CVE-2020-11151

Race condition occurs while calling user space ioctl from two different threads can results to use after free issue in video in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables...

CVE-2020-11151

CVE-2020-11151 describes a race condition in video handling on Qualcomm Snapdragon devices (Auto, Compute, Connectivity, Industrial IOT, Mobile, Wearables). Two threads calling a user-space ioctl concurrently can trigger a use-after-free in the video stack. Impact per NVD indicates potential high...

CVE-2020-11149

CVE-2020-11149 involves an out-of-bounds access caused by an out-of-range pointer offset in the camera driver across Snapdragon platforms (Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables). The vulnerability stems from improper pointer handling in the camera su...

CVE-2020-11150

CVE-2020-11150 describes an out-of-bounds memory access in the camera driver caused by improper validation of data from UMD, which affects pointer offset manipulation across multiple Snapdragon SKUs (Auto/Compute/Connectivity/Consumer IoT/Industrial IoT/Mobile/Voice & Music/Wearables). The issue ...

CVE-2020-11148

Use after free issue in HIDL while using callback to post event in Rx thread when internal mutex is not acquired and meantime close is triggered and callback instance is deleted in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT,...

CVE-2020-11148

CVE-2020-11148 describes a use-after-free in HIDL when posting events from a callback in a Snapdragon stack (Auto/Compute/Connectivity/Consumer IOT/Industrial IOT/Mobile/Wearables). The root cause is that a callback instance can be deleted in a window where an internal mutex is not held and a clo...

CVE-2020-11146

Out of bound write while copying data using IOCTL due to lack of check of array index received from user in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2020-11146

CVE-2020-11146 describes an out-of-bounds write during IOCTL data copying due to missing check of a user-provided array index in Qualcomm Snapdragon components (across Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, Voice & Music, Wearables). This enables a local att...

CVE-2020-11145

CVE-2020-11145 describes a divide-by-zero flaw in the delta extension header update caused by improper validation of master SN and extension header SN in Qualcomm Snapdragon components (Auto, Compute, Connectivity, Consumer IoT, Industrial IoT, IoT, Mobile, Wearables, etc.). This is reported acro...

CVE-2020-11144

CVE-2020-11144 affects Qualcomm Snapdragon family components (Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables). Root cause: buffer over-read from decompression of invalid DL ROHC packets due to missing size check on the compressed packet...

CVE-2020-11143

Out of bound memory access during music playback with modified content due to copying data without checking destination buffer size in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon...

CVE-2020-11140

CVE-2020-11140 describes an out-of-bounds memory access during music playback with ALAC-modified content due to improper validation in Qualcomm Snapdragon components. Affected are Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, IoT, Mobile, Voice & Music, Wearables, and Wire...

CVE-2020-11139

CVE-2020-11139 describes an out-of-bounds memory access when processing frames due to insufficient validation of invalid frames in Qualcomm Snapdragon components (across Snapdragon Auto/Compute/Connectivity/IoT families). The vulnerability affects Snapdragon platforms and is associated with proce...

CVE-2020-11139

Out of bound memory access while processing frames due to lack of check of invalid frames received in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables...

CVE-2020-11136

Buffer Over-read in audio driver while using malloc management function due to not returning NULL for zero sized memory requirement in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon...

CVE-2020-11119

CVE-2020-11119 describes a buffer over-read in Snapdragon components (Auto/Compute/Connectivity/IoT/Industrial IoT, etc.) where a mismatch between the buffer length from response handlers and the payload size can trigger over-read. Affected are Qualcomm Snapdragon platforms as listed; root cause ...

CVE-2020-11119

Buffer over-read can happen when the buffer length received from response handlers is more than the size of the payload in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT...

CVE-2020-11136

CVE-2020-11136 corresponds to a buffer over-read in the Qualcomm audio driver caused by not returning NULL for a zero-sized memory request in the vulnerable Snapdragon family (Auto/Compute/Connectivity/IOT/Mobile, etc.). The issue affects Qualcomm closed‑source components and is listed as Critica...

CERT/CC and CISA Report Multiple Vulnerabilities in Dnsmasq

CISA and the CERT Coordination Center CERT/CC are aware of multiple vulnerabilities affecting Dnsmasq version 2.82 and prior. Dnsmasq is a widely-used, open-source software that provides Domain Name Service forwarding and caching and is common in Internet-of-Things IoT and other embedded devices....

CVE-2021-2052: Undefined Security Weakness

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards component: E1 IOT Orchestrator Security. The supported version that is affected is Prior to 9.2.5.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise ...