CVE-2019-14055

Possibility of use-after-free and double free because of not marking buffer as NULL after freeing can lead to dangling pointer access in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdrago...

CVE-2019-14051

CVE-2019-14051 concerns memory handling in Qualcomm Snapdragon Industrial IOT kernels (MDM9206/MDM9607). Multiple connected sources describe an input validation/allocation path that can overflow memory during module loading, causing a buffer overflow in the kernel. Red Hat’s security entry attrib...

CVE-2019-14057

CVE-2019-14057 is a buffer over-read in the codec private data while parsing MKV files, triggered by missing buffer-size validation during read in Qualcomm Snapdragon platforms (including Snapdragon Auto/Compute/Connectivity, IoT variants, and related SoCs such as APQ8xxx, SDM/SM series). Root ca...

CVE-2019-14046

Out of bound access while allocating memory for an array in camera due to improper validation of elements parameters in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Musi...

CVE-2019-14049

CVE-2019-14049 describes a Stage-2 fault during writes to an ION system allocation assigned to non-HLOS memory in Qualcomm-based Snapdragon platforms (across multiple product lines such as Snapdragon Auto/Compute/Mobile) with non-standard memory usage. The flaw is presented as a memory/write-proc...

CVE-2019-14046

CVE-2019-14046 is a Qualcomm/Snapdragon vulnerability described as an out-of-bounds memory allocation during camera parameter validation across Snapdragon Auto, Compute, and related chips (QCS605, SDM439, SDX24). Connected sources (NVD/NVD family, Red Hat advisory, CVE listings, and Android bulle...

CVE-2019-14049

Stage-2 fault will occur while writing to an ION system allocation which has been assigned to non-HLOS memory which is non-standard in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdrag...

CVE-2019-14044

Out of bound access due to access of uninitialized memory segment in an array of pointers while normal camera open close in Snapdragon Consumer IOT, Snapdragon Mobile in QCS605, SDM439, SDM630, SDM636, SDM660, SDX24...

CVE-2019-14044

CVE-2019-14044 is an out-of-bounds memory access in an array of pointers during normal camera open/close on Qualcomm Snapdragon platforms (e.g., QCS605, SDM439/630/636/660/SDX24/SDM660). Root cause: use of uninitialized memory segment leading to potential privilege impact. Documented impact is Hi...

CVE-2019-14041

CVE-2019-14041 affects Qualcomm Snapdragon platforms (listed APQ, SDM, SM etc.) in kernel components. The issue is a buffer overrun caused by a lack of buffer size verification when updating the message buffer with physical address information during listener modified response processing. The vul...

CVE-2019-14041

During listener modified response processing, a buffer overrun occurs due to lack of buffer size verification when updating message buffer with physical address information in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobil...

CVE-2019-14002

APKs without proper permission may bind to CallEnhancementService and can lead to unauthorized access to call status in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in APQ8053, APQ8096AU, APQ8098, MSM8909W, MSM891...

CVE-2019-14040

Using memory after being freed in qsee due to wrong implementation can lead to unexpected behavior such as execution of unknown code in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

CVE-2019-14040

CVE-2019-14040 is a memory-use-after-free condition in the qsee component that can lead to unexpected behavior, including execution of unknown code, on Qualcomm Snapdragon platforms. Affected families include Snapdragon Auto/Compute/IoT/Wearables (covering numerous SoCs such as APQ8xxx, SDM/SMX l...

CVE-2019-14002

CVE-2019-14002 describes a local vulnerability where APKs without proper permission may bind to CallEnhancementService, enabling unauthorized access to call status on Qualcomm-based Snapdragon platforms (including Snapdragon Auto/Compute/Consumer IOT/Industrial IOT, Mobile, Wearables; e.g., APQ80...

CVE-2019-10567

CVE-2019-10567 affects Qualcomm Adreno GPU kernel driver (KGSL) where a randomized scratch buffer in the global shared mappings is used to store the RPTR for the ringbuffer. The attack leverages the RPTR read from scratch to influence ringbuffer space checks, allowing an attacker-controlled RPTR ...

CVE-2019-10590

CVE-2019-10590 concerns an out-of-bounds access when parsing a dts atom in Qualcomm/Snapdragon components (closed-source). Affected products are listed in the initial record and include Snapdragon Auto, Compute, Connectivity, IoT, Wearables and related Snapdragon families across numerous SoCs (e....

CVE-2019-10567

There is a way to deceive the GPU kernel driver into thinking there is room in the GPU ringbuffer and overwriting existing commands could allow unintended GPU opcodes to be executed in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile,...

CVE-2019-10590

Out of bound access while parsing dts atom, which is non-standard as it does not have valid number of tracks in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon...

Ubuntu: Security Advisory (USN-4254-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...