Qualcomm APQ8016 Firmware vulnerabilities

15 CVEs affecting Qualcomm APQ8016 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2018-11816, published 2024-11-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10574, published 2020-04-16. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2019-2242, published 2019-12-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-14095, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2022-25719, published 2022-10-19. Critical severity, CVSS 9.1. EPSS: 0.6% chance of exploitation in the next 30 days. Information disclosure in WLAN due to improper length check while processing authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2022-25718, published 2022-10-19. Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days. Cryptographic issue in WLAN due to improper check on return value while authentication handshake in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon…
CVE-2020-11269, published 2021-02-22. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-2251, published 2019-11-21. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. If a bitmap file is loaded from any un-authenticated source, there is a possibility that the bitmap can potentially cause stack buffer overflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon…
CVE-2019-10483, published 2020-04-16. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Side channel issue in QTEE due to usage of non-time-constant comparison function such as memcmp or strcmp in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-10616, published 2020-03-05. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Possibility of null pointer access if the SPDM commands are executed in the non-standard way in TZ. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2021-1924, published 2021-11-12. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. Information disclosure through timing and power side-channels during mod exponentiation for RSA-CRT in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…

Latest

CVE-2018-11816, published 2024-11-26. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Crafted Binder Request Causes Heap UAF in MediaServer
CVE-2022-40532, published 2023-04-13. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
CVE-2021-1909, published 2021-09-09. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Buffer overflow occurs in trusted applications due to lack of length check of parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity,…
CVE-2020-11204, published 2021-02-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possible memory corruption and information leakage in sub-system due to lack of check for validity and boundary compliance for parameters that are read from shared MSG RAM in Snapdragon Auto,…
CVE-2020-11195, published 2021-02-22. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Out of bound write and read in TA while processing command from NS side due to improper length check on command and response buffers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…