RLSA-2021:4056 Important: kernel security, bug fix, and enhancement update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: use-after-free in drivers/infiniband/core/ucma.c ctx use-after-free CVE-2020-36385 kernel: out-of-bounds write due to a heap buffer overflow in hidinputchangeresolutionmultipliers of...

CVE-2021-1946

Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-1933

UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

Null pointer dereference

Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

Input validation

UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

CVE-2021-1946

CVE-2021-1946 is a null-pointer dereference in Qualcomm closed-source components (Snapdragon family) triggered by improper validation while processing crafted SDP data. The issue allows remote code execution with high impact (CVSS v3.1: 9.8, network attack, no user interaction). It affects Snapdr...

CVE-2021-1946

Null Pointer Dereference may occur due to improper validation while processing crafted SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile...

CVE-2021-1933

UE assertion is possible due to improper validation of invite message with SDP body in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Wearables...

CVE-2021-22156

An integer overflow vulnerability in the calloc function of the C runtime library of affected versions of BlackBerry® QNX Software Development Platform SDP versions 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier that could allow an attacker to...

CVE-2021-22156

CVE-2021-22156 is an integer overflow in the calloc() function of the BlackBerry QNX C runtime library, affecting SDP 6.5.0SP1 and earlier, QNX OS for Medical 1.1 and earlier, and QNX OS for Safety 1.0.1 and earlier. Exploitation could cause denial of service or arbitrary code execution; remote a...

Cross site request forgery (csrf)

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request...

PJSIP competition condition issue vulnerability

PJSIP is a free and open source multimedia communications library written in C that implements standards-based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE.A contention problem vulnerability exists in PJSIP, which stems from improper handling of concurrent access when concurrent code need...

CVE-2021-31878

An issue was discovered in PJSIP in Asterisk before 16.19.1 and before 18.5.1. To exploit, a re-INVITE without SDP must be received after Asterisk has sent a BYE request...

CVE-2021-0522

In ConnectionHandler::SdpCb of connectionhandler.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-1...

CVE-2021-25417

Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage...

Authorization

Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage...

CVE-2021-25417

CVE-2021-25417 affects the SDP SDK prior to Samsung SMR JUN-2021 Release 1, where improper authorization allows access to internal storage. The vulnerability is documented across multiple sources (NVD entry; Red Hat advisory; PRION; CVE listing; CNNVD) with CVSS v3.1 base score 7.5 (Network, Low ...

CVE-2021-25417

Improper authorization in SDP SDK prior to SMR JUN-2021 Release 1 allows access to internal storage...

ZOHO ManageEngine ServiceDesk Plus Input Validation Error Vulnerability

ZOHO ManageEngine ServiceDesk Plus SDP, an ITIL-based IT service management software from ZOHO, is vulnerable to an input validation error in versions prior to ZOHO ManageEngine ServiceDesk Plus SDP 11205, which could be exploited by an attacker to execute arbitrary commands with SYSTEM privilege...

Samsung SMR 安全漏洞

Samsung SMR is a system patch package from Samsung South Korea. It provides patches for Samsung mobile applications. A security vulnerability exists in the SDP SDK prior to SMR june -2021 version 1, which stems from incorrect authorization allowing access to internal storage...