CPE Details
Alerte pour un CPE
Stay informed of any changes for a specific CPE.
CPE Name: cpe:2.3:h:qualcomm:sa4150p:-:*:*:*:*:*:*:*
Informations
Vendor
qualcommProduct
sa4150pVersion
-Related CVE
| CVE ID | Published | Description | Score | Severity |
|---|---|---|---|---|
| Memory corruption when IOMMU unmap operation fails, the DMA and anon buffers are getting released. | 8.4 |
HIGH |
||
| Memory corruption when allocating and accessing an entry in an SMEM partition. | 7.8 |
HIGH |
||
| Memory corruption when an invoke call and a TEE call are bound for the same trusted application. | 7.8 |
HIGH |
||
| Memory corruption while processing key blob passed by the user. | 7.8 |
HIGH |
||
| Transient DOS while loading the TA ELF file. | 7.1 |
HIGH |
||
| Memory corruption while performing finish HMAC operation when context is freed by keymaster. | 8.4 |
HIGH |
||
| Transient DOS while parse fils IE with length equal to 1. | 7.5 |
HIGH |
||
| Transient DOS in WLAN Firmware when the length of received beacon is less than length of ieee802.11 beacon frame. | 7.5 |
HIGH |
||
| Transient DOS while key unwrapping process, when the given encrypted key is empty or NULL. | 7.5 |
HIGH |
||
| Memory corruption in video while parsing the Videoinfo, when the size of atom is greater than the videoinfo size. | 9.8 |
CRITICAL |
||
| Memory corruption in video while parsing invalid mp2 clip. | 9.8 |
CRITICAL |
||
| Memory corruption while processing the event ring, the context read pointer is untrusted to HLOS and when it is passed with arbitrary values, may point to address in the middle of ring element. | 7.8 |
HIGH |
||
| Memory corruption in HLOS while converting from authorization token to HIDL vector. | 7.8 |
HIGH |
||
| Transient DOS while parsing IPv6 extension header when WLAN firmware receives an IPv6 packet that contains `IPPROTO_NONE` as the next header. | 7.5 |
HIGH |
||
| Memory corruption in Audio when memory map command is executed consecutively in ADSP. | 7.8 |
HIGH |
||
| Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL. | 7.8 |
HIGH |
||
| Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command. | 7.8 |
HIGH |
||
| Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time. | 8.4 |
HIGH |
||
| Memory corruption when resource manager sends the host kernel a reply message with multiple fragments. | 8.4 |
HIGH |
||
| Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element. | 7.5 |
HIGH |
||
| Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host. | 7.5 |
HIGH |
||
| Memory corruption while running VK synchronization with KASAN enabled. | 8.4 |
HIGH |
||
| Memory corruption in wearables while processing data from AON. | 7.8 |
HIGH |
||
| Transient DOS in WLAN Firmware while parsing a BTM request. | 7.5 |
HIGH |
||
| Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data. | 7.1 |
HIGH |
||
| Memory corruption in Audio during playback with speaker protection. | 8.4 |
HIGH |
||
| Memory corruption in TZ Secure OS while requesting a memory allocation from TA region. | 9.3 |
CRITICAL |
||
| Memory corruption in HLOS while running playready use-case. | 9.3 |
CRITICAL |
||
| Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call. | 8.4 |
HIGH |
||
| Memory corruption while submitting a large list of sync points in an AUX command to the IOCTL_KGSL_GPU_AUX_COMMAND. | 8.4 |
HIGH |
||
| Transient DOS while parsing WPA IES, when it is passed with length more than expected size. | 7.5 |
HIGH |
||
| Transient DOS when processing a NULL buffer while parsing WLAN vdev. | 7.5 |
HIGH |
||
| Memory corruption when processing cmd parameters while parsing vdev. | 8.4 |
HIGH |
||
| Memory corruption in Core while processing RX intent request. | 7.8 |
HIGH |
||
| Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame. | 7.5 |
HIGH |
||
| Memory corruption in Audio while running invalid audio recording from ADSP. | 7.8 |
HIGH |
||
| Memory corruption in DSP Services during a remote call from HLOS to DSP. | 7.8 |
HIGH |
||
| Memory corruption in Kernel while parsing metadata. | 8.4 |
HIGH |
||
| Memory corruption while sending SMS from AP firmware. | 7.8 |
HIGH |
||
| Memory corruption in HLOS while invoking IOCTL calls from user-space. | 8.4 |
HIGH |
||
| Memory corruption in Boot while running a ListVars test in UEFI Menu during boot. | 7.8 |
HIGH |
||
| Transient DOS in Bluetooth Host while rfc slot allocation. | 7.5 |
HIGH |
||
| Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level. | 7.8 |
HIGH |
||
| Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE. | 6.5 |
MEDIUM |
||
| Memory corruption while loading an ELF segment in TEE Kernel. | 8.8 |
HIGH |
||
| Memory Corruption in SPS Application while exporting public key in sorter TA. | 7.8 |
HIGH |
||
| Memory corruption in Audio when SSR event is triggered after music playback is stopped. | 8.4 |
HIGH |
||
| Memory corruption in Audio while processing the VOC packet data from ADSP. | 7.8 |
HIGH |
||
| Memory Corruption in Audio while invoking callback function in driver from ADSP. | 7.8 |
HIGH |
||
| Memory corruption in Automotive Audio while copying data from ADSP shared buffer to the VOC packet data buffer. | 7.8 |
HIGH |
||
| Information disclosure in WLAN HAL while handling command through WMI interfaces. | 6.1 |
