Vulnerabilidades em Qualcomm, Inc.

2.976 resultados
Análise Vexday

Com 2.934 CVEs catalogadas, a Qualcomm apresenta um volume expressivo de vulnerabilidades, reflexo da amplitude de seu portfólio de chipsets e firmware embarcado. A taxa de exploração ativa — 12 entradas no catálogo KEV da CISA, ou 0,41% do total — está em linha com a média geral do catálogo, indicando que o risco de exploração confirmada não foge do padrão da indústria, embora 94 falhas de severidade crítica representem uma superfície de ataque relevante para equipes de segurança que dependem de componentes Qualcomm em ambientes móveis, automotivos ou de IoT. A CVE mais perigosa atualmente em exploração ativa, CVE-2020-11261, apresenta EPSS de 0,0177, sugerindo probabilidade de exploração adicional relativamente baixa no curto prazo, mas sua presença no KEV exige atenção imediata em qualquer inventário de ativos afetados. O surgimento de 49 novas CVEs nos últimos 90 dias e a disponibilidade de PoCs públicas para 3 vulnerabilidades reforçam a necessidade de ciclos contínuos de atualização de firmware e monitoramento ativo de patches liberados pelo fabricante.

CVE-2017-17765—In all Qualcomm products with Android releases from CAF using the Linux kernel, multiple values received from firmware are not properly valiEPSS 0.2%CVE-2019-10484—Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previoEPSS 0.2%CVE-2017-11007—In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, there is a possibility of stEPSS 0.2%CVE-2018-5888—While processing the system path, an out of bounds access can occur in Android releases from CAF using the linux kernel (Android for MSM, FiEPSS 0.2%CVE-2019-2336—Subsequent use of the CBO listener may result in further memory corruption due to use after free issue. in Snapdragon Auto, Snapdragon CompuEPSS 0.2%CVE-2018-3573—In all android releases (Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, while relocating kernel images wEPSS 0.2%CVE-2021-1959HIGHPossible memory corruption due to lack of bound check of input index in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, SnapdrEPSS 0.2%CVE-2018-3570—In the cpuidle driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux kernel, the list_foEPSS 0.2%CVE-2018-5899—In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security patch level 2018-06-0EPSS 0.2%CVE-2017-15851—Lack of copy_from_user and information leak in function "msm_ois_subdev_do_ioctl, file msm_ois.c can lead to a camera crash in all Android rEPSS 0.2%CVE-2020-11266—Image address is dereferenced before validating its range which can cause potential QSEE information leakage in Snapdragon Wired InfrastructEPSS 0.2%CVE-2021-1889HIGHPossible buffer overflow due to lack of length check in Trusted Application in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,EPSS 0.2%CVE-2018-5843—In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using thEPSS 0.2%CVE-2018-5842—An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android releases from CAF (AnEPSS 0.2%CVE-2018-5851—Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value in all Android releEPSS 0.2%CVE-2022-22079MEDIUMBuffer Over-read in BOOTEPSS 0.2%CVE-2018-11987—In all android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the linux kernel, if there is an unlikely memory alEPSS 0.2%CVE-2020-11177—User can overwrite Security Code NV item without knowing current SPC due to improper validation of SPC code setting and device lock in SnapdEPSS 0.2%CVE-2020-11204—Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters thEPSS 0.2%CVE-2018-11846—The use of a non-time-constant memory comparison operation can lead to timing/side channel attacks in Snapdragon Mobile in version SD 210/SDEPSS 0.2%