CVE-2019-2309

CVE-2019-2309 describes an integer overflow when storing calibrated firmware data in cache, caused by the data length received potentially exceeding the real length. Affected are multiple Qualcomm/Snapdragon families (e.g., Snapdragon Auto, Snapdragon Mobile, Snapdragon 845/850, SDM660, QCA6174A,...

CVE-2019-2316

CVE-2019-2316 concerns Qualcomm Snapdragon components where a local variable is used after it goes out of scope during digest computation in multiple Snapdragon platforms (MDM9640, QCS405, QCS605, SD 4xx/6xx/7xx series, 710/712/730/845/850/855, SDM660/SDX24, etc.). The root cause is a use-after-s...

CVE-2019-2308

CVE-2019-2308 is described across connected docs as a kernel-level issue where fastrpc_internal_invoke in drivers/misc/fastrpc.c does not prevent user applications from sending kernel RPC messages (CID-20c40794eb85), enabling a local escalation path to the fastrpc/DSP subsystem. The Astra Linux e...

CVE-2019-2278

CVE-2019-2278 affects Qualcomm components on Snapdragon platforms (Auto, Consumer IoT, Mobile) where the keystore signature is ignored during boot, enabling a bypass of boot image signature verification. Affected devices include SDM660, SD 712/710/670, SD 845/850, SD 625/636/427/425/430/435/450 a...

CVE-2019-2312

CVE-2019-2312 describes a potential buffer overflow in vendor command handling due to insufficient input validation on data buffers across Snapdragon platforms ( Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, S...

CVE-2019-2305

Out of bound access when reason code is extracted from frame data without validating the frame length in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9150, MDM9206, MDM9607,...

CVE-2019-2290

CVE-2019-2290 affects the Qualcomm camera stack across Snapdragon devices. The root cause is a race condition where multiple threads opening/closing the camera driver can cause access to a destroyed session data pointer, potentially impacting camera operation. Documents from NVD and Red Hat descr...

CVE-2019-2312

When handling the vendor command there exists a potential buffer overflow due to lack of input validation of data buffer received in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in...

CVE-2019-2327

Possible buffer overflow can occur when playing clip with incorrect element size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MDM9150, MDM9206, MDM9607, MDM9650,...

CVE-2019-2316

When computing the digest a local variable is used after going out of scope in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music in MDM9640, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD 636, SD 665, SD 675, SD 712 / SD 710 / SD 670, SD 730...

CVE-2019-2281

An unauthenticated bitmap image can be loaded in to memory and subsequently cause execution of unverified code. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music in QCS405, QCS605, SD 636, SD 665, SD 675...

CVE-2019-2299

CVE-2019-2299 is an out-of-bounds write vulnerability triggered by a specially crafted command from a userspace application. The Red Hat advisory and CVE listings confirm the issue affects Qualcomm Snapdragon platforms (e.g., IPQ4019, IPQ8064, IPQ8074, MDM9xxx, MSM8xxx, QCA7xxx, SDx families) and...

CVE-2019-2327

CVE-2019-2327 describes a possible buffer overflow when playing a clip with an incorrect element size affecting a wide range of Qualcomm Snapdragon platforms (Snapdragon Auto, Compute, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables, and related SDM/SD/ Snapdragon families). T...

CVE-2019-2322

CVE-2019-2322 is a buffer overflow vulnerability in Qualcomm Snapdragon media playback paths affecting a wide range of Snapdragon SoCs and product lines (e.g., Snapdragon Auto/Compute/Connectivity, Snapdragon Mobile, Media frameworks). The issue occurs when playing a specific non-standard clip, e...

CVE-2019-2309

While storing calibrated data from firmware in cache, An integer overflow may occur since data length received may exceed real data length. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice &...

CVE-2019-2290

Multiple open and close from multiple threads will lead camera driver to access destroyed session data pointer in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables in MDM9206, MDM9607, MDM9640, MDM9650, MSM8909W,...

CVE-2019-2299

An out-of-bound write can be triggered by a specially-crafted command supplied by a userspace application. in Snapdragon Auto, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wired...

CVE-2019-2293

Pointer dereference while freeing IFE resources due to lack of length check of in port resource. in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables in MSM8909W, QCS405, QCS605, SD 425, SD 427, SD 430, SD 435, SD 450, SD 625, SD...

CVE-2019-2328

CVE-2019-2328 describes a potential buffer overflow when the number of channels exceeds the size of the channel mapping array in Qualcomm/ Snapdragon audio-related components (across multiple Snapdragon families). The vulnerability is listed under Qualcomm Audio in the 2019 Android security conte...

CVE-2019-2306

CVE-2019-2306 is described as: an improper casting of a structure while handling a buffer causes an out-of-bounds read in the display code across Snapdragon platforms (Snapdragon Auto, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Voice & Music, Wearables) on multiple SoCs (e.g., SD se...