MEDIUM |
||
| Information disclosure in IOE Firmware while handling WMI command. | 6.1 |
MEDIUM |
||
| Cryptographic issue in HLOS during key management. | 7.8 |
HIGH |
||
| Information Disclosure in WLAN Host when processing WMI event command. | 6.1 |
MEDIUM |
||
| Memory Corruption in Core due to secure memory access by user while loading modem image. | 8.4 |
HIGH |
||
| Memory corruption while invoking callback function of AFE from ADSP. | 7.8 |
HIGH |
||
| Memory corruption while parsing the ADSP response command. | 7.8 |
HIGH |
||
| Memory corruption in DSP Service during a remote call from HLOS to DSP. | 8.4 |
HIGH |
||
| Transient DOS in WLAN Firmware while parsing rsn ies. | 7.5 |
HIGH |
||
| Memory Corruption in HLOS while registering for key provisioning notify. | 8.4 |
HIGH |
||
| Memory Corruption in HLOS while importing a cryptographic key into KeyMaster Trusted Application. | 7.8 |
HIGH |
||
| Memory corruption in Graphics while processing user packets for command submission. | 8.4 |
HIGH |
||
| Transient DOS in WLAN Firmware while interpreting MBSSID IE of a received beacon frame. | 7.5 |
HIGH |
||
| Transient DOS in WLAN Host when a mobile station receives invalid channel in CSA IE while doing channel switch announcement (CSA). | 7.5 |
HIGH |
||
| Memory corruption in WLAN HAL while parsing WMI command parameters. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while handling command through WMI interfaces. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while handling command streams through WMI interfaces. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while passing command parameters through WMI interfaces. | 7.8 |
HIGH |
||
| Memory corruption in WLAN handler while processing PhyID in Tx status handler. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while processing command parameters from untrusted WMI payload. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while parsing Rx buffer in processing TLV payload. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while processing Tx/Rx commands from QDART. | 7.8 |
HIGH |
||
| Memory corruption in WIN Product while invoking WinAcpi update driver in the UEFI region. | 8.4 |
HIGH |
||
| Memory Corruption in Core Platform while printing the response buffer in log. | 7.8 |
HIGH |
||
| Memory corruption in Core Platform while printing the response buffer in log. | 7.8 |
HIGH |
||
| Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range. | 8.4 |
HIGH |
||
| Transient DOS in Audio while remapping channel buffer in media codec decoding. | 7.5 |
HIGH |
||
| Memory corruption while allocating memory in COmxApeDec module in Audio. | 8.4 |
HIGH |
||
| Memory Corruption in Audio while playing amrwbplus clips with modified content. | 8.4 |
HIGH |
||
| Cryptographic issue in HLOS as derived keys used to encrypt/decrypt information is present on stack after use. | 7.7 |
HIGH |
||
| Cryptographic issue in HLOS due to improper authentication while performing key velocity checks using more than one key. | 7.1 |
HIGH |
||
| Memory Corruption in WLAN HOST while fetching TX status information. | 7.8 |
HIGH |
||
| Memory Corruption in WLAN HOST while parsing QMI WLAN Firmware response message. | 7.8 |
HIGH |
||
| Memory Corruption in WLAN HOST while parsing QMI response message from firmware. | 7.8 |
HIGH |
||
| Memory Corruption in Audio while allocating the ion buffer during the music playback. | 8.4 |
HIGH |
||
| Arbitrary memory overwrite when VM gets compromised in TX write leading to Memory Corruption. | 7.8 |
HIGH |
||
| Memory Corruption in WLAN HOST while processing WLAN FW request to allocate memory. | 7.8 |
HIGH |
||
| Memory corruption in Audio while running concurrent tunnel playback or during concurrent audio tunnel recording sessions. | 8.4 |
HIGH |
||
| Memory corruption in Audio while processing sva_model_serializer using memory size passed by HIDL client. | 7.8 |
HIGH |
||
| Memory Corruption in GPU Subsystem due to arbitrary command execution from GPU in privileged mode. | 7.8 |
HIGH |
||
| Memoru corruption in Audio when ADSP sends input during record use case. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HOST while receiving an WMI event from firmware. | 7.8 |
HIGH |
||
| Memory corruption in WLAN HAL while processing WMI-UTF command or FTM TLV1 command. | 8.4 |
HIGH |
||
| Memory corruption due to improper access control in kernel while processing a mapping request from root process. | 7.8 |
HIGH |
||
| Memory corruption due to double free in Core while mapping HLOS address to the list. | 8.4 |
HIGH |
||
| information disclosure due to cryptographic issue in Core during RPMB read request. | 7.1 |
HIGH |
||
| Memory corruption in Graphics while importing a file. | 8.4 |
HIGH |
||
| Memory corruption in Automotive due to Improper Restriction of Operations within the Bounds of a Memory Buffer while exporting a shared key. | 7.8 |
HIGH |
||
| Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target. | 8.4 |
HIGH |
||
| Memory corruption due to double free in core while initializing the encryption key. | 9.3 |
CRITICAL |
||
| Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message. | 8.4 |
HIGH |
