CVE-2023-33248

Amazon Alexa software version 8960323972 on Echo Dot 2nd generation and 3rd generation devices potentially allows attackers to deliver security-relevant commands via an audio signal between 16 and 22 kHz often outside the range of human adult hearing. Commands at these frequencies are essentially...

CVE-2023-33248

CVE-2023-33248 affects Amazon Alexa on Echo Dot 2nd/3rd gen with firmware version 8960323972. The flaw allows attackers to deliver security-relevant commands via ultrasonic audio signals in the 16–22 kHz range, which are often outside adult hearing. Impacted component is the Alexa software’s comm...

Amazon Alexa 安全漏洞

Amazon Alexa is a smart assistant from Amazon.com, Inc. A security vulnerability exists in Amazon Alexa version 8960323972, which stems from a vulnerability that could allow an attacker to deliver security-related commands via audio signals between 16 and 22 kHz, which is typically outside of the...

May 24, 2023—KB5026446 (OS Build 22621.1778) Preview

None None...

May 23, 2023—KB5026436 (OS Build 22000.2003) Preview

None None...

Apache OpenMeetings Code Execution Vulnerability

Apache OpenMeetings is a multilingual, customizable video conferencing and collaboration system from the Apache Foundation. The product supports audio, video and allows users to view each participant's desktop and more. A code execution vulnerability exists in Apache OpenMeetings versions 2.0.0...

The vulnerability of the ChromeOS Audio Server component of Google Chrome browsers on ChromeOS and ChromeOS Flex operating systems allows a hacker to execute arbitrary code.

The vulnerability of the ChromeOS Audio Server component in Google Chrome browsers, as well as in ChromeOS and ChromeOS Flex operating systems, is caused by a buffer overflow in the queue. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using a specially created...

Apache OpenMeetings Information Disclosure Vulnerability

Apache OpenMeetings is a multi-language, customizable video conferencing and collaboration system from the Apache Foundation. The product supports audio, video and allows users to view each participant's desktop and more. A security vulnerability exists in Apache OpenMeetings versions 2.0.0 throu...

kernel: ALSA: usb-audio: Cancel pending work at closing a MIDI substream

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Cancel pending work at closing a MIDI substream At closing a USB MIDI output substream, there might be still a pending work, which would eventually access the rawmidi runtime object that is being released. For...

kernel: ASoC: qcom: Add checks for devm_kcalloc

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: Add checks for devmkcalloc As the devmkcalloc may return NULL, the return value needs to be checked to avoid NULL poineter dereference...

kernel: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: cnl: Do not process IPC reply before firmware boot It is not yet clear, but it is possible to create a firmware so broken that it will send a reply message before a FWREADY message it is not yet clear if FWREADY...

kernel: ASoC: Intel: avs: Fix potential buffer overflow by snprintf()

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix potential buffer overflow by snprintf snprintf returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in a buffer overflow although it's...

kernel: ASoc: audio-graph-card2: Fix refcount leak bug in __graph_get_type()

In the Linux kernel, the following vulnerability has been resolved: ASoc: audio-graph-card2: Fix refcount leak bug in graphgettype We should call ofnodeput for the reference before its replacement as it returned by ofgetparent which has increased the refcount. Besides, we should also call ofnodep...

kernel: ALSA: usb-audio: ALSA USB Audio Out-of-Bounds Bug

A flaw was found in the Linux kernel ALSA USB audio driver. This vulnerability allows a denial of service via a crafted USB audio device...

kernel: ALSA: usb-audio: Fix potential memory leaks

A memory leak was found in the Linux kernel's USB audio driver in the synchronization endpoint URB allocation path. When memory allocation fails partway through allocating URBs for a sync endpoint, the error handling code fails to release the partially allocated URBs because the endpoint's URB...

kernel: ASoC: da7219: Fix an error handling path in da7219_register_dai_clks()

A flaw was found in the Linux kernel's ASoC da7219 audio codec driver. An error handling path in da7219registerdaiclks incorrectly attempts to unregister a clock that was never successfully registered. This could lead to incorrect resource cleanup during driver probe failure, potentially causing...

kernel: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf()

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: Fix potential buffer overflow by snprintf snprintf returns the would-be-filled size when the string overflows the given buffer size, hence using this value may result in the buffer overflow although it's...

kernel: ASoC: mt6359: Fix refcount leak bug

In the Linux kernel, the following vulnerability has been resolved: ASoC: mt6359: Fix refcount leak bug In mt6359parsedt and mt6359accdetparsedt, we should call ofnodeput for the reference returned by ofgetchildbyname which has increased the refcount...

kernel: ASoC: pxa: fix null-pointer dereference in filter()

A flaw was found in the Linux kernel ASoC pxa audio driver. The function filter used kasprintf to allocate a formatted string but did not check whether the allocation succeeded before passing the result to strcmp. If memory allocation fails and kasprintf returns NULL, this results in a NULL point...

PT-2026-31514

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in Google Chrome's audio component, prior to version 147.0.7727.55. A remote attacker could bypass sandbox download restrictions by convincing a user to...