Archive
5 December 2023
Vulnerabilities first published on this day (UTC), newest first.
131 results · Feed
-
High 8.4
NULL pointer dereference in WLAN Firmware
Memory corruption when processing cmd parameters while parsing vdev.
-
High 7.8
Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in Core
Memory corruption in Core while processing RX intent request.
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption in WLAN Host while processing RRM beacon on the AP.
-
Critical 9.8
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN Host
Memory corruption while sending an Assoc Request having BTM Query or BTM Response containing MBO IE.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while converting TWT (Target Wake Time) frame parameters in the OTA broadcast.
-
High 7.5
Buffer over-read in WLAN Firmware
Transient DOS while parsing a vender specific IE (Information Element) of reassociation response management frame.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio while running invalid audio recording from ADSP.
-
High 8.4
Improper Access Control in Automotive OS Platform Android
Memory corruption in Automotive OS whenever untrusted apps try to access HAb for graphics functionalities.
-
High 7.1
Improper Authentication in Automotive OS
Transient DOS in Automotive OS due to improper authentication to the secure IO calls.
-
High 7.8CVE-2023-33063 Exploited
Use After Free in DSP Services
Memory corruption in DSP Services during a remote call from HLOS to DSP.
KEV Dec 5, 2023 -
Critical 9.1
Improper Authentication in GPS HLOS Driver
Cryptographic issue in GPS HLOS Driver while downloading Qualcomm GNSS assistance data.
-
High 8.4
Improper Validation of Array Index in Kernel
Memory corruption in Kernel while parsing metadata.
-
High 7.5
Reachable Assertion in Data Modem
Transient DOS in Data modem while handling TLB control messages from the Network.
-
High 7.5
Reachable Assertion in Modem
Transient DOS in Modem when a Beam switch request is made with a non-configured BWP.
-
High 7.5
Improper Input Validation in Modem
Transient DOS in Modem after RRC Setup message is received.
-
High 7.5
Reachable assertion in WLAN Firmware
Under certain scenarios the WLAN Firmware will reach an assertion due to state confusion while looking up peer ids.
-
Medium 6.7
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface Layer
Memory corruption while sending SMS from AP firmware.
-
High 8.4
Integer Overflow to Buffer Overflow in HLOS
Memory corruption in HLOS while invoking IOCTL calls from user-space.
-
High 7.8
Integer Overflow to Buffer Overflow in User Identity Module
Memory corruption while using the UIM diag command to get the operators name.
-
High 7.8
Buffer Copy Without Checking Size of Input in Boot
Memory corruption in Boot while running a ListVars test in UEFI Menu during boot.
-
High 7.5CVE-2023-28588 Public exploit
Integer Overflow or Wraparound in Bluetooth Host
Transient DOS in Bluetooth Host while rfc slot allocation.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller
Memory corruption in BT controller while parsing debug commands with specific sub-opcodes at HCI interface level.
-
Medium 6.0
Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS
Information disclosure when the trusted application metadata symbol addresses are accessed while loading an ELF in TEE.
-
High 8.2
Integer Overflow to Buffer Overflow in TZ Secure OS
Memory corruption while loading an ELF segment in TEE Kernel.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory corruption in WLAN Host while setting the PMK length in PMK length in internal cache.
-
Medium 6.7
Buffer Copy Without Checking Size of Input in WLAN Host
Memory Corruption in WLAN Host while deserializing the input PMK bytes without checking the input PMK length.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS
Memory corruption in UTILS when modem processes memory specific Diag commands having arbitrary address values as input arguments.
-
High 7.8
Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance
Memory corruption in MPP performance while accessing DSM watermark using external memory address.
-
High 7.8
Buffer Copy Without Checking Size of Input in SPS Applications
Memory Corruption in SPS Application while exporting public key in sorter TA.
-
Medium 6.7
Use After Free in Audio
Memory Corruption in Audio while invoking IOCTLs calls from the user-space.
-
Medium 6.7
Use After Free in Camera
Memory Corruption in camera while installing a fd for a particular DMA buffer.
-
Medium 6.7
Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer
Memory Corruption in Radio Interface Layer while sending an SMS or writing an SMS to SIM.
-
Medium 6.7
Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR D…
-
High 7.5
Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute…
-
High 7.5
Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute J…
-
Medium 6.5
Improper usage of insecure protocol (i.e. HTTP) in SogouSDK of Chinese Samsung Keyboard prior to versions 5.3.70.1 in A…
-
Medium 6.5
Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00…
-
Medium 6.8
Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17…
-
Medium 5.4
Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass au…
-
Medium 5.4
Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass au…