Vendor
Qualcomm
3,001 known vulnerabilities.
Products
3,001 results · Feed
-
High 7.6
Improper Input Validation in Services
Information disclosure in Core services while processing a Diag command.
-
Medium 6.7
Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
-
High 8.4
Integer Overflow or Wraparound in Graphics Linux
Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.
KEV Dec 5, 2023 -
High 8.4CVE-2023-33106 Exploited
Use of Out-of-range Pointer Offset in Graphics
Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND.
KEV Dec 5, 2023 -
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS while parsing WPA IES, when it is passed with length more than expected size.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while processing a FTMR frame.
-
High 8.4
Buffer Copy Without Checking Size of Input in Bluetooth HOST
Memory corruption while processing pin reply in Bluetooth, when pin code received from APP layer is greater than expected size.
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS when processing a NULL buffer while parsing WLAN vdev.
-
High 8.4
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.
-
High 7.8
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core
Memory corruption in Core while processing RX intent request.
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption in WLAN Host while processing RRM beacon on the AP.
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while running invalid audio recording from ADSP.
-
High 8.4
Improper Access Control in Automotive OS Platform Android
Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
-
High 7.1
Improper Authentication in Automotive OS
Transient DOS in Automotive OS due to improper authentication to the secure IO calls.
-
High 7.8CVE-2023-33063 Exploited
Use After Free in DSP Services
Memory corruption in DSP Services during a remote call from HLOS to DSP.
KEV Dec 5, 2023 -
Critical 9.1
Improper Authentication in GPS HLOS Driver
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
-
High 8.4
Improper Validation of Array Index in Kernel
Memory corruption in Kernel while parsing metadata.
-
High 7.5
Reachable Assertion in Data Modem
Transient DOS in Data modem while handling TLB control messages from the Network.
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
-
High 7.5
Improper Input Validation in Modem
Transient DOS in Modem after RRC Setup message is received.
-
High 7.5
Reachable assertion in WLAN Firmware
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer
Memory corruption while sending SMS from AP firmware.
-
High 8.4
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
-
High 7.8
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
-
High 7.8
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
-
High 7.5CVE-2023-28588 Public exploit
Integer Overflow or Wraparound in Bluetooth Host
Transient DOS in Bluetooth Host while rfc slot allocation.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
-
Medium 6.0
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
-
High 8.2
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
-
High 7.8
Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA.
-
Medium 6.7
Use After Free in Audio
Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
-
Medium 6.7
Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.