Skip to contentQualcomm Pmm8195au Firmware vulnerabilities
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8096au firmware +424 more +426 moreOut of bound read will happen if EAPOL Key length is less than expected while processing NAN...CVE-2020-112417.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +400 more +402 morePossible Buffer over-read in ARP/NS parsing due to lack of check of packet length received in...CVE-2020-112387.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, pm3003a firmware +266 more +268 morePossible heap overflow while parsing NAL header due to lack of check of length of data received...CVE-2020-111829.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +285 more +287 moreTrusted APPS to overwrite the CPZ memory of another use-case as TZ only checks the physical...CVE-2020-111787.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +253 more +255 moreMemory corruption due to buffer overflow while copying the message provided by HLOS into buffer...CVE-2020-111657.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +405 more +407 morePossible denial of service scenario due to improper handling of group management action frame in...CVE-2021-19257.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8096au firmware, aqt1000 firmware +402 more +404 moreBuffer overflow can occur due to improper validation of NDP application information length in...CVE-2021-19157.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +371 more +373 moreDouble free in video due to lack of input buffer length check in Snapdragon Auto, Snapdragon...CVE-2021-19107.3 High
- qualcomm, inc. snapdragon consumer iot, snapdragon industrial iot, snapdragon voice & music, qualcomm apq8009w firmware, apq8017 firmware +412 more +414 morePossible integer overflow due to improper length check while flashing an image in Snapdragon...CVE-2021-18956.8 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm fsm10055 firmware, fsm10056 firmware +171 more +173 moreUse after free in camera If the threadmanager is being cleaned up while the worker thread is...CVE-2020-112956.8 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm ar8035 firmware, pm215 firmware +242 more +244 moreOut of bound write in logger due to prefix size is not validated while prepended to logging...CVE-2020-112945.9 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8017 firmware, apq8037 firmware +337 more +339 moreOut of bound read can happen in Widevine TA while copying data to buffer from user data due to...CVE-2020-112935.1 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +494 more +496 moreOut of bound write can occur in TZ command handler due to lack of validation of command ID in...CVE-2020-112897.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm aqt1000 firmware, ar8031 firmware +316 more +318 moreOut of bound write can occur in playready while processing command due to lack of input...CVE-2020-112887.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +129 more +131 moreLocked memory can be unlocked and modified by non secure boot loader through improper system call...CVE-2020-112848.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8009w firmware +455 more +457 morePossible use after free due to lack of null check while memory is being freed in FastRPC driver...CVE-2021-1927Fix available8.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +399 more +401 moreImproper handling of address deregistration on failure can lead to new GPU address allocation...CVE-2021-1906In KEVFix available6.2 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +395 more +397 morePossible use after free due to improper handling of memory mapping of multiple processes...CVE-2021-1905In KEVFix available8.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009w firmware, apq8017 firmware +412 more +414 moreA possible use-after-free occurrence in audio driver can happen when pointers are not properly...CVE-2021-1891Fix available8.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +308 more +310 moreTrustzone initialization code will disable xPU`s when memory dumps are enabled and lead to...CVE-2020-112527.2 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +317 more +319 moreOut of bound memory read while unpacking data due to lack of offset length check in Snapdragon...CVE-2020-112478.2 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm apq8017 firmware, apq8037 firmware +315 more +317 moreA double free condition can occur when the device moves to suspend mode during secure playback in...CVE-2020-112468.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +200 more +202 moreUnintended reads and writes by NS EL2 in access control driver due to lack of check of input...CVE-2020-112458.4 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +379 more +381 moreBuffer overflow can occur in video while playing the non-standard clip in Snapdragon Auto,...CVE-2020-112999.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, fsm10055 firmware +178 more +180 morePotential arbitrary memory corruption when the qseecom driver updates ion physical addresses in...CVE-2020-112306.4 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +129 more +131 morePart of RPM region was not protected from xblSec itself due to improper policy and leads to...CVE-2020-112287.