Qualcomm SDM710 Firmware vulnerabilities

267 CVEs affecting Qualcomm SDM710 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-11076, published 2024-11-26.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-10574, published 2020-04-16. High severity, CVSS 7.1. EPSS: 1.6% chance of exploitation in the next 30 days. Lack of boundary checks for data offsets received from HLOS can lead to out-of-bound read in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2020-11202, published 2020-11-12. High severity, CVSS 7.8. EPSS: 1.5% chance of exploitation in the next 30 days. Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon Auto, Snapdragon…
CVE-2022-40507, published 2023-06-06. High severity, CVSS 7.8. EPSS: 1.3% chance of exploitation in the next 30 days. Memory corruption due to double free in Core while mapping HLOS address to the list.
CVE-2019-10581, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. NULL is assigned to local instance of audio device pointer after free instead of global static pointer and can lead to use after free issue in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-3633, published 2020-06-02. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Array out of bound may occur while playing mp3 file as no check is there on offset if it is greater than the buffer allocated or not in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT,…
CVE-2020-3669, published 2020-09-08. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Buffer Overflow issue in WLAN tcp ip verification due to usage of out of range pointer offset' in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics…
CVE-2019-2271, published 2019-11-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Buffer over read can happen while parsing downlink session management OTA messages if network sends un-intended values in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon…
CVE-2019-10532, published 2020-01-21. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Null-pointer dereference issue can occur while calculating string length when source string length is zero in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial…
CVE-2019-2242, published 2019-12-18. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. Device memory may get corrupted because of buffer overflow/underflow. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon…
CVE-2020-3673, published 2020-11-02. Critical severity, CVSS 9.8. EPSS: 1.1% chance of exploitation in the next 30 days. u'Buffer overflow can happen as part of SIP message packet processing while storing values in array due to lack of check to validate the index length' in Snapdragon Auto, Snapdragon Compute,…

Latest

CVE-2017-11076, published 2024-11-26. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. On some hardware revisions where VP9 decoding is hardware-accelerated, the frame size is not programmed correctly into the decoder hardware which can lead to an invalid memory access by the decoder.
CVE-2023-33080, published 2023-12-05. High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days. Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
CVE-2023-33022, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption in HLOS while invoking IOCTL calls from user-space.
CVE-2023-33018, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption while using the UIM diag command to get the operators name.
CVE-2023-33017, published 2023-12-05. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
CVE-2023-33059, published 2023-11-07. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in Audio while processing the VOC packet data from ADSP.
CVE-2023-33027, published 2023-10-03. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Firmware while parsing rsn ies.
CVE-2023-28560, published 2023-09-05. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory corruption in WLAN HAL while processing devIndex from untrusted WMI payload.
CVE-2023-21670, published 2023-06-06. High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days. Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode.
CVE-2023-21659, published 2023-06-06. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Transient DOS in WLAN Firmware while processing frames with missing header fields.