Vendor
Qualcomm
3,001 known vulnerabilities.
Products
317 results · Clear filters · Feed
-
Medium 6.7
Improper Input Validation in Video
memory corruption when WiFi display APIs are invoked with large random inputs.
-
Medium 6.7
Use of Out-of-range Pointer Offset in ComputerVision
Memory corruption while invoking IOCTL command from user-space, when a user modifies the original packet size of the command after system properties have been already sent to the EVA driver.
-
Medium 6.1
Improper Authorization in Performance
Information disclosure while sending implicit broadcast containing APP launch information.
-
Medium 6.7
Double Free in DSP Services
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in RIL
Memory corruption during the network scan request.
-
Medium 6.7
Stack-based Buffer Overflow in Power Management IC
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
-
Medium 6.7
Use After Free in Automotive Multimedia
Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
-
Medium 5.5
Buffer Over-read in FM Host
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
-
Medium 6.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
-
Medium 6.2
NULL Pointer Dereference in HLOS
Transient DOS while importing a PKCS#8-encoded RSA key with zero bytes modulus.
-
Medium 6.5
Reachable Assertion in Multi Mode Call Processor
Permanent DOS when DL NAS transport receives multiple payloads such that one payload contains SOR container whose integrity check has failed, and the other is LPP where UE needs to send status message to network.
-
Medium 6.5
Buffer Over-read in WLAN Host Communication
Information disclosure while handling beacon probe frame during scan entry generation in client side.
-
Medium 6.5
Buffer Over-read in WLAN HOST
Information disclosure while handling beacon or probe response frame in STA.
-
Medium 6.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Linux Boot Loader
Memory corruption during the secure boot process, when the `bootm` command is used, it bypasses the authentication of the kernel/rootfs image.
-
Medium 6.5
Integer Underflow (Wrap or Wraparound) in WLAN Host Communication
Information disclosure while parsing sub-IE length during new IE generation.
-
Medium 6.5
Buffer Over-read in WLAN HOST
Information disclosure while handling SA query action frame.
-
Medium 6.5
Buffer Over-read in WLAN Host Communication
INformation disclosure while handling Multi-link IE in beacon frame.
-
Medium 6.5
Buffer Over-read in WLAN HOST
Information Disclosure while parsing beacon frame in STA.
-
Medium 6.2
NULL Pointer Dereference in Graphics
transient DOS when setting up a fence callback to free a KGSL memory entry object during DMA.
-
Medium 6.7
Integer Overflow or Wraparound in WLAN HOST
Memory corruption when more scan frequency list or channels are sent from the user space.
-
Medium 6.7
Use After Free in Audio
Memory corruption when IPC callback handle is used after it has been released during register callback by another thread.
-
Medium 6.7
Use After Free in Audio
Memory corruption in Audio during a playback or a recording due to race condition between allocation and deallocation of graph object.
-
Medium 6.5
Buffer Over-read in WLAN Host
Information disclosure while handling T2LM Action Frame in WLAN Host.
-
Medium 5.9
Integer Overflow or Wraparound in HLOS
Memory corruption in HLOS while checking for the storage type.
-
Medium 6.1
Buffer Over-read in Audio
Information disclosure when the ADSP payload size received in HLOS in response to Audio Stream Manager matrix session is less than this expected size.
-
Medium 6.8
Buffer Over-read in Video
Information disclosure while parsing dts header atom in Video.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while querying module parameters from Listen Sound model client in kernel from user space.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while copying the sound model data from user to kernel buffer during sound model register.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption when the bandpass filter order received from AHAL is not within the expected range.
-
Medium 6.7
Use After Free in HLOS
Memory corruption when multiple listeners are being registered with the same file descriptor.
-
Medium 6.6
Buffer copy without checking size of input (Classic buffer overflow) in HLOS
Memory corruption in HLOS while running kernel address sanitizers (syzkaller) on tmecom with DEBUG_FS enabled.
-
Medium 5.5
Improper Validation of Array Index in Audio
Information disclosure when VI calibration state set by ADSP is greater than MAX_FBSP_STATE in the response payload to AFE calibration command.
-
Medium 5.5
Buffer Over-read in Audio
Transient DOS while processing channel information for speaker protection v2 module in ADSP.
-
Medium 5.1
Buffer Over-read in DSP Services
Information Disclosure while processing IOCTL request in FastRPC.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in HLOS
Memory corruption in HLOS while converting from authorization token to HIDL vector.
-
Medium 5.9
Configuration Issue in Core
Memory corruption in Core when updating rollback version for TA and OTA feature is enabled.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing the calibration data returned from ACDB loader.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in Audio
Memory corruption in Audio while processing IIR config data from AFE calibration block.