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +129 more +131 moreWhile processing storage SCM commands there is a time of check or time of use window where a...CVE-2020-112206.4 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +399 more +401 moreUse after free in GPU driver while mapping the user memory to GPU memory due to improper check of...CVE-2020-11309Fix available7.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm apq8009 firmware, aqt1000 firmware +331 more +333 moreBuffer overflow occurs when trying to convert ASCII string to Unicode string if the actual size...CVE-2020-11308Fix available6.8 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +326 more +328 moreUse after free condition in msm ioctl events due to race between the ioctl register and...CVE-2020-11290Fix available7.0 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +313 more +315 moreOut of bound read access in hypervisor due to an invalid read access attempt by passing invalid...CVE-2020-36646.0 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +530 more +532 moreArithmetic overflow can happen while processing NOA IE due to improper error handling in...CVE-2020-112967.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +345 more +347 moreAllowing RTT frames to be linked with non randomized MAC address by comparing the sequence...CVE-2020-112817.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar7420 firmware +410 more +412 moreDenial of service while processing fine timing measurement request (FTMR) frame with reserved...CVE-2020-112807.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +375 more +377 morePossible denial of service while handling host WMI command due to improper validation in...CVE-2020-112787.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +512 more +514 morePossible buffer over read while processing P2P IE and NOA attribute of beacon and probe response...CVE-2020-112769.1 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +469 more +471 morePossible buffer over-read while parsing quiet IE in Rx beacon frame due to improper check of IE...CVE-2020-112759.1 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar7420 firmware +413 more +415 morePossible denial of service due to RTT responder consistently rejects all FTMR by transmitting...CVE-2020-112707.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8009w firmware +535 more +537 morePossible memory corruption while processing EAPOL frames due to lack of validation of key length...CVE-2020-112698.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, qualcomm aqt1000 firmware, pm3003a firmware +171 more +173 moreArbitrary memory write issue in video driver while setting the internal buffers in Snapdragon...CVE-2020-112537.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8016 firmware +517 more +519 morePossible memory corruption and information leakage in sub-system due to lack of check for...CVE-2020-112047.8 High
- qualcomm, inc. snapdragon auto, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wearables, qualcomm apq8009w firmware, apq8064au firmware +141 more +143 moreStack overflow may occur if GSM/WCDMA broadcast config size received from user is larger than...CVE-2020-112037.1 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +299 more +301 moreKey material used for TZ diag buffer encryption and other data related to log buffer is not wiped...CVE-2020-111986.7 Medium
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm apq8009 firmware, apq8016 firmware +391 more +393 moreOut of bound write and read in TA while processing command from NS side due to improper length...CVE-2020-111957.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8035 firmware +227 more +229 morePossible out of bound access in TA while processing a command from NS side due to improper length...CVE-2020-111947.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8009w firmware +503 more +505 moreOut of bound memory access while playing music playbacks with crafted vorbis content due to...CVE-2020-111709.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, qualcomm apq8096au firmware, aqt1000 firmware +261 more +263 moreDenial of service in WLAN module due to improper check of subtypes in logic where excessive...CVE-2020-11297Fix available7.5 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, qualcomm apq8009 firmware, apq8009w firmware +346 more +348 moreBefore enqueuing a frame to the PE queue for further processing, an entry in a hash table can be...CVE-2020-11272Fix available9.8 Critical
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon mobile, snapdragon voice & music, snapdragon wearables, snapdragon wired infrastructure and networking, qualcomm aqt1000 firmware, ar8031 firmware +338 more +340 morePossible out of bounds while accessing global control elements due to race condition in...CVE-2020-11271Fix available7.8 High
- qualcomm, inc. snapdragon auto, snapdragon compute, snapdragon connectivity, snapdragon consumer electronics connectivity, snapdragon consumer iot, snapdragon industrial iot, snapdragon iot, snapdragon mobile, snapdragon voice & music, snapdragon wired infrastructure and networking, qualcomm apq8009 firmware, apq8017 firmware +469 more +471 moreBuffer over-read can happen when the buffer length received from response handlers is more than...CVE-2020-111197.5 High