CVE-2019-10531

CVE-2019-10531 describes an incorrect reading of the system image that results in a buffer overflow when the system image size is increased, affecting Snapdragon Auto, Mobile and Wearables platforms (MDM9607, MSM8909W, Qualcomm 215, SD 210/212/205, SD 425, 439/429, 450, 625, 632, SDM439 and relat...

CVE-2019-10533

Out of bound access due to improper validation of array index cause the index table entry to get corrupt in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9206, MDM9607, MSM8909W,...

CVE-2019-10533

CVE-2019-10533 describes an out-of-bounds access due to improper validation of an array index that corrupts an index table entry in Qualcomm/Snapdragon components (numerous SoCs and modems across Snapdragon Auto/Compute/Consumer IOT/Industrial IOT/Mobile/Voice & Music/Wearables portfolios). Conne...

CVE-2019-10531

Incorrect reading of system image resulting in buffer overflow when size of system image is increased in Snapdragon Auto, Snapdragon Mobile, Snapdragon Wearables in MDM9607, MSM8909W, Qualcomm 215, SD 210/SD 212/SD 205, SD 425, SD 439 / SD 429, SD 450, SD 625, SD 632, SDM439...

CVE-2019-10529

Possible use after free issue due to race condition while attempting to mark the entry pages as dirty using function setpagedirty in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-10529

CVE-2019-10529 is a use-after-free race in Qualcomm’s KGSL kernel path when marking user entries dirty via set_page_dirty, occurring if page->mapping is freed concurrently. It affects Snapdragon/KGSL GPU components and is associated with a documented exploit (exploit-db 46941). The provided do...

CVE-2019-10524

Lack of check for a negative value returned for getclk is wrongly interpreted as valid pointer and lead to use after free in clk driver in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206,...

CVE-2019-10524

CVE-2019-10524 involves a lack of validation for a negative value returned by get_clk, which is misinterpreted as a valid pointer, causing a use-after-free in the Qualcomm clk driver across numerous Snapdragon platforms (e.g., Snapdragon Auto/Mobile/IoT variants). The issue enables local exploita...

CVE-2019-10502

CVE-2019-10502 is a stack overflow vulnerability described across multiple Qualcomm Snapdragon camera implementations. The issue arises when an index equal to the I/O buffer size is accessed within the camera module, affecting a wide range of Snapdragon Compute, Snapdragon Consumer IoT, Snapdrago...

CVE-2019-10496

Lack of checking a variable received from driver and populating in Firmware data structure leads to buffer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearable...

CVE-2019-10495

CVE-2019-10495 describes an arbitrary buffer write during processing of sequence headers for HEVC/AVC encoding in Qualcomm Snapdragon SoCs (wide range of Snapdragon Auto/Compute/Connectivity/IoT devices). The vulnerability is caused by a buffer-write flaw in the encoder path; vulnerable component...

Qualcomm WLAN Host Information Disclosure Vulnerability

Qualcomm WLAN Host is a wireless LAN component from Qualcomm Incorporated USA. An information disclosure vulnerability exists in Qualcomm WLAN Host, which arises from configuration and other errors in the operation of the network system or product, and can be exploited by an unauthorized attacker...

Android Security Bulletin—November 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-11-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

IoT security will set innovation free: Azure Sphere general availability scheduled for February 2020

Today, at the IoT Solutions World Congress, we announced that Azure Sphere will be generally available in February of 2020. General availability will mark our readiness to fulfill our security promise at scale, and to put the power of Microsoft’s expertise to work for our customers every day—by...

Google October Android Security Update Fixes Critical RCE Flaws

UPDATE Google has released fixes for three critical-severity vulnerabilities in the Media framework of its Android operating system, which if exploited could allow a remote attacker to execute code. The remote code execution RCE flaws are part of Google’s October 2019 Android Security Bulletin,...

Qualcomm Closed Source Components Multiple Unspecified Vulnerabilities

Description Qualcomm Closed-Source Components are prone to multiple unspecified vulnerabilities. An attacker can exploit these issues to perform unauthorized actions. This may aid in further attacks. These issues are being tracked by Android Bug IDs A-122474427, A-129766175, A-129765090,...

Android Security Bulletin—October 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-10-06 or later address all of these issues. To learn how to check a device's security patch level, see Check & update your Android version. Android partners are...

CVE-2019-10539

Possible buffer overflow issue due to lack of length check when parsing the extended cap IE header length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdrag...

CVE-2019-2294

Usage of hard-coded magic number for calculating heap guard bytes can allow users to corrupt heap blocks without heap algorithm knowledge in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial...

CVE-2019-2341

Buffer overflow when the audio buffer size provided by user is larger than the maximum allowable audio buffer size. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in...