Qualcomm MSM8996 Firmware vulnerabilities

72 CVEs affecting Qualcomm MSM8996 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-11207, published 2020-11-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10574, published 2020-04-16. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2020-11207, published 2020-11-12. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon…
CVE-2017-18132, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, MDM8996, an out-of-bounds access can potentially occur in tz_assign().
CVE-2017-18129, published 2018-04-11. Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days. In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Automobile and Snapdragon Mobile MDM9206, MDM9607, SD 845, MSM8996, MSM8998, it is possible for IPA (internet protocol…
CVE-2014-10050, published 2018-04-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. In Android before 2018-04-05 or earlier security patch level on Qualcomm Snapdragon Mobile MSM8996, MSM8939, MSM8976, MSM8917, SDM845, and SDM660, access control collision vulnerability when…
CVE-2019-10532, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2019-14006, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer overflow occur while playing the clip which is nonstandard due to lack of offset length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2019-14005, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Buffer overflow occur while playing the clip which is nonstandard due to lack of check of size duration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…
CVE-2020-3662, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Buffer overflow can occur while parsing eac3 header while playing the clip which is nonstandard in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-3660, published 2020-06-22. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Possible null-pointer dereference can occur while parsing mp4 clip with corrupted sample table atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT,…

Latest

CVE-2020-11196, published 2020-11-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-11193, published 2020-11-12. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. u'Buffer over read can happen while parsing mkv clip due to improper typecasting of data returned from atomsize' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2020-11123, published 2020-11-12. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'information disclosure in gatekeeper trustzone implementation as the throttling mechanism to prevent brute force attempts at getting user`s lock-screen password can be bypassed by performing the…
CVE-2020-3644, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'Information disclosure issue occurs as in current logic Secure Touch session is released without terminating display session' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity,…
CVE-2020-3643, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'Information disclosure issue can occur due to partial secure display-touch session tear-down' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-3622, published 2020-09-08. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. u'Channel name string which has been read from shared memory is potentially subjected to string manipulations but not validated for NULL termination can results into memory corruption' in Snapdragon…
CVE-2020-3621, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'Lack of check to ensure that the TX read index & RX write index that are read from shared memory are less than the FIFO size results into memory corruption and potential information leakage' in…
CVE-2020-3620, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'Lack of check of integer overflow while doing a round up operation for data read from shared memory for G-link SMEM transport can lead to corruption and potential information leak' in Snapdragon…
CVE-2019-14115, published 2020-09-08. Medium severity, CVSS 5.5. EPSS: 0.2% chance of exploitation in the next 30 days. u'Information disclosure issue occurs as in current logic as secure touch is released without clearing the display session which can result in user reading the secure input while touch is in…