||
| Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase. | 8.4 |
HIGH |
||
| Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity. | 7.8 |
HIGH |
||
| Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD. | 7.8 |
HIGH |
||
| Information Disclosure in Graphics during GPU context switch. | 6.2 |
MEDIUM |
||
| Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame. | 9.8 |
CRITICAL |
||
| Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon. | 7.5 |
HIGH |
||
| Transient DOS due to improper input validation in WLAN Host. | 7.5 |
HIGH |
||
| Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation. | 7.5 |
HIGH |
||
| Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command. | 8.4 |
HIGH |
||
| Information disclosure due to buffer over-read in WLAN while parsing NMF frame. | 8.2 |
HIGH |
||
| Memory corruption due to stack-based buffer overflow in Core | 8.4 |
HIGH |
||
| Information disclosure due to buffer overread in Core | 6.8 |
MEDIUM |
||
| Information disclosure due to buffer overread in Core | 6.8 |
MEDIUM |
||
| Memory corruption in core due to stack-based buffer overflow | 8.4 |
HIGH |
||
| Memory corruption in Core due to stack-based buffer overflow. | 8.4 |
HIGH |
||
| Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames. | 7.5 |
HIGH |
||
| Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames. | 7.5 |
HIGH |
||
| Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames. | 7.5 |
HIGH |
||
| Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame. | 8.2 |
HIGH |
||
| Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 8.2 |
HIGH |
||
| Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.5 |
HIGH |
||
| Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | 6.8 |
MEDIUM |
||
| Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music | 7.5 |
HIGH |
||
| Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 8.4 |
HIGH |
||
| Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | 7.5 |
HIGH |
||
| Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 8.4 |
HIGH |
||
| Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.5 |
HIGH |
||
| Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.5 |
HIGH |
||
| memory corruption in video due to buffer overflow while parsing asf clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 9.8 |
CRITICAL |
||
| Memory corruption in WLAN due to out of bound array access during connect/roaming in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 9.8 |
CRITICAL |
||
| Denial of service in WLAN due to out-of-bound read happens while processing VHT action frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.5 |
HIGH |
||
| Memory corruption in WLAN due to integer overflow to buffer overflow while parsing GTK frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 9.8 |
CRITICAL |
||
| Transient Denial-of-Service in WLAN due to buffer over-read while parsing MDNS frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.5 |
HIGH |
||
| Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | 8.4 |
HIGH |
||
| Memory corruption in graphics support layer due to use after free condition in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | 8.4 |
HIGH |
||
| Possible buffer overflow due to improper parsing of headers while playing the FLAC audio clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 9.8 |
CRITICAL |
||
| Possible buffer over read due to lack of size validation while copying data from DBR buffer to RX buffer and can lead to Denial of Service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 5.5 |
MEDIUM |
||
| Improper access control sequence for AC database after memory allocation can lead to possible memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 8.2 |
HIGH |
||
| Possible use after free due to lack of null check of DRM file status after file structure is freed in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables | 8.4 |
HIGH |
||
| Buffer overflow in sahara protocol while processing commands leads to overwrite of secure configuration data in Snapdragon Mobile, Snapdragon Compute, Snapdragon Auto, Snapdragon IOT, Snapdragon Connectivity, Snapdragon Voice & Music | 7.5 |
HIGH |
||
| Possible unauthorized access to secure space due to improper check of data allowed while flashing the no access control device configuration in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 8.4 |
HIGH |
||
| Possible out of bound read due to improper length calculation of WMI message. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 7.8 |
HIGH |
||
| Possible out of bounds access due to improper input validation during graphics profiling in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables | 8.4 |
HIGH |
||
| Possible out of bound write due to improper validation of number of timer values received from firmware while syncing timers in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 7.8 |
HIGH |
||
| Possible out of bound read due to improper validation of IE length during SSID IE parse when channel is DFS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 9.1 |
CRITICAL |
||
| Improper handling of permissions of a shared memory region can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking | 9.3 |
CRITICAL |
2024©
tesweb SA
