Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing ESP IE from beacon/probe response frame.
-
High 7.5
Use After Free in WLAN Host
Transient DOS when transmission of management frame sent by host is not successful and error status is received in the host.
-
Critical 9.8
Improper Input Validation in WLAN Resource Manager
Memory corruption while redirecting log file to any file location with any file name.
-
High 8.4
Improper Input Validation in Camera
Memory corruption while taking snapshot when an offset variable is set by camera driver.
-
High 8.2
Buffer Over-read in WLAN Host Communication
Information disclosure while parsing the multiple MBSSID IEs from the beacon.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing noninheritance IE of Extension element when length of IE is 2 of beacon frame.
-
Medium 6.7
Double Free in DSP Services
Memory corruption while unmapping the fastrpc map when two threads can free the same map in concurrent scenario.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Audio
Memory corruption while invoking IOCTL calls for MSM module from the user space during audio playback and record.
-
Medium 6.7
Use After Free in ComputerVision
Memory corruption while sending the persist buffer command packet from the user-space to the kernel space through the IOCTL call.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in RIL
Memory corruption during the network scan request.
-
Medium 6.7
Stack-based Buffer Overflow in Power Management IC
Memory corruption is possible when an attempt is made from userspace or console to write some haptics effects pattern to the haptics debugfs file.
-
Medium 6.7
Use After Free in Automotive Multimedia
Memory corruption when a process invokes IOCTL calls from user-space to create a HAB virtual channel and another process invokes IOCTL calls to destroy the same.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in HLOS
Memory corruption when invalid length is provided from HLOS for FRS/UDS request/response buffers.
-
High 7.8
Untrusted Pointer Dereference in DSP Service
Memory corruption when a compat IOCTL call is followed by another IOCTL call from userspace to a driver.
-
High 7.8
Use After Free in DSP Services
Memory corruption while processing IOCTL call for getting group info.
-
High 7.8
Use After Free in Qualcomm IPC
Memory corruption while processing concurrent IOCTL calls.
-
High 8.4
Use After Free in DSP Service
Memory corruption when two threads try to map and unmap a single node simultaneously.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing the multi-link element Control field when common information length check is missing before updating the location.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Computer Vision
Memory corruption during the handshake between the Primary Virtual Machine and Trusted Virtual Machine.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when user provides data for FM HCI command control operations.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while processing TIM IE from beacon frame as there is no check for IE length.
-
High 7.5
Buffer Over-read in WLAN Host Communication
Transient DOS while parsing MBSSID during new IE generation in beacon/probe frame when IE length check is either missing or improper.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the received TID-to-link mapping element of beacon/probe response frame.
-
High 8.4
Buffer Over-read in Display
Memory corruption when the captureRead QDCM command is invoked from user-space.
-
High 8.4
Return of Stack Variable Address in Buses
Memory corruption when BTFM client sends new messages over Slimbus to ADSP.
-
Medium 5.5
Buffer Over-read in FM Host
Transient DOS while handling PS event when Program Service name length offset value is set to 255.
-
High 7.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in FM Host
Memory corruption when Alternative Frequency offset value is set to 255.
-
High 7.8
Untrusted Pointer Dereference in Computer Vision
Memory corruption while passing untrusted/corrupted pointers from DSP to EVA.
-
High 8.4
Integer Overflow or Wraparound in Display
Memory corruption while calculating total metadata size when a very high reserved size is requested by gralloc clients.
-
Medium 6.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in Storage
memory corruption when an invalid firehose patch command is invoked.
-
High 8.4
Use After Free in SCE-Mink
Memory corruption while releasing shared resources in MinkSocket listener thread.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing the non-transmitted BSSID profile sub-elements present within the MBSSID Information Element (IE) of a beacon frame that is received from over-the-air (OTA).
-
High 7.1
Improper Input Validation in Trusted Execution Environment
Cryptographic issue while parsing RSA keys in COBR format.
-
High 8.2
Buffer Over-read in Multi Mode Call Processor
Information disclosure while decoding Tracking Area Update Accept or Attach Accept message received from network.
-
High 7.5
Buffer Over-read in Multi Mode Call Processor
Transient DOS when registration accept OTA is received with incorrect ciphering key data IE in Modem.
-
High 8.4
Use After Free in Graphics Linux
Memory corruption can occur if VBOs hold outdated or invalid GPU SMMU mappings, especially when the binding and reclaiming of memory buffers are performed at the same time.
-
High 8.4
Use After Free in Automotive Telematics
Memory corruption as fence object may still be accessed in timeline destruct after isync fence is released.
-
High 8.4
Improper Access Control in Graphics Linux
Memory corruption can occur when arbitrary user-space app gains kernel level privilege to modify DDR memory by corrupting the GPU page table.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing probe response and assoc response frame when received frame length is less than max size of timestamp.
-
High 7.5
Buffer Over-read in WLAN Host
Transient DOS while parsing the BSS parameter change count or MLD capabilities fields of the ML IE.