83 matches found
CVE-2023-20972
In btmvendorspecificevt of btmdevctl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID:...
PT-2023-17760 · Google · Android
Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: In the btm vendor specific evt function of btm devctl.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution...
SUSE CVE-2021-28695
IOMMU page mapping issues on x86 This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE. Both AMD and Intel allow ACPI tables to specify regions of memory which should be left untranslated, which typically means these addresse...
Researchers Uncover UEFI Secure Boot Bypass in 3 Microsoft Signed Boot Loaders
A security feature bypass vulnerability has been uncovered in three signed third-party Unified Extensible Firmware Interface UEFI boot loaders that allow bypass of the UEFI Secure Boot feature. "These vulnerabilities can be exploited by mounting the EFI System Partition and replacing the existing...
Memory corruption
Memory corruption in BT controller due to improper length check while processing vendor specific commands in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking...
CVE-2021-27252
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R7800 firmware version 1.0.2.76. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the vendorspecific DHCP opcode. The...
uEmu - Tiny Cute Emulator Plugin For IDA Based On Unicorn.
uEmu is a tiny cute emulator plugin for IDA based on unicorn engine. Supports following architectures out of the box: x86 , x64 , ARM , ARM64 , MIPS , MIPS64 What is it GOOD for? Emulate bare metal code bootloaders, embedded firmware etc Emulate standalone functions What is it BAD for? Emulate...
Replay Protected Memory Block (RPMB) protocol does not adequately defend against replay attacks
Overview The Replay Protected Memory Block RPMB protocol found in several storage specifications does not securely protect against replay attacks. An attacker with physical access can deceive a trusted component about the status of an RPBM write command or the content of an RPMB area. Description...
kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
A flaw was found in the way the mwifiexcmdappendvsietlv in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system...
kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
A flaw was found in the way the mwifiexcmdappendvsietlv in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system...
kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
A flaw was found in the way the mwifiexcmdappendvsietlv in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system...
kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
A flaw was found in the way the mwifiexcmdappendvsietlv in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system...
kernel: buffer overflow in mwifiex_cmd_append_vsie_tlv function in drivers/net/wireless/marvell/mwifiex/scan.c
A flaw was found in the way the mwifiexcmdappendvsietlv in Linux kernel's Marvell WiFi-Ex driver handled vendor specific information elements. A local user could use this flaw to escalate their privileges on the system...
kernel: heap overflow in mwifiex_update_vs_ie() function of Marvell WiFi driver
A vulnerability was found in the Linux kernel's Marvell WiFi chip driver. Where, while parsing vendor-specific informational attributes, an attacker on the same WiFi physical network segment could cause a system crash, resulting in a denial of service, or potentially execute arbitrary code. This...
CVE-2018-12038
CVE-2018-12038 is a hardware-encryption vulnerability affecting self-encrypting drives (e.g., Samsung 840 EVO, MX100/MX200/MX300, Samsung T3/T5) where wear-leveling and weak binding between the user password and the disk-encryption key can allow an attacker with physical access to recover data. T...
The vulnerability of the `lim_process_action_vendor_specific` function in the Android WLAN operating system component from the CAF repository, which allows a hacker to disclose protected information
The vulnerability of the limprocessactionvendorspecific function in the Android WLAN operating system from the CAF repository arises due to an operation occurring outside the buffer in memory. Exploiting this vulnerability could allow a remote attacker to disclose sensitive information that is...
Design/Logic Flaw
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing VENDOR specific action frame in the function limprocessactionvendorspecific, a comparison is performed with the incoming action frame body without validating if the...
CVE-2017-14882
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing VENDOR specific action frame in the function limprocessactionvendorspecific, a comparison is performed with the incoming action frame body without validating if the...
CVE-2017-14882
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, while processing VENDOR specific action frame in the function limprocessactionvendorspecific, a comparison is performed with the incoming action frame body without validating if the...
Security update for hostapd (important)
This update for hostapd fixes the following issues: - Fix KRACK attacks on the AP side boo1063479, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088: Hostap was updated to upstream release 2.6 fixed EAP-pwd last fragment validation...