of bound access occurs while handling the WMI FW event due to lack of check of buffer argument which comes directly from the WLAN FW in EPSS 0.2%CVE-2019-14087—Failure in buffer management while accessing handle for HDR blit when color modes not supported by display in Snapdragon Consumer IOT, SnapdEPSS 0.2%CVE-2019-10606—Out-of-bound access will occur in USB driver due to lack of check to validate the frame size passed by user in Snapdragon Auto, Snapdragon CEPSS 0.2%CVE-2019-14074—u'Heap overflow in diag command handler due to lack of check of packet length received from user' in Snapdragon Auto, Snapdragon Compute, SnEPSS 0.2%CVE-2019-14024—Possible stack-use-after-scope issue in NFC usecase for card emulation in Snapdragon Auto, Snapdragon Industrial IOT, Snapdragon Mobile in MEPSS 0.2%