Qualcomm MSM8939 Firmware vulnerabilities

47 CVEs affecting Qualcomm MSM8939 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11269, published 2021-02-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-10050, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when…
CVE-2019-2271, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-10532, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2019-2242, published 2019-12-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-10554, published 2020-03-05. Critical severity, CVSS 9.1. EPSS: 1% chance of exploitation in the next 30 days. Multiple Read overflows issue due to improper length check while decoding Identity Request in CSdomain/Authentication Reject in CS domain/ PRAU accept/while logging DL message in Snapdragon Auto,…
CVE-2019-14006, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2019-14005, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2019-10590, published 2020-02-07. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2019-14016, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Integer overflow occurs while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2019-14013, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. While parsing invalid super index table, elements within super index table may exceed total chunk size and invalid data is read into the table in Snapdragon Auto, Snapdragon Compute, Snapdragon…

Latest

CVE-2020-11269, published 2021-02-22. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Possible memory corruption while processing EAPOL frames due to lack of validation of key length before using it in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-14095, published 2020-03-05. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflow occurs while processing LMP packet in which name length parameter exceeds value specified in BT-specification in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2019-14072, published 2020-03-05. High severity, CVSS 7.0. EPSS: 0.1% chance of exploitation in the next 30 days. Unhandled paging request is observed due to dereferencing an already freed object because of race condition between sparse free and sparse bind ioctls which access the same physical entry in…
CVE-2019-14061, published 2020-03-05. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Null-pointer dereference can occur while accessing the segment element info when it is not allocated and assigned in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-10591, published 2020-03-05. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Null pointer dereference can happen when parsing udta atom which is non-standard and having invalid depth in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2019-10552, published 2020-03-05. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Multiple Buffer Over-read issue can happen due to improper length checks while decoding Service Reject/RAU Reject/PTMSI Realloc cmd in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2019-14057, published 2020-02-07. Critical severity, CVSS 9.1. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer Over read of codec private data while parsing an mkv file due to lack of check of buffer size before read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer…
CVE-2019-14055, published 2020-02-07. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer…