PT-2019-11938

Name of the Vulnerable Software and Affected Versions Qualcomm Snapdragon Auto versions APQ8009, APQ8017, APQ8053, APQ8096AU, APQ8098, MDM9206, MDM9207C, MDM9607, MDM9640, MDM9650, MSM8909W, MSM8917, MSM8920, MSM8937, MSM8940, MSM8953, MSM8996AU, MSM8998, Nicobar, QCN7605, QCS405, QCS605, QM215,...

CVE-2019-10592

Possible integer overflow while multiplying two integers of 32 bit in QDCM API of get display modes as there is no check on the maximum mode count in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-2288

Out of bound write in TZ while copying the secure dump structure on HLOS provided buffer as a part of memory dump in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

Design/Logic Flaw

Use after free issue occurs when command destructors access dynamically allocated response buffer which is already deallocated during previous command teardwon sequence in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice ...

Design/Logic Flaw

Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Hardcoded credentials

HLOS could corrupt CPZ page table memory for S1 managed VMs in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking in MDM9205, QCS404, QCS605, SDA845, SDM670, SDM710,...

CVE-2019-2319

CVE-2019-2319 affects Qualcomm Snapdragon platforms (Auto, Compute, Connectivity, IoT, Mobile, etc.) where the HLOS may corrupt CPZ page table memory for S1 managed VMs. Root cause is memory corruption in the CPZ page table handling. The CVSSv3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) yield...

CVE-2019-10571

Snapshot of IB can lead to invalid address access due to missing check for size in the related function in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-10571

CVE-2019-10571 targets Qualcomm Snapdragon family GPUs/graphics drivers (listed APQ/MSM/SDM devices) with a memory-access flaw: a missing size check in a function can lead to invalid address access. Public references show vendor advisories (Qualcomm November 2019 bulletin) and cross-links in Red ...

PT-2019-11939

Name of the Vulnerable Software and Affected Versions QDCM API versions affected versions not specified Description The issue is related to a possible integer overflow while multiplying two integers of 32 bit in the QDCM API of get display modes. This occurs because there is no check on the maxim...

PT-2019-4697

Name of the Vulnerable Software and Affected Versions Intel NUC Kit, Intel Compute Stick, Intel Compute Card affected versions not specified Description The issue is related to an out of bounds write in the firmware, which may allow a privileged user to potentially enable escalation of privilege...

Multiple Intel NUC Firmware Multiple Security Vulnerabilities

Description Multiple Intel NUC Firmware are prone to multiple unspecified security vulnerabilities. Attackers can leverage these issues to gain elevated privileges. Technologies Affected Intel Compute Card CD1IV128MK BIOS Intel Compute Card CD1M3128MK BIOS Intel Compute Card CD1P64GK BIOS Intel...

PT-2019-4700

Name of the Vulnerable Software and Affected Versions Intel NUC affected versions not specified Intel NUC Kit affected versions not specified Intel Compute Stick affected versions not specified Intel Compute Card affected versions not specified Description The issue is related to improper input...

PT-2019-4699

Name of the Vulnerable Software and Affected Versions Intel NUC versions affected versions not specified Intel NUC Kit versions affected versions not specified Intel Compute Stick versions affected versions not specified Intel Compute Card versions affected versions not specified Description The...

PT-2019-4698

Name of the Vulnerable Software and Affected Versions Intel NUC versions affected versions not specified Intel NUC Kit versions affected versions not specified Intel Compute Stick versions affected versions not specified Intel Compute Card versions affected versions not specified Description The...

PT-2019-4701

Name of the Vulnerable Software and Affected Versions Intel NUC versions affected versions not specified Intel NUC Kit versions affected versions not specified Intel Compute Stick versions affected versions not specified Intel Compute Card versions affected versions not specified Description The...

Security Bulletin: PowerVC is impacted by an OpenStack Neutron vulnerability related to security group rules (CVE-2019-10876)

Summary OpenStack Neutron is vulnerable to a denial of service, caused by a flaw in the neutron-openvswitch-agent. By creating two security groups with separate/overlapping port ranges, a remote authenticated attacker could exploit this vulnerability to prevent Neutron from being able to configur...

Updated libcryptopp packages fix security vulnerability

The updated packages fix a security vulnerability: Crypto++ 8.3.0 and earlier contains a timing side channel in ECDSA signature generation. This allows a local or remote attacker, able to measure the duration of hundreds to thousands of signing operations, to compute the private key used. The iss...

Unspecified Vulnerability in CloudBees Jenkins Google Compute Engine Plugin (CNVD-2019-42819)

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Google Compute Engine Plugin is used in one o...

CloudBees Jenkins Google Compute Engine Plugin Cross-Site Request Forgery Vulnerability

CloudBees Jenkins Hudson Labs is the United States CloudBees company's set of Java-based development of continuous integration tools. The product is mainly used to monitor the continuous software version release/testing projects and some timed tasks . Google Compute Engine Plugin is used in one o...