Sa9000p Firmware
by Qualcomm
CVEs (403)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-33210 | Hig | 0.55 | 8.4 | 0.00 | Oct 19, 2022 | Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto | ||
| CVE-2022-25661 | Hig | 0.55 | 8.4 | 0.00 | Oct 19, 2022 | Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile | ||
| CVE-2022-22106 | Hig | 0.55 | 8.4 | 0.00 | Sep 2, 2022 | Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto | ||
| CVE-2022-22104 | Hig | 0.55 | 8.4 | 0.00 | Sep 2, 2022 | Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto | ||
| CVE-2022-22100 | Hig | 0.55 | 8.4 | 0.00 | Sep 2, 2022 | Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto | ||
| CVE-2022-22099 | Hig | 0.55 | 8.4 | 0.00 | Sep 2, 2022 | Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto | ||
| CVE-2021-35132 | Hig | 0.55 | 8.4 | 0.00 | Sep 2, 2022 | Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables | ||
| CVE-2021-35114 | Hig | 0.55 | 8.4 | 0.00 | Jun 14, 2022 | Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto | ||
| CVE-2021-35115 | Hig | 0.55 | 8.4 | 0.00 | Apr 1, 2022 | Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile | ||
| CVE-2026-24088 | Hig | 0.53 | 8.2 | 0.00 | Jun 1, 2026 | Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader. | ||
| CVE-2025-21487 | Hig | 0.53 | 8.2 | 0.00 | Sep 24, 2025 | Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length. | ||
| CVE-2025-21484 | Hig | 0.53 | 8.2 | 0.00 | Sep 24, 2025 | Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet. | ||
| CVE-2025-21427 | Hig | 0.53 | 8.2 | 0.00 | Jul 8, 2025 | Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network. | ||
| CVE-2024-53026 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call. | ||
| CVE-2024-53021 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while processing goodbye RTCP packet from network. | ||
| CVE-2024-53020 | Hig | 0.53 | 8.2 | 0.00 | Jun 3, 2025 | Information disclosure may occur while decoding the RTP packet with invalid header extension from network. | ||
| CVE-2024-45552 | Hig | 0.53 | 8.2 | 0.00 | Apr 7, 2025 | Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards. | ||
| CVE-2024-49839 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Memory corruption during management frame processing due to mismatch in T2LM info element. | ||
| CVE-2024-49838 | Hig | 0.53 | 8.2 | 0.00 | Feb 3, 2025 | Information disclosure while parsing the OCI IE with invalid length. | ||
| CVE-2024-38408 | Hig | 0.53 | 8.2 | 0.00 | Nov 4, 2024 | Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions. |
- risk 0.55cvss 8.4epss 0.00
Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Memory corruption due to untrusted pointer dereference in kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile
- risk 0.55cvss 8.4epss 0.00
Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Out of bound write in DSP service due to improper bound check for response buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
- risk 0.55cvss 8.4epss 0.00
Improper buffer initialization on the backend driver can lead to buffer overflow in Snapdragon Auto
- risk 0.55cvss 8.4epss 0.00
Improper handling of multiple session supported by PVM backend can lead to use after free in Snapdragon Auto, Snapdragon Mobile
- risk 0.53cvss 8.2epss 0.00
Cryptographic Issue while processing a specific partition which allows unauthorized write access to load a customized bootloader.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while decoding RTP packet received by UE from the network, when payload length mentioned is greater than the available buffer length.
- risk 0.53cvss 8.2epss 0.00
Information disclosure when UE receives the RTP packet from the network, while decoding and reassembling the fragments from RTP packet.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while decoding this RTP packet Payload when UE receives the RTP packet from the network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while processing goodbye RTCP packet from network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur while decoding the RTP packet with invalid header extension from network.
- risk 0.53cvss 8.2epss 0.00
Information disclosure may occur during a video call if a device resets due to a non-conforming RTCP packet that doesn`t adhere to RFC standards.
- risk 0.53cvss 8.2epss 0.00
Memory corruption during management frame processing due to mismatch in T2LM info element.
- risk 0.53cvss 8.2epss 0.00
Information disclosure while parsing the OCI IE with invalid length.
- risk 0.53cvss 8.2epss 0.00
Cryptographic issue when a controller receives an LMP start encryption command under unexpected conditions.
Page 5 of 21