Qualcomm Bitra Firmware vulnerabilities

38 CVEs affecting Qualcomm Bitra Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-3704, published 2020-11-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-3673, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto, Snapdragon Compute,…
CVE-2020-11116, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. u'Possible out of bound write while processing association response received from host due to lack of check of IE length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics…
CVE-2020-3654, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. u'Buffer overflow occurs while processing SIP message packet due to lack of check of index validation before copying into it' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-3703, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 0.7% chance of exploitation in the next 30 days. u'Buffer over-read issue in Bluetooth peripheral firmware due to lack of check for invalid opcode and length of opcode received from central device(This CVE is equivalent to Link Layer Length Overfow…
CVE-2020-11118, published 2020-09-08. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. u'Information exposure issues while processing IE header due to improper check of beacon IE frame' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon…
CVE-2020-11115, published 2020-09-08. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. u'Buffer over read occurs while processing information element from beacon due to lack of check of data received from beacon' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics…
CVE-2020-3704, published 2020-11-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. u'While processing invalid connection request PDU which is nonstandard (interval or timeout is 0) from central device may lead peripheral system enter into dead lock state.(This CVE is equivalent to…
CVE-2020-11122, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. u'Null Pointer exception while playing crafted mkv file as data stream get deleted on secondary invalid configuration' in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile in APQ8098,…
CVE-2020-3679, published 2020-09-09. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. u'During execution after Address Space Layout Randomization is turned on for QTEE, part of code is still mapped at known address including code segments' in Snapdragon Auto, Snapdragon Compute,…
CVE-2020-3694, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom' in Snapdragon Auto, Snapdragon Compute, Snapdragon Mobile, Snapdragon Voice & Music in…

Latest

CVE-2020-3693, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2020-3690, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'Due to an incorrect SMMU configuration, the modem crypto engine can potentially compromise the hypervisor' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2020-3684, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'QSEE reads the access permission policy for the SMEM TOC partition from the SMEM TOC contents populated by XBL Loader and applies them without validation' in Snapdragon Auto, Snapdragon Compute,…
CVE-2020-3638, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'An Unaligned address or size can propagate to the database due to improper page permissions and can lead to improper access control' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-11174, published 2020-11-02. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'Array index underflow issue in adsp driver due to improper check of channel id before used as array index.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…