Archive
2 January 2024
Vulnerabilities first published on this day (UTC), newest first.
107 results · Feed
-
High 7.8
Use After Free in Audio
Memory corruption in Audio when memory map command is executed consecutively in ADSP.
-
High 7.8
Use After Free in Automotive Audio
Memory corruption while processing Listen Sound Model client payload buffer when there is a request for Listen Sound session get parameter from ST HAL.
-
High 7.8
Use After Free in Audio
Memory corruption when HLOS allocates the response payload buffer to copy the data received from ADSP in response to AVCS_LOAD_MODULE command.
-
High 7.5
Buffer over-read without Checking Size of Input in WLAN Host
Transient DOS while parsing ieee80211_parse_mscs_ie in WIN WLAN driver.
-
High 8.4
Use after free in Neural Processing Unit
Memory corruption while running NPU, when NETWORK_UNLOAD and (NETWORK_UNLOAD or NETWORK_EXECUTE_V2) commands are submitted at the same time.
-
High 8.4
Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Kernel
Memory corruption when resource manager sends the host kernel a reply message with multiple fragments.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS when WLAN firmware receives "reassoc response" frame including RIC_DATA element.
-
High 7.8
Use of Out-of-range Pointer Offset in Audio
The session index variable in PCM host voice audio driver initialized before PCM open, accessed during event callback from ADSP and reset during PCM close may lead to race condition between event callback - PCM close and reset session index causing memory cor…
-
High 7.5
NULL Pointer Dereference in WLAN Firmware
Transient DOS while processing a WMI P2P listen start command (0xD00A) sent from host.
-
High 8.4
Use After Free in Graphics
Memory corruption in Graphics Driver when destroying a context with KGSL_GPU_AUX_COMMAND_TIMELINE objects queued.
-
High 8.4
Use After Free in Linux Graphics
Memory corruption while running VK synchronization with KASAN enabled.
-
High 7.8
Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in Wearables
Memory corruption in wearables while processing data from AON.
-
High 7.5
Buffer Over-read in WLAN Firmware
Transient DOS in WLAN Firmware while parsing a BTM request.
-
High 7.5
Buffer Over-read in Data Modem
Transient DOS in Data Modem during DTLS handshake.
-
Medium 6.7
Integer Overflow or Wraparound in Radio Interface Layer
Memory corruption while receiving a message in Bus Socket Transport Server.
-
High 7.1
Cryptographic Issues in Automotive
Cryptographic issue in Automotive while unwrapping the key secs2d and verifying with RPMB data.
-
High 7.1
NULL Pointer Dereference in Hypervisor
Permanent DOS in Hypervisor while untrusted VM without PSCI support makes a PSCI call.
-
High 8.4
Use of Out-of-range Pointer Offset in Audio
Memory corruption in Audio during playback with speaker protection.
-
Critical 9.3
Integer Overflow or Wraparound in TZ Secure OS
Memory corruption in TZ Secure OS while requesting a memory allocation from TA region.
-
Critical 9.3
Buffer Copy without Checking Size of Input in HLOS
Memory corruption in HLOS while running playready use-case.
-
Critical 9.8
Buffer Copy without Checking Size of Input in Data Modem
Memory corruption in Data Modem when a non-standard SDP body, during a VOLTE call.
-
High 7.6
Improper Input Validation in Services
Information disclosure in Core services while processing a Diag command.
-
Medium 6.7
Double Free in Data Network Stack & Connectivity
Memory corruption when IPv6 prefix timer object`s lifetime expires which are created while Netmgr daemon gets an IPv6 address.
-
High 7.8
Perl: perl for windows binary hijacking vulnerability
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and exe…
-
Medium 5.5
Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds r…
-
High 7.3
Follow Redirects improperly handles URLs in the url.parse() function
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacke…
-
Medium 6.7
In bluetooth service, there is a possible out of bounds write due to improper input validation. This could lead to loca…
-
Medium 5.5
In wlan driver, there is a possible PIN crack due to use of insufficiently random values. This could lead to local info…
-
Medium 5.9
In modem EMM, there is a possible system crash due to improper input validation. This could lead to remote denial of se…
-
High 7.5
In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote …
-
High 7.5
In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote …
-
High 7.5
In Modem IMS Stack, there is a possible system crash due to a missing bounds check. This could lead to remote denial of…
-
High 7.5
In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check. This could lead to remote d…
-
Medium 6.7
In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.7
In netdagent, there is a possible information disclosure due to an incorrect bounds check. This could lead to local esc…
-
Medium 6.7
In Engineer Mode, there is a possible out of bounds write due to a missing bounds check. This could lead to local escal…
-
Medium 6.7
In battery, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of…
-
Medium 4.4
In battery, there is a possible information disclosure due to an integer overflow. This could lead to local information…
-
Medium 4.4
In battery, there is a possible information disclosure due to a missing bounds check. This could lead to local informat…
-
Medium 6.7
In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation …