Main Vulnerability Database SB2020120734

SB2020120734 - Multiple vulnerabilities in Qualcomm chipsets

Published: December 7, 2020 Updated: October 8, 2025

Security Bulletin ID SB2020120734

CSH Severity

High

Patch available

YES

Number of vulnerabilities 33

Exploitation vector Remote access

Highest impact Code execution

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 33 vulnerabilities.

1) Buffer over-read (CVE-ID: CVE-2020-11119)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation in WLAN. A remote attacker can perform a denial of service (DoS) attack.

2) Exposure of sensitive information to an unauthorized actor (CVE-ID: CVE-2020-3687)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local application to gain access to sensitive information.

The vulnerability exists due to improper input validation in Bluetooth Host. A local application can gain access to sensitive information.

3) Improper Validation of Array Index (CVE-ID: CVE-2020-11146)

CWE-ID: CWE-129 - Improper Validation of Array Index

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in HLOS. A local application can execute arbitrary code.

4) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2020-11149)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Multimedia. A local privileged application can execute arbitrary code.

5) Use of Out-of-range Pointer Offset (CVE-ID: CVE-2020-11150)

CWE-ID: CWE-823 - Use of Out-of-range Pointer Offset

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Camera driver. A local privileged application can execute arbitrary code.

6) Use After Free (CVE-ID: CVE-2020-11151)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in Video. A local privileged application can execute arbitrary code.

7) Configuration (CVE-ID: CVE-2020-11179)

CWE-ID: CWE-16 - Configuration

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local application to execute arbitrary code.

The vulnerability exists due to improper input validation in Kernel. A local application can execute arbitrary code.

8) Use After Free (CVE-ID: CVE-2020-11152)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged application to execute arbitrary code.

The vulnerability exists due to improper input validation in GPS. A local privileged application can execute arbitrary code.

9) Buffer over-read (CVE-ID: CVE-2020-11136)

CWE-ID: CWE-126 - Buffer over-read

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]