Memory corruption

Thread start can cause invalid memory writes to arbitrary memory location since the argument is passed by user to kernel in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile in MDM9205, MDM9640, MSM8996AU, QCA6574,...

Code injection

Payload size is not checked before using it as array index in audio in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking in...

Double free

Double free issue can happen when sensor power settings is freed by some thread while another thread try to access. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music...

CVE-2019-2325

CVE-2019-2325 affects a wide range of Qualcomm Snapdragon components (Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/IoT/Mobile/Voice & Music/Wearables) across multiple platforms (MDM9150, MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8996AU, QCS405, QCS605, and various SD/SDM/SDA/SDX ser...

CVE-2019-2331

CVE-2019-2331 describes a possible integer overflow caused by subtracting two integers without overflow checks in Qualcomm/Xiaomi Snapdragon family devices (e.g., Snapdragon Auto/Compute/IoT/Mobile and related SSDs listed in the description). The issue affects a broad set of Qualcomm/Snapdragon c...

CVE-2019-2275

CVE-2019-2275 centers on a buffer overflow during deserialization of a key blob in Qualcomm Snapdragon firmware (multiple Snapdragon Auto/Compute/Connectivity/Secure elements). The issue arises when key operations are invoked and depends on CVE-2018-13907. Affected components include numerous Sna...

CVE-2019-10565

CVE-2019-10565 describes a double-free vulnerability in Snapdragon socs (Snapdragon Auto/Compute/CS/IoT/Wearables, etc.) where freeing sensor power settings in one thread while another accesses the object can corrupt memory. Affected components include APQ8053, MDM92xx, SDM845, QCS605/SDX24, SXR1...

CVE-2019-10534

Null-pointer dereference can occur while accessing the super index entry when it is not been allocated in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W,...

CVE-2019-10541

Dereference on uninitialized buffer can happen when parsing FLV clip with corrupted codec specific data in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W,...

CVE-2019-10529

CVE-2019-10529 is a use-after-free race in Qualcomm’s KGSL kernel path when marking user entries dirty via set_page_dirty, occurring if page->mapping is freed concurrently. It affects Snapdragon/KGSL GPU components and is associated with a documented exploit (exploit-db 46941). The provided do...

CVE-2019-10502

CVE-2019-10502 is a stack overflow vulnerability described across multiple Qualcomm Snapdragon camera implementations. The issue arises when an index equal to the I/O buffer size is accessed within the camera module, affecting a wide range of Snapdragon Compute, Snapdragon Consumer IoT, Snapdrago...

CVE-2019-10488

CVE-2019-10488 describes a Null pointer dereference in the Qualcomm Snapdragon media parsing when handling nonstandard clips; the issue affects a broad range of Snapdragon platforms (Auto, Compute, IoT, Mobile, Wearables, etc.) across many SD/SoC families listed in the description. Root cause is ...

DEBIAN-CVE-2013-2255

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

CVE-2013-2255

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

Code injection

HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates...

CVE-2013-2255

OpenStack CVE-2013-2255 affects HTTPSConnections in Keystone (2013) and OpenStack Compute (2013.1), and possibly other OpenStack components. Root cause: server-side SSL certificate validation is not performed, allowing potential impersonation or man-in-the-middle scenarios where untrusted certifi...

CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic plugin cross-site request forgery vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task.Oracle Cloud Infrastructure...

Unspecified Vulnerability in CloudBees Jenkins Oracle Cloud Infrastructure Compute Classic Plugin

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed execution of the task.Oracle Cloud Infrastructure...

foreman: Recover of plaintext password or token for the compute resources

It was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the plaintext password or token for the affected compute resource. A malicious user with the "deletecomputeresource" permission can use this flaw to take control over compu...

CVE-2019-10457

A missing permission check in Jenkins Oracle Cloud Infrastructure Compute Classic Plugin allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials...