CVE-2020-11196

u'Integer overflow to buffer overflow occurs while playback of ASF clip having unexpected number of codec entries' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8009W,...

CVE-2020-11202

Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligned with the actual size of the structure' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in QCM6125, QCS410, QCS603...

Design/Logic Flaw

u'Incorrect validation of ring context fetched from host memory can lead to memory overflow' in Snapdragon Compute, Snapdragon Mobile in QSM8350, SC7180, SDX55, SDX55M, SM6150, SM6250, SM6250P, SM7125, SM7150, SM7150P, SM7250, SM7250P, SM8150, SM8150P, SM8250, SM8350, SM8350P, SXR2130, SXR2130P...

CVE-2020-3639

CVE-2020-3639 is reported as a critical issue affecting Qualcomm Snapdragon components (closed‑source) across multiple Snapdragon lines. The root cause described in the provided documents is handling of non‑standard SIP SigComp messages, which may cause excessive UDVM cycles or memory overflow. T...

CVE-2020-11209

Improper authorization in DSP process could allow unauthorized users to downgrade the library versions in SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439...

CVE-2020-11208

CVE-2020-11208 describes an out-of-bounds issue in Qualcomm Snapdragon DSP services when processing argument lengths, affecting multiple SoCs (SD820/821, SD855, SD660, SD675, QCS603/605, SDA855, SA6155/6145/6155P, SD429/439, etc.). Root cause: improper validation of the length of received argumen...

PT-2020-12596 · Qualcomm · Snapdragon Auto +5

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon Auto versions APQ8052 through SA8195P Qualcomm Snapdragon Compute versions APQ8052 through SA8195P Qualcomm Snapdragon Consumer IOT versions APQ8052 through SA8195P Qualcomm Snapdragon Industrial IOT versions APQ8052 throu...

PT-2020-12597 · Qualcomm · Qualcomm Snapdragon

Name of the Vulnerable Software and Affected Versions: Qualcomm Snapdragon versions SD820, SD821, SD820, QCS603, QCS605, SDA855, SA6155P, SA6145P, SA6155, SA6155P, SD855, SD 675, SD660, SD429, SD439 Description: The issue is related to an out of bounds problem in DSP services. This occurs while...

Code injection

u'Lack of handling unexpected control messages while encryption was in progress can terminate the connection and thus leading to a DoS' in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

Improper access control

u'Third-party app may also call the broadcasts in Perfdump and cause privilege escalation issue due to improper access control' in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in Agatti, APQ8096AU, APQ8098,...

Design/Logic Flaw

u'Use out of range pointer issue can occur due to incorrect buffer range check during the execution of qseecom.' in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in APQ8009, APQ8017,...

Android Security Bulletin—November 2020Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2020-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Synology SRM lbd service Command Execution Vulnerability

Summary An exploitable command execution vulnerability exists in the lbd service functionality of Qualcomm lbd 1.1, as present in Synology SRM 1.2.3 RT2600ac 8017-5. A specially crafted debug command can overwrite arbitrary files with controllable content, resulting in remote code execution. An...

Qualcomm QCMAP Web Code Issue Vulnerability

Qualcomm QCMAP is a data access point for Linux-based cell phones from Qualcomm Incorporated. Qualcomm QCMAP Web October 2020 Release A security vulnerability exists in the client-side binary code that does not validate the return value of the strstr or strchr call in the Tokenizer function, whic...

Qualcomm QCMAP OS Command Injection Vulnerability

Qualcomm QCMAP is Qualcomm's Linux-based data access point for cell phones. The Qualcomm QCMAP QCMAPCLI uses the system call without validating input while handling the SetGatewayUrl request, which can be exploited by a remote attacker to submit a special request that can pass shell metacharacter...

CVE-2020-25859

The QCMAPCLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system call without validating the input, while handling a SetGatewayUrl request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAPCLI ca...

Design/Logic Flaw

The QCMAPCLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system call without validating the input, while handling a SetGatewayUrl request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAPCLI ca...

CVE-2020-25859

The QCMAPCLI utility in the Qualcomm QCMAP software suite prior to versions released in October 2020 uses a system call without validating the input, while handling a SetGatewayUrl request. A local attacker with shell access can pass shell metacharacters and run arbitrary commands. If QCMAPCLI ca...

CVE-2020-25859

CVE-2020-25859 concerns the QCMAP_CLI utility in Qualcomm QCMAP, where handling SetGatewayUrl() can invoke system() without input validation. This allows a local attacker with shell access to pass shell metacharacters and execute arbitrary commands. If QCMAP_CLI runs with sudo or setuid, privileg...

CVE-2020-25858

CVE-2020-25858 affects the Qualcomm QCMAP Web UI. The issue lies in the QCMAP_Web_CLIENT binary where the Tokenizer() function does not validate the return values of strstr() or strchr(). This can let an attacker supply a crafted URL via the web interface that crashes the process, resulting in a ...