Design/Logic Flaw

Possible out of bound access in WLAN handler when the received value of length in rx path is shorter than the expected value of country IE in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in IPQ8074,...

CVE-2020-3653

CVE-2020-3653 refers to a possible buffer over-read in the Windows WLAN driver function caused by not validating the length of a value received from userspace, affecting Snapdragon Compute and Snapdragon Connectivity components (MSM8998, QCA6390, SC7180, SC8180X, SDM850). The underlying issue is ...

CVE-2019-14135

CVE-2019-14135 describes a vulnerability: an integer overflow that can overflow to a buffer overflow in WLAN parsing of nonstandard NAN IE messages. Reported across Qualcomm Snapdragon/wlan components (e.g., APQ8009, QCA4xxx, SDM platforms) and affecting Qualcomm closed-source components and rela...

CVE-2020-3652

Possible buffer over-read issue in windows x86 wlan driver function while processing beacon or request frame due to lack of check of length of variable received. in Snapdragon Compute, Snapdragon Connectivity in MSM8998, QCA6390, SC7180, SC8180X, SDM850...

CVE-2020-3652

CVE-2020-3652: A buffer over-read in Windows x86 WLAN driver processing beacon/request frames due to missing length validation of a received variable. Affected components include Snapdragon Compute and Snapdragon Connectivity (MSM8998, QCA6390, SC7180, SC8180X, SDM850). Impacted due to potential ...

CVE-2019-14134

CVE-2019-14134 describes a possible out-of-bounds access in the WLAN handler when the length field in the RX path is shorter than the expected country IE value in Qualcomm Snapdragon platforms (Compute, Consumer IOT, Industrial IOT, Mobile, and Wired Infrastructure/Networking). Affected products ...

CVE-2019-14131

Out of bound write can occur in radio measurement request if STA receives multiple invalid rrm measurement request from AP in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in APQ8053, APQ8096AU, MSM8998, Nicoba...

CVE-2019-14127

Possible buffer overflow while playing mkv clip due to lack of validation of atom size buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017, APQ8053, APQ8064,...

CVE-2019-14104

CVE-2019-14104 describes a slab-out-of-bounds access caused by a missing null check before dereferencing the context pointer in Snapdragon Compute/IoT/Mobile components (APQ8053, SC8180X, SDX55, SM8150). Affected products include Snapdragon Compute, Snapdragon Consumer IoT, and Snapdragon Mobile ...

CVE-2019-14104

Slab-out-of-bounds access can occur if the context pointer is invalid due to lack of null check on pointer before accessing it in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Mobile in APQ8053, SC8180X, SDX55, SM8150...

CVE-2019-14033

Multiple Read overflows issue due to improper length check while decoding tau reject/tau accept/detach request/attach reject/attach accept in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096,...

CVE-2019-14020

CVE-2019-14020 describes “Multiple Read overflows” caused by improper length checks when decoding several Qualcomm/Snapdragon protocol messages (dedicated_eps_bearer_req, act_def_context_req, cs_serv_notification, emm_info, guti_realloc_cmd) affecting a wide range of Snapdragon-based devices (Aut...

CVE-2019-14012

Possibility of null pointer deference as the array of video codecs from media info is referenced without null checking while processing SDP messages in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MSM8905,...

CVE-2019-14009

CVE-2019-14009 corresponds to an out-of-bounds memory access in the TZ command handler on Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, IOT, Mobile, etc.) caused by improper input validation of the response length from user space. Affected components include Snapdragon devices acros...

CVE-2019-14009

Out of bound memory access while processing TZ command handler due to improper input validation on response length received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music,...

CVE-2019-14011

Multiple Read overflows issue due to improper length check while decoding 3G attach accept/ SMS/ pdn connection reject/ esm data transport/ bearer modify context reject in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile,...

CVE-2019-10624

CVE-2019-10624 describes an integer truncation in Snapdragon firmware that could lead to a buffer overflow when handling the vendor command, caused by copying an int to an 8-bit type across multiple Snapdragon platforms (e.g., APQ8096AU, MSM8996AU, QCA6574AU, QCN7605, Rennell, SC8180X, SDM710, SD...

CVE-2019-10623

Possible integer overflow can happen in host driver while processing user controlled string due to improper validation on data received. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in...

CVE-2019-10610

Possible buffer over read when trying to process SDP message Video media line with frame-size attribute in video Media line in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2019-10621

CVE-2019-10621 affects Qualcomm Snapdragon components (multiple mobile, auto, IoT variants) where a use-after-free can occur when MAP and UNMAP calls run concurrently; a data structure used by MAP may be freed by UNMAP. This is a local, high-severity issue with potential for partial confidentiali...